AWSThinkboxAWSPortalGatewayPolicy¶
You can attach the AWSThinkboxAWSPortalGatewayPolicy policy to your IAM identities.
This policy grants operative permissions that allow Gateway instance in AWS Portal to write Thinkbox created logs to CloudWatch, perform upload and download actions on the S3 Cache bucket (for backwards compatibility purposes), read the Resource Tracker Fleet Health table, get UBL and TLS certificates from the stack bucket, and get the password for the RCS TLS cert if necessary.
Permissions details¶
This policy includes the following permissions.
dynamodb
- Used by Deadline Pulse running on the Gateway instance to read the Resource Tracker’s DeadlineFleetHealth DynamoDB table. This is needed so that Pulse can report fleet health back to on-premise.logs
- Used by Gateway instance to stream Thinkbox created logs to CloudWatch. Additionally there are permissions to create the necessary log groups/streams if they don’t already exist.s3
- Used by Gateway instance to get Usage Based Licensing (UBL) and Deadline Client RCS certificates from S3. Additionally there are permissiosn to upload the CA certificate it used to sign its server certificate with, which Workers will use to authenticate the Gateway.secretsmanager
- Used by the Gateway instance to fetch the passphrase for the RCS TLS certificate, if it has one.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:PutLogEvents",
"logs:DescribeLogStreams",
"logs:DescribeLogGroups",
"logs:CreateLogStream"
],
"Resource": [
"arn:aws:logs:*:*:log-group:/thinkbox*"
]
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::aws-portal-cache*"
]
},
{
"Effect": "Allow",
"Action": "dynamodb:Scan",
"Resource": [
"arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::stack*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::stack*/gateway_certs/*"
]
},
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": [
"arn:aws:secretsmanager:*:*:secret:rcs-tls-pw-stack*"
]
}
]
}