giuseppe-trisciuoglio/developer-kit

Comprehensive developer toolkit providing reusable skills for Java/Spring Boot, TypeScript/NestJS/React/Next.js, Python, PHP, AWS CloudFormation, AI/RAG, DevOps, and more.

Quality

82%

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

Securityby

Risky

Do not use without reviewing

Validation failed for skills in this tile

One or more skills have errors that need to be fixed before they can move to Implementation and Discovery review.

AWS CloudFormation IAM - Reference

Name: giuseppe-trisciuoglio/developer-kit
Rating: 82.6470588235294 (1 reviews)
Author: giuseppe-trisciuoglio

This reference guide contains detailed information about AWS CloudFormation resources, intrinsic functions, and configurations for IAM infrastructure.

AWS::IAM::User

Creates an IAM user for your AWS account.

Properties

Property	Type	Required	Description
UserName	String	Yes	The name of the user
Path	String	No	The path for the user name
Groups	List of String	No	A list of group names to associate with the user
ManagedPolicyArns	List of String	No	A list of managed policy ARNs to attach to the user
PermissionsBoundary	String	No	The ARN of the policy used to set the permissions boundary
Policies	List of Policy	No	A list of embedded policies to attach to the user
Tags	List of Tag	No	A list of tags to attach to the user

Policy Structure

Policy:
  PolicyName: String
  PolicyDocument: PolicyDocument

PolicyDocument Structure

PolicyDocument:
  Version: String
  Statement: List of Statement

Statement Structure

Statement:
  - Sid: String
    Effect: String
    Principal: Principal
    NotPrincipal: Principal
    Action: List of String or String
    NotAction: List of String or String
    Resource: List of String or String
    NotResource: List of String or String
    Condition: Condition

Example

Resources:
  AppUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Sub "${AWS::StackName}-app-user"
      Path: /applications/
      Groups:
        - !Ref AppUserGroup
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-custom-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:ListBucket
                Resource:
                  - !Ref DataBucketArn
                  - !Sub "${DataBucketArn}/*"
      Tags:
        - Key: Environment
          Value: !Ref Environment

Attributes

Attribute	Description
Arn	The ARN of the user
UserId	The unique identifier for the user

AWS::IAM::Role

Creates an IAM role that you can assume to delegate permissions.

Properties

Property	Type	Required	Description
RoleName	String	No	The name of the role
AssumeRolePolicyDocument	PolicyDocument	Yes	The policy that grants an entity permission to assume the role
ManagedPolicyArns	List of String	No	A list of managed policy ARNs to attach to the role
MaxSessionDuration	Integer	No	The maximum session duration in seconds (900-43200)
PermissionsBoundary	String	No	The ARN of the policy used to set the permissions boundary
Policies	List of Policy	No	A list of embedded policies to attach to the role
Description	String	No	A description for the role
Tags	List of Tag	No	A list of tags to attach to the role

Principal Types

Principal:
  Service: List of String or String
  AWS: List of String or String
  Federated: List of String or String

Example with Service Principal

Resources:
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-lambda-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      MaxSessionDuration: 3600
      Policies:
        - PolicyName: !Sub "${AWS::StackName}-dynamodb-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                Resource: !GetAtt DataTable.Arn

Example with AWS Principal

Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-crossaccount"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${SourceAccountId}:root"
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:Externalid: !Ref ExternalId
      Policies:
        - PolicyName: ReadOnly
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:ListBucket
                Resource: "*"

Attributes

Attribute	Description
Arn	The ARN of the role
RoleId	The unique identifier for the role

AWS::IAM::Policy

Creates an IAM policy for an IAM user, group, or role.

Properties

Property	Type	Required	Description
PolicyName	String	Yes	The name of the policy
Groups	List of String	No	A list of group names to attach the policy to
Roles	List of String	No	A list of role names to attach the policy to
Users	List of String	No	A list of user names to attach the policy to
ManagedPolicyArns	List of String	No	A list of additional managed policy ARNs to attach
PolicyDocument	PolicyDocument	Yes	The policy document

Example

Resources:
  S3ReadPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: !Sub "${AWS::StackName}-s3-read"
      Groups:
        - !Ref ReadOnlyGroup
      Roles:
        - !Ref ReadOnlyRole
      Users:
        - !Ref ReadOnlyUser
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
              - s3:GetObjectVersion
              - s3:ListBucket
            Resource:
              - !Ref DataBucketArn
              - !Sub "${DataBucketArn}/*"

Attributes

Attribute	Description
Arn	The ARN of the policy

AWS::IAM::ManagedPolicy

Creates a managed policy that you can attach to multiple users, groups, or roles.

Properties

Property	Type	Required	Description
ManagedPolicyName	String	No	The name of the managed policy
Description	String	No	A description of the managed policy
Path	String	No	The path for the policy name
Groups	List of String	No	A list of group names to attach the policy to
Roles	List of String	No	A list of role names to attach the policy to
Users	List of String	No	A list of user names to attach the policy to
PolicyDocument	PolicyDocument	Yes	The policy document

Example

Resources:
  CustomReadOnlyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub "${AWS::StackName}-custom-readonly"
      Description: Custom read-only access policy
      Path: /custom/
      Groups:
        - !Ref AppGroup
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - s3:Get*
              - s3:List*
            Resource: "*"
          - Effect: Allow
            Action:
              - dynamodb:Get*
              - dynamodb:Query
              - dynamodb:Scan
            Resource: "*"

Attributes

Attribute	Description
Arn	The ARN of the managed policy

AWS::IAM::UserLoginProfile

Creates a password for an IAM user. The password allows access to the AWS Management Console.

Properties

Property	Type	Required	Description
UserName	String	Yes	The name of the IAM user
Password	String	No	The password for the IAM user
PasswordResetRequired	Boolean	No	Whether the user is required to reset their password

Example

Resources:
  ConsoleUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Sub "${AWS::StackName}-console-user"

  UserLoginProfile:
    Type: AWS::IAM::UserLoginProfile
    Properties:
      UserName: !Ref ConsoleUser
      Password: !Ref InitialPassword
      PasswordResetRequired: true

AWS::IAM::AccessKey

Creates an access key and secret key for an IAM user.

Properties

Property	Type	Required	Description
UserName	String	Yes	The name of the IAM user
Status	String	No	The status of the access key (Active or Inactive)
Serial	Integer	No	The serial number for the access key

Example

Resources:
  AppUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Sub "${AWS::StackName}-app-user"

  UserAccessKey:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref AppUser
      Status: Active
      Serial: 1

  UserSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub "${AWS::StackName}/credentials"
      SecretString: !Sub |
        {
          "access_key": "${UserAccessKey.Ref}",
          "secret_key": "{{resolve:secretsmanager:${UserAccessKey.SecretAccessKey}}}"
        }

Attributes

Attribute	Description
SecretAccessKey	The secret key for the access key
Ref	The access key ID

AWS::IAM::InstanceProfile

Creates an instance profile that can be used to pass an IAM role to an EC2 instance.

Properties

Property	Type	Required	Description
InstanceProfileName	String	No	The name of the instance profile
Roles	List of String	Yes	A list of role names to associate with the instance profile
Path	String	No	The path for the instance profile name

Example

Resources:
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-ec2-role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub "${AWS::StackName}-profile"
      Roles:
        - !Ref EC2Role

  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      IamInstanceProfile: !Ref EC2InstanceProfile

Attributes

Attribute	Description
Arn	The ARN of the instance profile

AWS::IAM::UserToGroupAddition

Adds an IAM user to an IAM group.

Properties

Property	Type	Required	Description
GroupName	String	Yes	The name of the group
Users	List of String	Yes	A list of user names to add to the group

Example

Resources:
  DevelopersGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: !Sub "${AWS::StackName}-developers"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/ReadOnlyAccess

  AppUser:
    Type: AWS::IAM::User
    Properties:
      UserName: !Sub "${AWS::StackName}-developer"

  UserGroupMembership:
    Type: AWS::IAM::UserToGroupAddition
    Properties:
      GroupName: !Ref DevelopersGroup
      Users:
        - !Ref AppUser
        - !Ref AnotherUser

AWS::IAM::ServerCertificate

Uploads a server certificate and saves it in IAM.

Properties

Property	Type	Required	Description
ServerCertificateName	String	No	The name for the server certificate
CertificateBody	String	Yes	The certificate body
PrivateKey	String	Yes	The private key
CertificateChain	String	No	The certificate chain
Path	String	No	The path for the server certificate

Example

Resources:
  SSLCertificate:
    Type: AWS::IAM::ServerCertificate
    Properties:
      ServerCertificateName: !Sub "${AWS::StackName}-ssl-cert"
      CertificateBody: |
        -----BEGIN CERTIFICATE-----
        MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiUMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
        BAYTAlVTMRUwEwYDVQQIDAxDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
        c2NvMRAwDgYDVQQKDAdFeGFtcGxlMRswGQYJKoZIhvcNAQkBFgx1c2VyQGV4YW1w
        bGUuY29tMB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEwMTAwMDAwMFowRTELMAkGA1UE
        BhMCVVMxFTATBgNVBAgMDENhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lz
        Y28xEDAOBgNVBAoMB0V4YW1wbGUxGzAZBgkqhkiG9w0BCQEWDHVzZXJAZXhhbXBs
       ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7fRXEe2x0qJqx
        hE4GjKqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
        DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
        8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
        DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
        8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
        AgMBAAGjUzBRMB0GA1UdDgQWBBTBBXcvR1q3c1B1jZfYvLrYQ5GfAfGA8wDgYD
        VR0PAQH/BAQDAgeAMBMGA1UdIwQMMAoECE31k7i4q5+rMA0GCSqGSIb3DQEBCwUA
        A4IBAQCk0pHvp8pwh3hUBDqK3x2j5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5
        V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9
        w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w
        3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3
        d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d
        -----END CERTIFICATE-----
      PrivateKey: |
        -----BEGIN RSA PRIVATE KEY-----
        MIIEowIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8h+3hY0J8dC4a4b4e8c9f0e1d2
        c3b4a5d6e7f8g9h0i1j2k3l4m5n6o7p8q9r0s1t2u3v4w5x6y7z8A9B0C1D2E3
        F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4A5B6C7D8E9F0G1H2I3J4
        K5L6M7N8O9P0Q1R2S3T4U5V6W7X8Y9Z0A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5
        P6Q7R8S9T0U1V2W3X4Y5Z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0O1P2Q3R4S5T6
        U7V8W9X0Y1Z2A3B4C5D6E7F8G9H0I1J2K3L4M5N6O7P8Q9R0S1T2U3V4W5X6Y7
        Z8A9B0C1D2E3F4G5H6I7J8K9L0M1N2O3P4Q5R6S7T8U9V0W1X2Y3Z4A5B6C7D8
        E9F0G1H2I3J4K5L6M7N8O9P0Q1R2S3T4U5V6W7X8Y9Z0A1B2C3D4E5F6G7H8I9
        J0K1L2M3N4O5P6Q7R8S9T0U1V2W3X4Y5Z6A7B8C9D0E1F2G3H4I5J6K7L8M9N0
        O1P2Q3R4S5T6U7V8W9X0Y1Z2A3B4C5D6E7F8G9H0I1J2K3L4M5N6O7P8Q9R0S1
        -----END RSA PRIVATE KEY-----
      CertificateChain: |
        -----BEGIN CERTIFICATE-----
        MIIDXTCCAkWgAwIBAgIJAJC1HiIAZAiUMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
        BAYTAlVTMRUwEwYDVQQIDAxDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
        c2NvMRAwDgYDVQQKDAdFeGFtcGxlMRswGQYJKoZIhvcNAQkBFgx1c2VyQGV4YW1w
        bGUuY29tMB4XDTIzMDEwMTAwMDAwMFoXDTI0MDEwMTAwMDAwMFowRTELMAkGA1UE
        BhMCVVMxFTATBgNVBAgMDENhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lz
        Y28xEDAOBgNVBAoMB0V4YW1wbGUxGzAZBgkqhkiG9w0BCQEWDHVzZXJAZXhhbXBs
        ZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7fRXEe2x0qJqx
        hE4GjKqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
        DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
        8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
        DeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG
        8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJDeU3Q8hZG8U8XjLqPJ
        AgMBAAGjUzBRMB0GA1UdDgQWBBTBBXcvR1q3c1B1jZfYvLrYQ5GfAfGA8wDgYD
        VR0PAQH/BAQDAgeAMBMGA1UdIwQMMAoECE31k7i4q5+rMA0GCSqGSIb3DQEBCwUA
        A4IBAQCk0pHvp8pwh3hUBDqK3x2j5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5
        V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9
        w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w
        3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3
        d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d5x3E5V9w3d
        -----END CERTIFICATE-----

Attributes

Attribute	Description
Arn	The ARN of the server certificate

AWS::Organizations::Policy

Creates a policy in an organization or in an organizational unit.

Properties

Property	Type	Required	Description
Name	String	Yes	The name of the policy
Description	String	No	A description of the policy
Type	String	Yes	The type of policy (SERVICE_CONTROL_POLICY, TAG_POLICY, BACKUP_POLICY, AI_SERVICES_OPT_OUT_POLICY)
Content	JSON	Yes	The policy content as JSON
TargetIds	List of String	No	A list of organizational unit IDs or account IDs to attach the policy to

Example with SCP

Resources:
  RestrictiveSCP:
    Type: AWS::Organizations::Policy
    Properties:
      Name: !Sub "${AWS::StackName}-restrictive"
      Description: SCP to restrict dangerous operations
      Type: SERVICE_CONTROL_POLICY
      Content:
        Version: "2012-10-17"
        Statement:
          - Sid: DenyDeleteProduction
            Effect: Deny
            Action:
              - s3:DeleteBucket
              - dynamodb:DeleteTable
              - rds:DeleteDBInstance
            Resource: "*"
            Condition:
              StringEquals:
                aws:ResourceTag/environment: production
          - Sid: RequireEncryption
            Effect: Deny
            Action:
              - s3:PutObject
            Resource: "*"
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: AES256

AWS::SSO::PermissionSet

Creates a permission set that you can assign to your workforce identities.

Properties

Property	Type	Required	Description
InstanceArn	String	Yes	The ARN of the SSO instance
PermissionSetName	String	Yes	The name of the permission set
Description	String	No	A description of the permission set
SessionDuration	String	No	The duration of the session (ISO 8601 duration format)
RelayStateType	String	No	The relay state URL
ManagedPolicies	List of String	No	A list of managed policy ARNs
InlinePolicy	String	No	An inline policy document

Example

Resources:
  AdminPermissionSet:
    Type: AWS::SSO::PermissionSet
    Properties:
      InstanceArn: !Ref SSOInstanceArn
      PermissionSetName: !Sub "${AWS::StackName}-admin"
      Description: Administrator access permission set
      SessionDuration: PT8H
      ManagedPolicies:
        - arn:aws:iam::aws:policy/AdministratorAccess
      InlinePolicy: |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": ["aws-portal:*Billing"],
              "Resource": "*"
            }
          ]
        }

Attributes

Attribute	Description
PermissionSetArn	The ARN of the permission set

AWS::SSO::AccountAssignment

Assigns access to a principal in a specific AWS account using a permission set.

Properties

Property	Type	Required	Description
InstanceArn	String	Yes	The ARN of the SSO instance
PermissionSetArn	String	Yes	The ARN of the permission set
PrincipalId	String	Yes	The ID of the principal
PrincipalType	String	Yes	The type of principal (USER or GROUP)
TargetId	String	Yes	The ID of the AWS account
TargetType	String	Yes	The type of target (AWS_ACCOUNT)

Example

Resources:
  AdminPermissionSet:
    Type: AWS::SSO::PermissionSet
    Properties:
      InstanceArn: !Ref SSOInstanceArn
      PermissionSetName: !Sub "${AWS::StackName}-admin"
      ManagedPolicies:
        - arn:aws:iam::aws:policy/AdministratorAccess

  AdminAssignment:
    Type: AWS::SSO::AccountAssignment
    Properties:
      InstanceArn: !Ref SSOInstanceArn
      PermissionSetArn: !Ref AdminPermissionSet.PermissionSetArn
      PrincipalId: !Ref AdminGroupId
      PrincipalType: GROUP
      TargetId: !Ref TargetAccountId
      TargetType: AWS_ACCOUNT

AWS::IAM::ServiceLinkedRole

Creates an IAM service-linked role for an AWS service.

Properties

Property	Type	Required	Description
AWSServiceName	String	Yes	The service name for which the role is created
Description	String	No	A description of the role
CustomSuffix	String	No	A custom suffix for the role name
SupportedServices	List of String	No	A list of services that can assume the role

Example

Resources:
  AutoScalingServiceRole:
    Type: AWS::IAM::ServiceLinkedRole
    Properties:
      AWSServiceName: autoscaling.amazonaws.com
      Description: Service-linked role for Auto Scaling
      CustomSuffix: auto-scaling

AWS::IAM::SAMLProvider

Creates an IAM SAML identity provider.

Properties

Property	Type	Required	Description
SAMLMetadataDocument	String	Yes	The XML metadata document
Name	String	No	The name of the SAML provider

Example

Resources:
  SAMLProvider:
    Type: AWS::IAM::SAMLProvider
    Properties:
      Name: !Sub "${AWS::StackName}-saml"
      SAMLMetadataDocument: !Ref MetadataDocument

Attributes

Attribute	Description
Arn	The ARN of the SAML provider

AWS::IAM::OIDCProvider

Creates an IAM OpenID Connect provider.

Properties

Property	Type	Required	Description
Url	String	Yes	The URL for the OIDC provider
ClientIdList	List of String	No	A list of client IDs
ThumbprintList	List of String	No	A list of thumbprints
Tags	List of Tag	No	A list of tags to attach

Example

Resources:
  OIDCProvider:
    Type: AWS::IAM::OIDCProvider
    Properties:
      Url: !Sub "https://${OidcProviderEndpoint}"
      ClientIdList:
        - !Ref ClientId
      ThumbprintList:
        - !Ref Thumbprint

Condition Keys Reference

AWS-Specific Condition Keys

Condition Key	Type	Description
aws:SourceIp	IP address	Source IP address of the requester
aws:RequestedRegion	String	AWS region requested
aws:ResourceTag/tag-key	String	Tag value on the resource
aws:PrincipalTag/tag-key	String	Tag value on the principal
aws:MultiFactorAuthPresent	Boolean	Whether MFA was used
aws:MultiFactorAuthAge	Numeric	Age of the MFA session
aws:EpochTime	Numeric	Time of the request
aws:CurrentTime	Date	Current time
aws:SecureTransport	Boolean	Whether SSL was used

S3-Specific Condition Keys

Condition Key	Type	Description
s3:prefix	String	Prefix for ListBucket
s3:Delimiter	String	Delimiter for ListBucket
s3:x-amz-server-side-encryption	String	Server-side encryption algorithm
s3:x-amz-acl	String	Access control list
s3:ExistingObjectTag/tag-key	String	Tag on existing object
s3:RequestObjectTag/tag-key	String	Tag on object being uploaded

DynamoDB-Specific Condition Keys

Condition Key	Type	Description
dynamodb:TableName	String	Name of the table
dynamodb:Select	String	Select type
dynamodb:Attributes	List	Attributes to return
dynamodb:ReturnValues	String	Return values type
dynamodb:QueryFilter	Map	Query filter conditions

IAM-Specific Condition Keys

Condition Key	Type	Description
iam:ResourceTag/tag-key	String	Tag on IAM resource
iam:PrincipalTag/tag-key	String	Tag on principal
iam:AWSServiceName	String	Service name for service roles
sts:Externalid	String	External ID for role assumption
sts:SourceIdentity	String	Source identity

KMS-Specific Condition Keys

Condition Key	Type	Description
kms:EncryptionContext:key	String	Encryption context
kms:ViaService	String	Service that can use the key
kms:GrantConstraintType	String	Type of grant constraint
kms:GrantOperations	List	Operations allowed by grant

Intrinsic Functions

Fn::GetAtt

Returns the value of an attribute from a resource.

RoleArn: !GetAtt MyRole.Arn
RoleId: !GetAtt MyRole.RoleId
UserArn: !GetAtt MyUser.Arn

Ref

Returns the value of the specified parameter or resource.

UserName: !Ref MyUser
RoleName: !Ref MyRole

Fn::Sub

Substitutes variables in an input string.

RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${RoleName}"
PolicyDocument: !Sub |
  {
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::${BucketName}/*"
    }]
  }

Fn::Join

Concatenates values into a single string.

ResourceArns: !Join
  - ","
  - - !GetAtt Table1.Arn
    - !GetAtt Table2.Arn

Fn::Select

Returns a single object from a list.

FirstRoleArn: !Select [0, !Ref RoleArns]

Condition Functions

# Fn::If
PermissionsBoundary: !If
  - HasBoundary
  - !Ref BoundaryPolicyArn
  - !Ref AWS::NoValue

# Fn::Equals
IsProduction: !Equals [!Ref Environment, production]

# Fn::Not
IsNotDev: !Not [!Equals [!Ref Environment, dev]]

# Fn::And
IsProdAndLarge: !And
  - !Equals [!Ref Environment, production]
  - !Equals [!Ref InstanceSize, large]

# Fn::Or
IsDevOrStaging: !Or
  - !Equals [!Ref Environment, dev]
  - !Equals [!Ref Environment, staging]

Common AWS Managed Policies

Lambda Execution

Policy ARN	Description
arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole	Basic Lambda execution with CloudWatch Logs
arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole	Lambda VPC network access
arn:aws:iam::aws:policy/service-role/AWSLambdaSQSQueueExecutionRole	Lambda SQS polling
arn:aws:iam::aws:policy/service-role/AWSLambdaKinesisExecutionRole	Lambda Kinesis streaming

EC2

Policy ARN	Description
arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore	SSM agent access
arn:aws:iam::aws:policy/AmazonSSMFullAccess	Full SSM access
arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess	EC2 read-only access
arn:aws:iam::aws:policy/AmazonEC2FullAccess	Full EC2 access

S3

Policy ARN	Description
arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess	S3 read-only access
arn:aws:iam::aws:policy/AmazonS3FullAccess	Full S3 access
arn:aws:iam::aws:policy/AmazonS3ObjectReadOnlyAccess	S3 object read-only

Database

Policy ARN	Description
arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess	DynamoDB read-only
arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess	Full DynamoDB
arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess	RDS read-only
arn:aws:iam::aws:policy/AmazonRDSFullAccess	Full RDS

Read-Only and Security

Policy ARN	Description
arn:aws:iam::aws:policy/ReadOnlyAccess	All read-only access
arn:aws:iam::aws:policy/SecurityAudit	Security audit access
arn:aws:iam::aws:policy/ViewBilling	View billing information

Container

Policy ARN	Description
arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy	ECS task execution
arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy	EKS worker nodes
arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy	EKS CNI plugin
arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly	ECR read-only

Limits and Quotas

IAM Limits

Resource	Default Limit
Users per account	5000
Groups per account	300
Roles per account	1000
Policies per account	1500
Access keys per user	2
Managed policies attached to role/user/group	10
Size of inline policy	10240 characters
Size of managed policy	6144 characters
Session duration (roles)	1-12 hours

Policy Document Limits

Element	Limit
Statements per policy	10
Characters per policy document	10240
Actions per statement	100
Resources per statement	100
Condition keys per statement	10

Error Handling

Common Errors

Error	Cause	Solution
AccessDenied	Insufficient permissions	Add required actions to policy
MalformedPolicyDocument	Invalid policy syntax	Validate JSON syntax
ValidationError	Invalid parameter value	Check parameter constraints
LimitExceeded	Resource limit reached	Request increase or clean up
NoSuchEntity	Resource not found	Verify resource name/ARN
ServiceFailure	AWS service error	Retry with backoff

Validation Tools

# Validate template
aws cloudformation validate-template --template-body file://template.yaml

# Check for IAM issues
aws iam get-account-password-policy
aws iam get-account-summary

Best Practices Reference

Policy Writing

Use least privilege: Start restrictive, add permissions as needed
Use wildcards sparingly: Prefer specific actions
Use conditions: Restrict by IP, time, tags
Use resource-level restrictions: Specify ARNs when possible
Use separate policies: Easier to audit and modify
Version policies: Use "2012-10-17" version

Role Configuration

Trust relationships: Limit to required principals
Session duration: Set based on use case
Permissions boundary: Prevent privilege escalation
External ID: Use for cross-account access
Conditions: Add IP and MFA requirements

Security Recommendations

Enable MFA for all users
Rotate access keys regularly
Use roles instead of long-term credentials
Delete unused users and access keys
Review policies quarterly
Use CloudTrail for audit logging
Enable IAM Access Analyzer

plugins

developer-kit-aws

skills

aws

aws-cloudformation

aws-cloudformation-auto-scaling

aws-cloudformation-bedrock

aws-cloudformation-cloudfront

aws-cloudformation-cloudwatch

aws-cloudformation-dynamodb

aws-cloudformation-ec2

aws-cloudformation-ecs

aws-cloudformation-elasticache

aws-cloudformation-iam

references

examples.md

reference.md

SKILL.md

aws-cloudformation-lambda

aws-cloudformation-rds

aws-cloudformation-s3

aws-cloudformation-security

aws-cloudformation-task-ecs-deploy-gh

aws-cloudformation-vpc

developer-kit-core

developer-kit-java

developer-kit-php

developer-kit-python

developer-kit-tools

developer-kit-typescript

README.md

tile.json

giuseppe-trisciuoglio/developer-kit

reference.md.css-3qkkll{font-size:var(--chakra-font-sizes-sm);font-weight:var(--chakra-font-weights-normal);color:var(--chakra-colors-gray-300);}plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-iam/references/

AWS CloudFormation IAM - Reference

AWS::IAM::User

Properties

Policy Structure

PolicyDocument Structure

Statement Structure

Example

Attributes

AWS::IAM::Role

Properties

Principal Types

Example with Service Principal

Example with AWS Principal

Attributes

AWS::IAM::Policy

Properties

Example

Attributes

AWS::IAM::ManagedPolicy

Properties

Example

Attributes

AWS::IAM::UserLoginProfile

Properties

Example

AWS::IAM::AccessKey

Properties

Example

Attributes

AWS::IAM::InstanceProfile

Properties

Example

Attributes

AWS::IAM::UserToGroupAddition

Properties

Example

AWS::IAM::ServerCertificate

Properties

Example

Attributes

AWS::Organizations::Policy

Properties

Example with SCP

AWS::SSO::PermissionSet

Properties

Example

Attributes

AWS::SSO::AccountAssignment

Properties

Example

AWS::IAM::ServiceLinkedRole

Properties

Example

AWS::IAM::SAMLProvider

Properties

Example

Attributes

AWS::IAM::OIDCProvider

Properties

Example

Condition Keys Reference

AWS-Specific Condition Keys

S3-Specific Condition Keys

DynamoDB-Specific Condition Keys

IAM-Specific Condition Keys

KMS-Specific Condition Keys

Intrinsic Functions

Fn::GetAtt

Ref

Fn::Sub

Fn::Join

Fn::Select

Condition Functions

Common AWS Managed Policies

Lambda Execution

EC2

S3

Database

reference.mdplugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-iam/references/