Cloudformation | Managed Policy

Question

Hello Team,

I am trying to create a manage policy with CloudFormation. The policy is getting created but the entire permission is not being reflected in the policy being created.

For ex:

```
CreateTestDBPolicy:
  Type: 'AWS::IAM::ManagedPolicy'
  Properties:
    Description: Policy for creating a test database
    Path: /
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Action: 'rds:CreateDBInstance'
          Resource: !Join 
            - ''
            - - 'arn:aws:rds:'
              - !Ref 'AWS::Region'
              - ':'
              - !Ref 'AWS::AccountId'
              - ':db:test*'
          Condition:
            StringEquals:
              'rds:DatabaseEngine': mysql
        - Effect: Allow
          Action: 'rds:CreateDBInstance'
          Resource: !Join 
            - ''
            - - 'arn:aws:rds:'
              - !Ref 'AWS::Region'
              - ':'
              - !Ref 'AWS::AccountId'
              - ':db:test*'
          Condition:
            StringEquals:
              'rds:DatabaseClass': db.t2.micro
    Groups:
      - TestDBGroup

```

For above template, only half of JSON permission can be seen in the policy being created.

Parthasaradi Challa · Accepted Answer

Hello,

please look at the solution it will be helpful for you

To create a **managed policy **with the required permissions using AWS CloudFormation.

```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  CreateTestDBPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      Description: Policy for creating a test database
      Path: /
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: 'rds:CreateDBInstance'
            Resource: !Sub 'arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:test*'
            Condition:
              StringEquals:
                rds:DatabaseEngine: 'mysql'
          - Effect: Allow
            Action: 'rds:CreateDBInstance'
            Resource: !Sub 'arn:aws:rds:${AWS::Region}:${AWS::AccountId}:db:test*'
            Condition:
              StringEquals:
                rds:DatabaseClass: 'db.t2.micro'

```

**Steps to Deploy the Template**

**1)Validate the Template**

Before deploying the template, you should validate it to ensure there are no syntax errors. Run the following command in your terminal:

```
aws cloudformation validate-template --template-body file://create-test-db-policy.yaml

```
**2)Deploy the Stack**

Use the command to deploy the CloudFormation stack:

```
aws cloudformation deploy --template-file create-test-db-policy.yaml --stack-name my-test-db-policy-stack --capabilities CAPABILITY_NAMED_IAM

```

Cloudformation | Managed Policy

Add your answer

Relevant content