Configuring permissions for AWS AppConfig - AWS AppConfig

Configuring permissions for AWS AppConfig

AWS AppConfig uses the following API actions.

AWS AppConfig resource API actions

AWS AppConfig applications

CreateApplication, UpdateApplication, DeleteApplication, GetApplication, ListApplications

For more information, see Step 1: Creating an AWS AppConfig application

Environments

CreateEnvironment, UpdateEnvironment, DeleteEnvironment, GetEnvironment, ListEnvironments

For more information, see Step 2: Creating an environment

Configurations

GetConfiguration

For more information, see Step 3: Creating a configuration and a configuration profile

Configuration profiles

CreateConfigurationProfile, UpdateConfigurationProfile, DeleteConfigurationProfile, GetConfigurationProfile, ValidateConfiguration, ListConfigurationProfiles, GetHostedConfigurationVersion, ListHostedConfigurationVersions

For more information, see Step 3: Creating a configuration and a configuration profile

Deployment strategies

CreateDeploymentStrategy, UpdateDeploymentStrategy, DeleteDeploymentStrategy, GetDeploymentStrategy, ListDeploymentStrategies, CreateDocument, UpdateDocument, DeleteDocument, GetDocument, ListDocuments

For more information, see Step 4: Creating a deployment strategy

Deployments

StartDeployment, StopDeployment, ListDeployments

For more information, see Step 5: Deploying a configuration

We recommend that you create restrictive IAM permissions policies that grant users, groups, and roles the least privileges necessary to perform a desired action in AWS AppConfig.

For example, you can create a read-only IAM permissions policy that includes only the Get and List API actions used by AWS AppConfig, like the following. 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ssm:GetDocument",
        "ssm:ListDocuments",
        "appconfig:ListApplications",
        "appconfig:GetApplication",
        "appconfig:ListEnvironments",
        "appconfig:GetEnvironment",
        "appconfig:ListConfigurationProfiles",
        "appconfig:GetConfigurationProfile",
        "appconfig:ListDeploymentStrategies",
        "appconfig:GetDeploymentStrategy",
        "appconfig:GetConfiguration",
        "appconfig:ListDeployments"
               
      ],
      "Resource": "*"
    }
  ]
}
Important

Restrict access to the StartDeployment and StopDeployment API actions to trusted users who understand the responsibilities and consequences of deploying a new configuration to your targets.

For more information about creating and editing IAM policies, see Creating IAM Policies in the IAM User Guide. For information about how to assign this policy to an IAM group, see Attaching a Policy to an IAM Group.

To configure an IAM user account with permission to use AWS AppConfig

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Users.

  3. In the list, choose a name.

  4. Choose the Permissions tab.

  5. On the right side of the page, under Permission policies, choose Add inline policy.

  6. Choose the JSON tab.

  7. Replace the default content with your custom permissions policy.

  8. Choose Review policy.

  9. On the Review policy page, for Name, enter a name for the inline policy. For example: AWSAppConfig-<action>-Access.

  10. Choose Create policy.