Configuring roles and permissions for Change Manager

Open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Policies, and then choose Create Policy.

On the Create policy page, choose the JSON tab and replace the default content with the following, which you will modify for your own Change Manager operations in following steps.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws-cn:iam::delegated-admin-account-id:role/AWS-SystemsManager-job-functionAdministrationRole",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "ssm.amazonaws.com.cn"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeDocument",
                "ssm:GetDocument",
                "ssm:StartChangeRequestExecution"
            ],
            "Resource": [
                "arn:aws-cn:ssm:region:account-id:automation-definition/template-name:$DEFAULT",
                "arn:aws-cn:ssm:region::document/template-name"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:ListOpsItemEvents",
                "ssm:GetOpsItem",
                "ssm:ListDocuments",
                "ssm:DescribeOpsItems"
            ],
            "Resource": "*"
        }
    ]
}

For the iam:PassRole action, update the Resource value to include the ARNs of all job functions defined for your organization that you want to grant permissions to initiate runbook workflows.

Replace the region, account-id, template-name, delegated-admin-account-id, and job-function placeholders with values for your Change Manager operations.

For the second Resource statement, modify the list to include all change templates that you want to grant permissions for. Alternatively, specify "Resource": "*" to grant permissions for all change templates in your organization.

Choose Next: Tags.

(Optional) Add one or more tag-key value pairs to organize, track, or control access for this policy.

Choose Next: Review.

On the Review policy page, enter a name in the Name box, such as MyChangeManagerAssumeRole, and then enter an optional description.

Choose Create policy, and continue to Task 2: Creating an assume role for Change Manager.

Open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Roles, and then choose Create role.

For Select trusted entity, make the following choices:

Choose Next.

On the Attached permissions policy page, search for the assume role policy you created in Task 1: Creating an assume role policy for Change Manager, such as MyChangeManagerAssumeRole.

Select the check box next to the assume role policy name, and then choose Next: Tags.

For Role name, enter a name for your new instance profile, such as MyChangeManagerAssumeRole.

(Optional) For Description, update the description for this instance role.

(Optional) Add one or more tag-key value pairs to organize, track, or control access for this role.

Choose Next: Review.

(Optional) For Tags, add one or more tag-key value pairs to organize, track, or control access for this role, and then choose Create role. The system returns you to the Roles page.

Choose Create role. The system returns you to the Roles page.

On the Roles page, choose the role you just created to open the Summary page.

Open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Roles.

Search for the Change Manager assume role you created, such as MyChangeManagerAssumeRole, and choose its name.

In the Summary page for the assume role, choose the Permissions tab.

Choose Add permissions, Create inline policy.

On the Create policy page, choose the Visual editor tab.

Choose Service, and then choose IAM.

In the Filter actions text box, enter PassRole, and then choose the PassRole option.

Expand Resources. Verify that Specific is selected, and then choose Add ARN.

In the Specify ARN for role field, enter the ARN of the IAM instance profile role or IAM service role to which you want to pass assume role permissions. The system populates the Account and Role name with path fields.

Choose Add.

Choose Review policy.

For Name, enter a name to identify this policy, and then choose Create policy.

Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/.

In the navigation pane, choose Roles.

In the list, choose the name of the assume role that you want to update, such as MyChangeManagerAssumeRole.

Choose the Permissions tab.

Choose Add permissions, Create inline policy.

Choose the JSON tab.

Enter a JSON policy document for the Amazon Web Services you want to invoke. Here are two example JSON policy documents.

Amazon S3 PutObject and GetObject example

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*"
        }
    ]
}
        

Amazon EC2 CreateSnapshot and DescribeSnapShots example

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":"ec2:CreateSnapshot",
         "Resource":"*"
      },
      {
         "Effect":"Allow",
         "Action":"ec2:DescribeSnapshots",
         "Resource":"*"
      }
   ]
}

For details about the IAM policy language, see IAM JSON policy reference in the IAM User Guide.

When you're finished, choose Review policy. The Policy Validator reports any syntax errors.

For Name, enter a name to identify the policy that you're creating. Review the policy Summary to see the permissions that are granted by your policy. Then choose Create policy to save your work.

After you create an inline policy, it's automatically embedded in your role.