ec2emr-iam-resources.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Creates a role for reseachers to use EC2 (full access) and EMR. Also derived from arn:aws:iam::aws:policy/job-function/DataScientist. Also creates an IAM group with similar privileges.
Parameters:
  BucketPrefixParameter:
    Type: String
    Default: cu-ec2emr
    Description: Bucket name prefix to scope S3 operations. E.g. "xyz" will restrict bucket access/operations to any buckets beginning with "zyx".
Resources:
  EC2EMRRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: shib-ec2emr
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
                Federated: !Sub "arn:aws:iam::${AWS::AccountId}:saml-provider/cornell_idp"
            Action: "sts:AssumeRoleWithSAML"
            Condition:
              StringEquals:
                SAML:aud: "https://signin.aws.amazon.com/saml"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess
        - !Ref ScopeRegionsUSEastPolicy
        - !Ref LimitedEMRPolicy

  EC2EMRGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: ec2emr-users
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess
        - !Ref ScopeRegionsUSEastPolicy
        - !Ref LimitedEMRPolicy
        - !Ref ForceMFAPolicy
      # Path: String
      # Policies:
      #   - Policies

  ScopeRegionsUSEastPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: scope-regions-us-east
      Description: Deny operations except in us-east-1, us-east-2
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Condition:
              StringNotEquals:
                aws:RequestedRegion:
                  - us-east-1
                  - us-east-2
            Action:
              - elasticmapreduce:*
              - ec2:*
              - elasticloadbalancing:*
              - cloudwatch:*
              - autoscaling:*
              - sns:*
              - logs:*
              - cloudformation:*
              - kms:*
              - s3:*
            Resource: "*"
            Effect: Deny

  LimitedEMRPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: limited-emr-access
      Description: A subset of EMR permissions based on AmazonElasticMapReduceFullAccess
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Action:
              - cloudformation:CreateStack
              - cloudformation:DescribeStackEvents
              - elasticmapreduce:*
              - iam:GetInstanceProfile
              - iam:GetRole
              - iam:GetPolicy
              - iam:GetPolicyVersion
              - iam:ListUsers
              - iam:ListPolicies
              - iam:ListRoles
              - iam:ListInstanceProfiles
              - kms:List*
              - s3:ListAllMyBuckets
              - sns:CreateTopic
              - sns:Get*
              - sns:List*
              - logs:DescribeLogStreams
              - logs:GetLogEvents
            Effect: Allow
            Resource: "*"
          -
            Effect: Allow
            Action:
              - s3:CreateBucket
              - s3:Abort*
              - s3:DeleteObject
              - s3:Get*
              - s3:List*
              - s3:PutAccelerateConfiguration
              - s3:PutBucketLogging
              - s3:PutBucketNotification
              - s3:PutBucketTagging
              - s3:PutObject
              - s3:Replicate*
              - s3:RestoreObject
            Resource:
              - !Sub "arn:aws:s3:::${BucketPrefixParameter}*"
          -
            Effect: Allow
            Action:
              - iam:GetRole
              - iam:PassRole
            Resource:
              - arn:aws:iam::*:role/DataPipelineDefaultRole
              - arn:aws:iam::*:role/DataPipelineDefaultResourceRole
              - arn:aws:iam::*:role/EMR_EC2_DefaultRole
              - arn:aws:iam::*:role/EMR_DefaultRole
              - arn:aws:iam::*:role/kinesis-*
              - arn:aws:iam::*:role/aws-ec2-spot-fleet-role
              - arn:aws:iam::*:role/aws-ec2-spot-fleet-tagging-role
          -
            Effect: Allow
            Action: iam:CreateServiceLinkedRole
            Resource: "*"
            Condition:
              StringLike:
                iam:AWSServiceName:
                  - elasticmapreduce.amazonaws.com
  ForceMFAPolicy:
        Type: AWS::IAM::ManagedPolicy
        Properties:
          ManagedPolicyName: self-manage-iam-force-mfa
          Description: Allow IAM users to manage their own credentials; require MFA; based on https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Sid: AllowAllUsersToListAccounts
              Effect: Allow
              Action:
              - iam:ListAccountAliases
              - iam:ListUsers
              - iam:ListVirtualMFADevices
              - iam:GetAccountPasswordPolicy
              - iam:GetAccountSummary
              Resource: "*"
            - Sid: AllowIndividualUserToSeeAndManageOnlyTheirOwnAccountInformation
              Effect: Allow
              Action:
              - iam:ChangePassword
              - iam:CreateAccessKey
              - iam:CreateLoginProfile
              - iam:DeleteAccessKey
              - iam:DeleteLoginProfile
              - iam:GetLoginProfile
              - iam:ListAccessKeys
              - iam:UpdateAccessKey
              - iam:UpdateLoginProfile
              - iam:ListSigningCertificates
              - iam:DeleteSigningCertificate
              - iam:UpdateSigningCertificate
              - iam:UploadSigningCertificate
              - iam:ListSSHPublicKeys
              - iam:GetSSHPublicKey
              - iam:DeleteSSHPublicKey
              - iam:UpdateSSHPublicKey
              - iam:UploadSSHPublicKey
              Resource: arn:aws:iam::*:user/${aws:username}
            - Sid: AllowIndividualUserToViewAndManageTheirOwnMFA
              Effect: Allow
              Action:
              - iam:CreateVirtualMFADevice
              - iam:DeleteVirtualMFADevice
              - iam:EnableMFADevice
              - iam:ListMFADevices
              - iam:ResyncMFADevice
              Resource:
              - arn:aws:iam::*:mfa/${aws:username}
              - arn:aws:iam::*:user/${aws:username}
            - Sid: AllowIndividualUserToDeactivateOnlyTheirOwnMFAOnlyWhenUsingMFA
              Effect: Allow
              Action:
              - iam:DeactivateMFADevice
              Resource:
              - arn:aws:iam::*:mfa/${aws:username}
              - arn:aws:iam::*:user/${aws:username}
              Condition:
                Bool:
                  aws:MultiFactorAuthPresent: 'true'
            - Sid: BlockMostAccessUnlessSignedInWithMFA
              Effect: Deny
              NotAction:
              - iam:CreateVirtualMFADevice
              - iam:DeleteVirtualMFADevice
              - iam:ListVirtualMFADevices
              - iam:EnableMFADevice
              - iam:ResyncMFADevice
              - iam:ListAccountAliases
              - iam:ListUsers
              - iam:ListSSHPublicKeys
              - iam:ListAccessKeys
              - iam:ListServiceSpecificCredentials
              - iam:ListMFADevices
              - iam:GetAccountSummary
              - sts:GetSessionToken
              - iam:ChangePassword
              - iam:CreateLoginProfile
              Resource: "*"
              Condition:
                BoolIfExists:
                  aws:MultiFactorAuthPresent: 'false'