Cloud9の環境を作成する権限を持ったIAMユーザーを作ってみた

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";

export interface GroupConstructProps {}

export class GroupConstruct extends Construct {
  readonly group: cdk.aws_iam.IGroup;

  constructor(scope: Construct, id: string, props?: GroupConstructProps) {
    super(scope, id);

    const tagPolicy = new cdk.aws_iam.ManagedPolicy(this, "TagPolicy", {
      statements: [
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: [
            "arn:aws:iam::" +
              cdk.Stack.of(this).account +
              ":user/${aws:username}",
          ],
          actions: ["iam:ListUserTags", "iam:UntagUser", "iam:TagUser"],
        }),
      ],
    });

    const selfManagedMfaPolicy = new cdk.aws_iam.ManagedPolicy(
      this,
      "SelfManagedMfaPolicy",
      {
        statements: [
          new cdk.aws_iam.PolicyStatement({
            sid: "SelfManagedMfa",
            effect: cdk.aws_iam.Effect.ALLOW,
            resources: [
              "arn:aws:iam::" +
                cdk.Stack.of(this).account +
                ":mfa/${aws:username}*",
              "arn:aws:iam::" +
                cdk.Stack.of(this).account +
                ":user/${aws:username}*",
            ],
            actions: [
              "iam:ChangePassword",
              "iam:CreateVirtualMFADevice",
              "iam:DeleteVirtualMFADevice",
              "iam:DeactivateMFADevice",
              "iam:EnableMFADevice",
              "iam:GetLoginProfile",
              "iam:GetUser",
              "iam:GetUserPolicy",
              "iam:ListGroupsForUser",
              "iam:ListAttachedUserPolicies",
              "iam:ListUserPolicies",
              "iam:ResyncMFADevice",
              "iam:ListMFADevices",
            ],
          }),
        ],
      }
    );

    const cloud9Policy = new cdk.aws_iam.ManagedPolicy(this, "Cloud9Policy", {
      statements: [
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: ["*"],
          actions: ["cloud9:CreateEnvironmentEC2"],
          conditions: {
            StringLike: {
              "cloud9:EnvironmentName": "${aws:username}*",
              "cloud9:InstanceType": [
                "t3.nano",
                "t3.micro",
                "t3.small",
                "t3.medium",
                "t3.large",
              ],
            },
            Null: {
              "cloud9:OwnerArn": "true",
            },
          },
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: ["*"],
          actions: [
            "cloud9:DescribeEnvironments",
            "cloud9:DescribeEnvironmentStatus",
            "cloud9:DescribeEnvironmentMemberships",
            "cloud9:ListEnvironments",
            "cloud9:ListTagsForResource",
            "cloud9:UpdateUserSettings",
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeInstanceTypeOfferings",
            "ec2:DescribeRouteTables",
          ],
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: ["arn:aws:iam::*:role/service-role/*"],
          actions: ["iam:ListRoles", "iam:ListInstanceProfilesForRole"],
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: [
            "arn:aws:iam::*:role/service-role/AWSCloud9SSMAccessRole",
          ],
          actions: ["iam:ListInstanceProfilesForRole", "iam:CreateRole"],
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: [
            "arn:aws:iam::*:role/service-role/AWSCloud9SSMAccessRole",
          ],
          actions: ["iam:AttachRolePolicy"],
          conditions: {
            StringEquals: {
              "iam:PolicyARN":
                "arn:aws:iam::aws:policy/AWSCloud9SSMInstanceProfile",
            },
          },
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: [
            "arn:aws:iam::*:role/service-role/AWSCloud9SSMAccessRole",
          ],
          actions: ["iam:PassRole"],
          conditions: {
            StringEquals: {
              "iam:PassedToService": "ec2.amazonaws.com",
            },
          },
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: [
            "arn:aws:iam::*:instance-profile/cloud9/AWSCloud9SSMInstanceProfile",
          ],
          actions: [
            "iam:CreateInstanceProfile",
            "iam:AddRoleToInstanceProfile",
          ],
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: ["*"],
          actions: ["iam:CreateServiceLinkedRole"],
          conditions: {
            StringEquals: {
              "iam:AWSServiceName": "cloud9.amazonaws.com",
            },
          },
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: ["arn:aws:ec2:*:*:instance/*"],
          actions: ["ssm:StartSession", "ssm:GetConnectionStatus"],
          conditions: {
            StringLike: {
              "ssm:resourceTag/aws:cloud9:environment": "*",
            },
            StringEquals: {
              "aws:CalledViaFirst": "cloud9.amazonaws.com",
            },
          },
        }),
        new cdk.aws_iam.PolicyStatement({
          effect: cdk.aws_iam.Effect.ALLOW,
          resources: ["arn:aws:ssm:*:*:document/*"],
          actions: ["ssm:StartSession"],
        }),
      ],
    });

    const group = new cdk.aws_iam.Group(this, "Default", {
      managedPolicies: [tagPolicy, selfManagedMfaPolicy, cloud9Policy],
    });
    this.group = group;
  }
}