Answers: <p>There's a generator for policies in IAM (Into IAM -> Policies -> Create), choosing connect gives me the following policy:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "connect:DescribeInstance",
                  "connect:CreateInstance",
                  "connect:ModifyInstance",
                  "connect:ListInstances",
                  "connect:GetFederationTokens",
                  "connect:DestroyInstance",
                  "connect:GetFederationToken"
              ],
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
  <p>There's a warning on the action part saying:</p>
  
  <ul>
  <li>connect:DescribeInstance action requires 7 more actions to provide full permissions</li>
  <li>connect:CreateInstance action requires 13 more actions to provide full permissions</li>
  <li>connect:ModifyInstance action requires 10 more actions to provide full permissions</li>
  </ul>
  
  <p>Each of them says:</p>
  
  <p>To allow an entity to call 'DescribeInstance', grant all of the following required permissions.</p>
  
  <ul>
  <li>firehose:DescribeDeliveryStream</li>
  <li>firehose:ListDeliveryStreams</li>
  <li>kinesis:DescribeStream</li>
  <li>kinesis:ListStreams</li>
  <li>kms:DescribeKey</li>
  <li>kms:ListAliases</li>
  <li>s3:ListAllMyBuckets</li>
  </ul>
  
  <p>To allow an entity to call 'CreateInstance', grant all of the following required permissions.</p>
  
  <ul>
  <li>ds:CreateAlias</li>
  <li>ds:DeleteDirectory</li>
  <li>ds:DescribeDirectories</li>
  <li>firehose:DescribeDeliveryStream</li>
  <li>firehose:ListDeliveryStreams</li>
  <li>kinesis:DescribeStream</li>
  <li>kinesis:ListStreams</li>
  <li>kms:CreateGrant</li>
  <li>kms:DescribeKey</li>
  <li>kms:ListAliases</li>
  <li>kms:RetireGrant</li>
  <li>s3:CreateBucket</li>
  <li>s3:ListAllMyBuckets</li>
  </ul>
  
  <p>To allow an entity to call 'ModifyInstance', grant all of the following required permissions.</p>
  
  <ul>
  <li>firehose:DescribeDeliveryStream</li>
  <li>firehose:ListDeliveryStreams</li>
  <li>kinesis:DescribeStream</li>
  <li>kinesis:ListStreams</li>
  <li>kms:CreateGrant</li>
  <li>kms:DescribeKey</li>
  <li>kms:ListAliases</li>
  <li>kms:RetireGrant</li>
  <li>s3:CreateBucket</li>
  <li>s3:ListAllMyBuckets</li>
  </ul>
  
  <p>Which once compiled gives the following policy when not filtering on any resource:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "connect:DescribeInstance",
                  "connect:ModifyInstance",
                  "connect:GetFederationTokens",
                  "s3:CreateBucket",
                  "kinesis:DescribeStream",
                  "kms:RetireGrant",
                  "connect:DestroyInstance",
                  "firehose:DescribeDeliveryStream",
                  "kinesis:ListStreams",
                  "connect:CreateInstance",
                  "s3:ListAllMyBuckets",
                  "connect:ListInstances",
                  "kms:ListAliases",
                  "ds:DescribeDirectories",
                  "kms:DescribeKey",
                  "firehose:ListDeliveryStreams",
                  "ds:CreateAlias",
                  "kms:CreateGrant",
                  "connect:GetFederationToken",
                  "ds:DeleteDirectory"
              ],
              "Resource": "*"
          }
      ]
  }
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2018-03-21T13:09:54.493Z
Answers: Thanks for the answer. I don't know how I have missed this.
Answers: mrktos
Answers: CC BY-SA 3.0
Answers: 2018-03-26T00:21:04.257Z
Answers: Be sure to accept the answer, @mrktos
Answers: Rilindo
Answers: CC BY-SA 3.0
Answers: 2018-03-21T12:44:57.647Z
Answers: 2018-03-21T12:44:57.647Z
Answers: Tensibai
Body: <p>I was trying to lock down user account just to Amazon Connect, Lambda and S3. I was able to give permissions to S3 and Lambda but I cannot find permissions for Amazon Connect. I have went through the documentation etc. but I cannot find out the proper name of that service so I will be able to write a policy for it. Would you be able to help? </p>
  
Tags: <amazon-web-services><amazon-s3><aws-lambda>
Title: Amazon AWS - Amazon Connect IAM policies
UserDisplayName: mrktos
ThreadText: # Amazon AWS - Amazon Connect IAM policies
  
  (Asked by: username_0 on 2018-03-21)
  
  I was trying to lock down user account just to Amazon Connect, Lambda and S3. I was able to give permissions to S3 and Lambda but I cannot find permissions for Amazon Connect. I have went through the documentation etc. but I cannot find out the proper name of that service so I will be able to write a policy for it. Would you be able to help?
  
  **Tags:** amazon-web-services, amazon-s3, aws-lambda
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2018-03-21. Score: 3 | Accepted answer
  
  There's a generator for policies in IAM (Into IAM -> Policies -> Create), choosing connect gives me the following policy:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "connect:DescribeInstance",
                  "connect:CreateInstance",
                  "connect:ModifyInstance",
                  "connect:ListInstances",
                  "connect:GetFederationTokens",
                  "connect:DestroyInstance",
                  "connect:GetFederationToken"
              ],
              "Resource": "*"
          }
      ]
  }
  
  ```
  
  There's a warning on the action part saying:
  
  * connect:DescribeInstance action requires 7 more actions to provide full permissions
  * connect:CreateInstance action requires 13 more actions to provide full permissions
  * connect:ModifyInstance action requires 10 more actions to provide full permissions
  
  Each of them says:
  
  To allow an entity to call 'DescribeInstance', grant all of the following required permissions.
  
  * firehose:DescribeDeliveryStream
  * firehose:ListDeliveryStreams
  * kinesis:DescribeStream
  * kinesis:ListStreams
  * kms:DescribeKey
  * kms:ListAliases
  * s3:ListAllMyBuckets
  
  To allow an entity to call 'CreateInstance', grant all of the following required permissions.
  
  * ds:CreateAlias
  * ds:DeleteDirectory
  * ds:DescribeDirectories
  * firehose:DescribeDeliveryStream
  * firehose:ListDeliveryStreams
  * kinesis:DescribeStream
  * kinesis:ListStreams
  * kms:CreateGrant
  * kms:DescribeKey
  * kms:ListAliases
  * kms:RetireGrant
  * s3:CreateBucket
  * s3:ListAllMyBuckets
  
  To allow an entity to call 'ModifyInstance', grant all of the following required permissions.
  
  * firehose:DescribeDeliveryStream
  * firehose:ListDeliveryStreams
  * kinesis:DescribeStream
  * kinesis:ListStreams
  * kms:CreateGrant
  * kms:DescribeKey
  * kms:ListAliases
  * kms:RetireGrant
  * s3:CreateBucket
  * s3:ListAllMyBuckets
  
  Which once compiled gives the following policy when not filtering on any resource:
  
  ```
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "connect:DescribeInstance",
                  "connect:ModifyInstance",
                  "connect:GetFederationTokens",
                  "s3:CreateBucket",
                  "kinesis:DescribeStream",
                  "kms:RetireGrant",
                  "connect:DestroyInstance",
                  "firehose:DescribeDeliveryStream",
                  "kinesis:ListStreams",
                  "connect:CreateInstance",
                  "s3:ListAllMyBuckets",
                  "connect:ListInstances",
                  "kms:ListAliases",
                  "ds:DescribeDirectories",
                  "kms:DescribeKey",
                  "firehose:ListDeliveryStreams",
                  "ds:CreateAlias",
                  "kms:CreateGrant",
                  "connect:GetFederationToken",
                  "ds:DeleteDirectory"
              ],
              "Resource": "*"
          }
      ]
  }
  
  ```
  
  > **Comments:**
  > **username_0**: Thanks for the answer. I don't know how I have missed this.  
  > **username_2**: Be sure to accept the answer, @username_0  
  
  ---
  
  