Document least-privilege IAM permissions and bucket creation

[rdkr]

It would be useful to have documentation about running Sceptre in a least-privilege environment in the Getting Started guide. Specifically, it would be useful to explain:

• a bucket will be automatically created, or that you can specify one which you have created
• the least-privilege IAM permissions for a specified bucket
• any other least-privilege IAM permissions needed to run Sceptre (probably just Cloudformation)

Working on this earlier, this should be a start towards the IAM permissions, but cloudformation:* may be excessive:

PolicyDocument:
  Version: 2012-10-17
  Statement:
    -
      Effect: Allow
      Resource: "*"
      Action:
        - cloudformation:*
    -
      Effect: Allow
      Resource: <bucket>/*
      Action:
        - s3:PutObject
        - s3:GetObject
    -
      Effect: Allow
      Resource: <bucket>
      Action:
        - s3:ListBucket

[theseanything]

Thanks @rdkr! This is a good idea. As I see it there are 3 sets of permissions -

• Permissions for S3 bucket access for those using S3 store templates (as you can use sceptre to upload the template directly in the Cloudformation api call)

• Permissions for CloudFormation that allows all of the Sceptre commands to be run.

• Permissions for the underlying template - depends on what resources are in the template and what action CloudFormation is taking.

The first two sets are something we can definitely outline in our docs. And agreed lets try to avoid using wildcard :)

[jamesroutley]

@rdkr you happy to work on this?

[trenigma]

@rdkr @theseanything @jamesroutley Hi all, as a newb to Sceptre and in the process of learning it, I'd like to see if I could contribute to the project starting with this issue.. any objections? I think since it involves documentation it could potentially dovetail nicely with my efforts to learn the tool.

[rdkr]

Hey @trenigma, sorry for the delayed reply. No objections here!

[craighurley]

@trenigma do you still use sceptre? Are you willing to contribute a PR to address the documentation update?

[zaro0508]

Transition this to a a GH discussion because @jfalkenstein just added some general docs around setting up IAM with Sceptre. We also don't want to prescribe anything too specific otherwise it will create a maintenance burden.