2. IAM Policy Configuration
To allow Logpresso Sonar to use AWS services through AWS APIs, you must configure a policy.
Enter Policy JSON
In the IAM console, go to Policies and click Create policy. In the Policy editor, select JSON, paste the JSON below, and click Next. The policy below grants read-only permissions, but it applies to all resources, so limit the scope of cloud resources that Logpresso can read. You may remove any permissions you do not use.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ce:GetCostAndUsage",
"acm:DescribeCertificate",
"acm:ListCertificates",
"ec2:DescribeVpcs",
"ec2:DescribeInstances",
"ec2:DescribeAddresses",
"ec2:DescribeSnapshots",
"ec2:DescribeVolumeStatus",
"ec2:DescribeVolumes",
"ec2:DescribeAccountAttributes",
"ec2:DescribeKeyPairs",
"ec2:DescribeNetworkAcls",
"ec2:DescribeVpnConnections",
"ec2:DescribeNatGateways",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeRouteTables",
"ec2:DescribeInstanceStatus",
"ec2:DescribeImages",
"autoscaling:DescribeAutoScalingGroups",
"cloudwatch:GetMetricData",
"cloudwatch:ListMetrics",
"logs:DescribeLogGroups",
"iam:ListPolicies",
"iam:ListRoles",
"iam:ListUsers",
"iam:ListMFADevices",
"iam:ListAccessKeys",
"iam:GenerateCredentialReport",
"iam:GetCredentialReport",
"iam:ListVirtualMFADevices",
"iam:ListServerCertificates",
"elasticbeanstalk:DescribeEnvironments",
"elasticbeanstalk:DescribeInstancesHealth",
"elasticbeanstalk:DescribeApplications",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"elasticloadbalancing:DescribeTargetGroups",
"rds:DescribeEvents",
"rds:DescribeDBLogFiles",
"rds:DownloadDBLogFilePortion",
"s3:ListAllMyBuckets",
"s3:ListBucket",
"s3:GetObject",
"s3:GetBucketAcl",
"s3:GetBucketLocation",
"route53:ListHostedZones",
"wafv2:GetIPSet",
"wafv2:ListIPSets",
"wafv2:UpdateIPSet"
],
"Resource": "*"
}
]
}
The following permissions are additionally required to use the WAF query commands or the block integration feature:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"wafv2:GetIPSet",
"wafv2:ListIPSets",
"wafv2:UpdateIPSet"
],
"Resource": "*"
}
]
}
The following permissions are additionally required to use the ECR query commands:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ecr:DescribeImageScanFindings",
"ecr:DescribeRegistry",
"ecr:GetAuthorizationToken",
"ecr:ListImages",
"ecr:GetRegistryScanningConfiguration",
"ecr:BatchGetImage",
"ecr:DescribeImages",
"ecr:DescribeRepositories",
"ecr:GetRepositoryPolicy",
"inspector2:ListCoverageStatistics",
"inspector2:ListFindings",
"inspector2:ListFindingAggregations",
"inspector2:ListCoverage",
"inspector2:GetFindingsReportStatus",
"inspector:ListFindings",
"inspector:DescribeFindings"
],
"Resource": "*"
}
]
}
Review and Create Policy
On the Review and create page, enter a Policy name (e.g., logpresso), confirm that Permissions defined in this policy are read-only, and click Create policy. Add tags only if needed.
