What are the minimum AWS permissions needed to deploy Datamic Cloud?

Question

I am reviewing my CI, including Datomic deployment, to improve my regulatory and compliance stance.

I'd like to know what the minimum permissions are to achieve this same deployment so we can tick this off in an audit in the future e.g. SOC2

This is a documentation request for Datomic Cloud.

Answer 1

For a verified, minimal policy: deploy once an intentionally broad admin policy in a sandbox account, then run AWS IAM Access Analyzer's (https://aws.amazon.com/iam/access-analyzer/) "generate policy from CloudTrail activity" against that CloudTrail trail. That will produce the exact action list actually invoked, which you can then build a policy on.

I am going to do this process on a few Datomic Cloud systems and update this post, but wanted to take a first stab here below.

Also FYI there is an AdminPolicy resource in the storage-template.json, it represents Datomic's end-user runtime access policy (S3 read on the access file + ec2:DescribeInstances). So the resources themselves need a policy to ensure they can communicate and utilize resources. If I recall correctly these are named after the system name.

here is my first stab. I will add more after I've run a test on other systems:
https://gist.github.com/Jaretbinford/9266ad186663a8d0d99936f6c1785b4b