Creating a free form configuration profile in Amazon AppConfig

Open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Policies, and then choose Create policy.

On the Create policy page, choose the JSON tab.

Update the following sample policy with information about your S3 bucket and configuration object. Then paste the policy into the text field on the JSON tab. Replace the placeholder values with your own information.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/my-configurations/my-configuration.json"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning",
        "s3:ListBucketVersions",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListAllMyBuckets",
      "Resource": "*"
    } 
  ]
}

Choose Review policy.

On the Review policy page, type a name in the Name box, and then type a description.

Choose Create policy. The system returns you to the Roles page.

Open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Roles, and then choose Create role.

On the Select type of trusted entity section, choose Amazon service.

In the Choose a use case section, under Common use cases, choose EC2, and then choose Next: Permissions.

On the Attach permissions policy page, in the search box, enter the name of the policy you created in the previous procedure.

Choose the policy and then choose Next: Tags.

On the Add tags (optional) page, enter a key and an optional value, and then choose Next: Review.

On the Review page, type a name in the Role name field, and then type a description.

Choose Create role. The system returns you to the Roles page.

On the Roles page, choose the role you just created to open the Summary page. Note the Role Name and Role ARN. You will specify the role ARN when you create the configuration profile later in this topic.

In the Summary page for the role you just created, choose the Trust Relationships tab, and then choose Edit Trust Relationship.

Delete "ec2.amazonaws.com" and add "appconfig.amazonaws.com", as shown in the following example.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "appconfig.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Choose Update Trust Policy.

Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/appconfig/.

In the navigation pane, choose Applications, and then choose an application you created in Creating a namespace for your application in Amazon AppConfig.

Choose the Configuration profiles and feature flags tab, and then choose Create configuration.

In the Configuration options section, choose Freeform configuration.

For Configuration profile name, enter a name for the configuration profile.

(Optional) Expand Description and enter a description.

(Optional) Expand Additional options and complete the following, as necessary.

1. In the Associate extensions section, choose an extension from the list.

2. In the Tags section, choose Add new tag, and then specify a key and optional value.

Choose Next.

On the Specify configuration data page, in the Configuration defition section, choose an option.

Complete the fields for the option you selected, as described in the following table.

In the Service role section, choose New service role to have Amazon AppConfig create the IAM role that provides access to the configuration data. Amazon AppConfig automatically populates the Role name field based on the name you entered earlier. Or, choose Existing service role. Choose the role by using the Role ARN list.

Optionally, on the Add validators page, choose either JSON Schema or Amazon Lambda. If you choose JSON Schema, enter the JSON Schema in the field. If you choose Amazon Lambda, choose the function Amazon Resource Name (ARN) and the version from the list.

Choose Next.

On the Review and save page, choose Save and continue to deploy.

Open the Amazon CLI.

Run the following command to create a freeform configuration profile.