IAM policy examples for GameLift
You can use the following examples to create inline policies and add the appropriate permissions to your IAM users or user groups.
Simple policy examples for administrators
These policy examples illustrate how to provide full administrative access to a user.
Policy for GameLift resource permissions
The following policy example covers access to all GameLift-related resources (fleets, queues, game sessions, matchmakers, etc.). All users who manage or view these resources need this type of permissions policy.
{ "Version": "2012-10-17", "Statement": { "Effect": "Allow", "Action": "gamelift:*", "Resource": "*" } }
Policy for GameLift resource and PassRole permissions
This policy example provides access to GameLift-related resources as above. It also
allows the user to pass an IAM service role to GameLift. Not all users need to have
PassRole permission; it is used to give GameLift limited ability to access resources
in
other services on your behalf. For example, you need this permission when calling
CreateBuild
with an IAM role that allows GameLift to access your build
files in an S3 bucket. For more information on PassRole, see the IAM User Guide topic IAM:
Pass an IAM role to a specific AWS service.
{ "Version": "2012-10-17", "Statement":[ { "Effect": "Allow", "Action": "gamelift:*", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": {"iam:PassedToService": "gamelift.amazonaws.com"} } }] }
Simple policy examples for players
The following policy examples illustrate how to enable game clients and/or game client services with the functionality to get players into game sessions. These examples cover the key scenarios that games might use to start new game sessions and assign players to available player slots.
Policy for game session placements
This policy example is for a game client service that uses game session queues and placements to start new game sessions. Players might be added to a game session either in the initial placement request or by creating new player sessions for an existing game session.
{ "Version": "2012-10-17", "Statement": { "SID": "PlayerPermissionsForGameSessionPlacements", "Effect": "Allow", "Action": [ "gamelift:StartGameSessionPlacement", "gamelift:DescribeGameSessionPlacement", "gamelift:StopGameSessionPlacement", "gamelift:CreatePlayerSession", "gamelift:CreatePlayerSessions", "gamelift:DescribeGameSessions" ], "Resource": "*" } }
Policy for matchmaking
This policy example is for a game client or client service that uses GameLift FlexMatch matchmaking. Players might be matched and placed into a new game session or they might be added to an existing game session through the backfill process.
{ "Version": "2012-10-17", "Statement": { "SID": "PlayerPermissionsForGameSessionMatchmaking", "Effect": "Allow", "Action": [ "gamelift:StartMatchmaking", "gamelift:DescribeMatchmaking", "gamelift:StopMatchmaking", "gamelift:AcceptMatch", "gamelift:StartMatchBackfill", "gamelift:DescribeGameSessions" ], "Resource": "*" } }
Policy for manual game session placement
This policy example is for a game client or client service that creates new game sessions on specific fleets and might create new player sessions in specific game sessions. This scenario supports a game that uses the "list-and-pick" method to let players choose from list of available game sessions.
{ "Version": "2012-10-17", "Statement": { "SID": "PlayerPermissionsForManualGameSessions", "Effect": "Allow", "Action": [ "gamelift:CreateGameSession", "gamelift:DescribeGameSessions", "gamelift:SearchGameSessions", "gamelift:CreatePlayerSession", "gamelift:CreatePlayerSessions", "gamelift:DescribePlayerSessions" ], "Resource": "*" } }