baseline.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: Baseline IAM resources for new account

Parameters:
  AdminUsername:
    Type: String
    Description: Username for the Admin user
  AdminPassword:
    Type: String
    NoEcho: True
    MinLength: 1
    Description: Password for the Admin user

Resources:
  FullAccess:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: Admin
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 
              - cloudtrail:DescribeTrails
              - ec2:DescribeTags
              - ec2:DescribeVolumes
              - ec2:DescribeInstances
              - ec2:DescribeHosts
              - config:PutEvaluations
              - config:PutConfigRule
              - config:PutConfigurationRecorder
              - config:PutDeliveryChannel
              - config:PutEvaluations
              - config:GetComplianceDetailsByConfigRule
              - config:GetComplianceDetailsByResource
              - config:GetComplianceSummaryByConfigRule
              - config:GetComplianceSummaryByResourceType
              - config:GetResourceConfigHistory
              - config:ListDiscoveredResources
              - config:DescribeComplianceByConfigRule
              - config:DescribeComplianceByResource
              - config:DescribeConfigRuleEvaluationStatus
              - config:DescribeConfigRules
              - config:DescribeConfigurationRecorders
              - config:DescribeConfigurationRecorderStatus
              - cloudtrail:GetTrailStatus
              - s3:GetObject
              - iam:GetAccountAuthorizationDetails
              - iam:GetAccountPasswordPolicy
              - iam:GetAccountSummary
              - iam:GetGroup
              - iam:GetGroupPolicy
              - iam:GetPolicy
              - iam:GetPolicyVersion
              - iam:GetRole
              - iam:GetRolePolicy
              - iam:GetUser
              - iam:GetUserPolicy
              - iam:ListAttachedGroupPolicies
              - iam:ListAttachedRolePolicies
              - iam:ListAttachedUserPolicies
              - iam:ListEntitiesForPolicy
              - iam:ListGroupPolicies
              - iam:ListGroupsForUser
              - iam:ListInstanceProfilesForRole
              - iam:ListPolicyVersions
              - iam:ListRolePolicies
              - iam:ListUserPolicies
              - elasticloadbalancing:DescribeLoadBalancers
              - elasticloadbalancing:DescribeLoadBalancerAttributes
              - elasticloadbalancing:DescribeTags
              - acm:DescribeCertificate
              - acm:ListCertificates
              - acm:ListTagsForCertificate
              - rds:DescribeDBInstances
              - rds:DescribeDBSecurityGroups
              - rds:DescribeDBSnapshotAttributes
              - rds:DescribeDBSnapshots
              - rds:DescribeDBSubnetGroups
              - rds:DescribeEventSubscriptions
              - rds:ListTagsForResource
              - rds:DescribeDBClusters
              - s3:GetAccelerateConfiguration
              - s3:GetBucketAcl
              - s3:GetBucketCORS
              - s3:GetBucketLocation
              - s3:GetBucketLogging
              - s3:GetBucketNotification
              - s3:GetBucketPolicy
              - s3:GetBucketRequestPayment
              - s3:GetBucketTagging
              - s3:GetBucketVersioning
              - s3:GetBucketWebsite
              - s3:GetLifecycleConfiguration
              - s3:GetReplicationConfiguration
              - s3:ListAllMyBuckets
              - redshift:DescribeClusterParameterGroups
              - redshift:DescribeClusterParameters
              - redshift:DescribeClusterSecurityGroups
              - redshift:DescribeClusterSnapshots
              - redshift:DescribeClusterSubnetGroups
              - redshift:DescribeClusters
              - redshift:DescribeEventSubscriptions
              - redshift:DescribeLoggingStatus
              - dynamodb:DescribeLimits
              - dynamodb:DescribeTable
              - dynamodb:ListTables
              - cloudwatch:DescribeAlarms
            Resource: "*"
      Groups:
        - Ref: Administrators
      Roles:
        - Ref: AdminRole

  Admin:
    Type: AWS::IAM::User
    Properties:
      UserName: !Ref AdminUsername
      Path: "/"
      LoginProfile:
        Password: !Ref AdminPassword


  Administrators:
    Type: AWS::IAM::Group
    Properties:
      GroupName: administrators
      Path: "/"


  AddUserToGroup:
    Type: AWS::IAM::UserToGroupAddition
    Properties:
      GroupName: !Ref Administrators
      Users:
      - Ref: Admin

  AdminRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: adminrole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"