AWSSupport-GrantPermissionsToIAMUser - Amazon Systems Manager Automation runbook reference
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWSSupport-GrantPermissionsToIAMUser

Description

This runbook grants the specified permissions to an IAM group (new or existing), and adds the existing IAM user to it. Policies you can choose from: Billing or Support . To enable billing access for IAM, remember to also activate IAM user and federated user access to the Billing and Cost Management pages .

Important

If you provide an existing IAM group, all current IAM users in the group receive the new permissions.

Run this Automation (console)

Document type

Automation

Owner

Amazon

Platforms

Linux, macOS, Windows

Parameters

  • AutomationAssumeRole

    Type: String

    Description: (Optional) The Amazon Resource Name (ARN) of the Amazon Identity and Access Management (IAM) role that allows Systems Manager Automation to perform the actions on your behalf. If no role is specified, Systems Manager Automation uses the permissions of the user that starts this runbook.

  • IAMGroupName

    Type: String

    Default: ExampleSupportAndBillingGroup

    Description: (Required) Can be a new or existing group. Must comply with IAM Entity Name Limits .

  • IAMUserName

    Type: String

    Default: ExampleUser

    Description: (Required) Must be an existing user.

  • LambdaAssumeRole

    Type: String

    Description: (Optional) The ARN of the role assumed by lambda.

  • Permissions

    Type: String

    Valid values: SupportFullAccess | BillingFullAccess | SupportAndBillingFullAccess

    Default: SupportAndBillingFullAccess

    Description: (Required) Choose one of: SupportFullAccess grants full access to the Support center. BillingFullAccess grants full access to the Billing dashboard. SupportAndBillingFullAccess grants full access to both Support center and the Billing dashboard. More info on policies under Document details.

Required IAM permissions

The AutomationAssumeRole parameter requires the following actions to use the runbook successfully.

The permissions required depend on how AWSSupport-GrantPermissionsToIAMUser is run.

Running as the currently logged in user or role

It is recommended you have the AmazonSSMAutomationRole Amazon managed policy attached, and the following additional permissions to be able to create the Lambda function and the IAM role to pass to Lambda: 

{
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Action": [
                                "lambda:InvokeFunction",
                                "lambda:CreateFunction",
                                "lambda:DeleteFunction",
                                "lambda:GetFunction"
                            ],
                            "Resource": "arn:aws:lambda:*:ACCOUNTID:function:AWSSupport-*",
                            "Effect": "Allow"
                        },
                        {
                            "Effect" : "Allow",
                            "Action" : [
                                "iam:CreateGroup",
                                "iam:AddUserToGroup",
                                "iam:ListAttachedGroupPolicies",
                                "iam:GetGroup",
                                "iam:GetUser"
                            ],
                            "Resource" : [
                                "arn:aws:iam::*:user/*",
                                "arn:aws:iam::*:group/*"
                            ]
                        },
                        {
                            "Effect" : "Allow",
                            "Action" : [
                                "iam:AttachGroupPolicy"
                            ],
                            "Resource": "*",
                            "Condition": {
                                "ArnEquals": {
                                    "iam:PolicyArn": [
                                        "arn:aws:iam::aws:policy/job-function/Billing",
                                        "arn:aws:iam::aws:policy/AWSSupportAccess"
                                    ]
                                }
                            }
                        },
                        {
                            "Effect" : "Allow",
                            "Action" : [
                                "iam:ListAccountAliases",
                                "iam:GetAccountSummary"
                            ],
                            "Resource" : "*"
                        }
                    ]
                }

Using AutomationAssumeRole and LambdaAssumeRole

The user must have the ssm:StartAutomationExecution permissions on the runbook, and iam:PassRole on the IAM roles passed as AutomationAssumeRole and LambdaAssumeRole . Here are the permissions each IAM role needs: 

AutomationAssumeRole

                    {
                        "Version": "2012-10-17",
                        "Statement": [
                            {
                                "Action": [
                                    "lambda:InvokeFunction",
                                    "lambda:CreateFunction",
                                    "lambda:DeleteFunction",
                                    "lambda:GetFunction"
                                ],
                                "Resource": "arn:aws:lambda:*:ACCOUNTID:function:AWSSupport-*",
                                "Effect": "Allow"
                            }
                        ]
                    }
            
LambdaAssumeRole

                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect" : "Allow",
                            "Action" : [
                                "iam:CreateGroup",
                                "iam:AddUserToGroup",
                                "iam:ListAttachedGroupPolicies",
                                "iam:GetGroup",
                                "iam:GetUser"
                            ],
                            "Resource" : [
                                "arn:aws:iam::*:user/*",
                                "arn:aws:iam::*:group/*"
                            ]
                        },
                        {
                            "Effect" : "Allow",
                            "Action" : [
                                "iam:AttachGroupPolicy"
                            ],
                            "Resource": "*",
                            "Condition": {
                                "ArnEquals": {
                                    "iam:PolicyArn": [
                                        "arn:aws:iam::aws:policy/job-function/Billing",
                                        "arn:aws:iam::aws:policy/AWSSupportAccess"
                                    ]
                                }
                            }
                        },
                        {
                            "Effect" : "Allow",
                            "Action" : [
                                "iam:ListAccountAliases",
                                "iam:GetAccountSummary"
                            ],
                            "Resource" : "*"
                        }
                    ]
                }

Document Steps

  1. aws:createStack - Run Amazon CloudFormation Template to create a Lambda function.

  2. aws:invokeLambdaFunction - Run Lambda to set IAM permissions.

  3. aws:deleteStack - Delete CloudFormation Template.

Outputs

configureIAM.Payload