operator-access.v1.json

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"elasticloadbalancing:*",
				"s3:*",
				"ec2:*",
				"sqs:*",
				"autoscaling:*",
				"sns:*",
				"cloudwatch:*",
				"logs:*",
				"cloudtrail:*",
				"lambda:*"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Effect": "Deny",
			"NotAction": [
				"aws-portal:*",
				"iam:*",
				"organizations:*",
				"support:*",
				"sts:*"
			],
			"Resource": "*",
			"Condition": {
				"StringNotEquals": {
					"aws:RequestedRegion": [
						"eu-central-1",
						"eu-west-1"
					]
				}
			}
		},
		{
			"Effect": "Deny",
			"Action": [
				"iam:CreateUser",
				"iam:DeleteUser"
			],
			"Resource": "*"
		},
		{
			"Sid": "limitedSize",
			"Effect": "Deny",
			"Action": "ec2:RunInstances",
			"Resource": "arn:aws:ec2:*:*:instance/*",
			"Condition": {
				"ForAnyValue:StringNotLike": {
					"ec2:InstanceType": [
						"*.nano",
						"*.small",
						"*.micro",
						"*.medium"
					]
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": "ec2:*",
			"Resource": "*",
			"Condition": {
				"StringNotEquals": {
					"ec2:Region": "us-west-2"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"iam:AttachGroupPolicy",
				"iam:AttachRolePolicy",
				"iam:CreatePolicy",
				"iam:CreatePolicyVersion",
				"iam:DeletePolicy",
				"iam:DeletePolicyVersion",
				"iam:GetPolicy",
				"iam:GetPolicyVersion",
				"iam:ListPolicies",
				"iam:ListPolicyVersions",
				"iam:SetDefaultPolicyVersion"
			],
			"Resource": [
				"*"
			]
		}
	]
}