group_policies

Creates, updates, deletes or gets a group_policy resource or lists group_policies in a region

Overview

Name	group_policies
Type	Resource
Description	Adds or updates an inline policy document that is embedded in the specified IAM group. A group can also have managed policies attached to it. To attach a managed policy to a group, use [AWS::IAM::Group](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-iam-group.html). To create a new managed policy, use [AWS::IAM::ManagedPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html). For information about policies, see [Managed policies and inline policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html) in the *IAM User Guide*. For information about the maximum number of inline policies that you can embed in a group, see [IAM and quotas](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html) in the *IAM User Guide*.
Id	awscc.iam.group_policies

Fields

Name	Datatype	Description
policy_document	object	The policy document.<br />You must provide policies in JSON format in IAM. However, for CFN templates formatted in YAML, you can provide the policy in JSON or YAML format. CFN always converts a YAML policy to JSON format before submitting it to IAM.<br />The &#91;regex pattern&#93;(https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex) used to validate this parameter is a string of characters consisting of the following:<br />+ Any printable ASCII character ranging from the space character (&#96;&#96;\u0020&#96;&#96;) through the end of the ASCII character range<br />+ The printable characters in the Basic Latin and Latin-1 Supplement character set (through &#96;&#96;\u00FF&#96;&#96;)<br />+ The special characters tab (&#96;&#96;\u0009&#96;&#96;), line feed (&#96;&#96;\u000A&#96;&#96;), and carriage return (&#96;&#96;\u000D&#96;&#96;)
policy_name	string	The name of the policy document.<br />This parameter allows (through its &#91;regex pattern&#93;(https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex)) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: &#95;+=,.@-
group_name	string	The name of the group to associate the policy with.<br />This parameter allows (through its &#91;regex pattern&#93;(https://docs.aws.amazon.com/http://wikipedia.org/wiki/regex)) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: &#95;+=,.@-.
region	string	AWS region.

For more information, see AWS::IAM::GroupPolicy.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	PolicyName, GroupName, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all properties from an individual group_policy.

SELECT
region,
policy_document,
policy_name,
group_name
FROM awscc.iam.group_policies
WHERE data__Identifier = '<PolicyName>|<GroupName>';

INSERT example

Use the following StackQL query and manifest file to create a new group_policy resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.iam.group_policies (
 PolicyName,
 GroupName,
 region
)
SELECT 
'{{ PolicyName }}',
 '{{ GroupName }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.iam.group_policies (
 PolicyDocument,
 PolicyName,
 GroupName,
 region
)
SELECT 
 '{{ PolicyDocument }}',
 '{{ PolicyName }}',
 '{{ GroupName }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: group_policy
    props:
      - name: PolicyDocument
        value: {}
      - name: PolicyName
        value: '{{ PolicyName }}'
      - name: GroupName
        value: '{{ GroupName }}'

DELETE example

/*+ delete */
DELETE FROM awscc.iam.group_policies
WHERE data__Identifier = '<PolicyName|GroupName>'
AND region = 'us-east-1';

Permissions

To operate on the group_policies resource, the following permissions are required:

Create

iam:PutGroupPolicy,
iam:GetGroupPolicy

Read

iam:GetGroupPolicy

Update

iam:PutGroupPolicy,
iam:GetGroupPolicy

Delete

iam:DeleteGroupPolicy,
iam:GetGroupPolicy