<p>There's a generator for policies in IAM (Into IAM -> Policies -> Create), choosing connect gives me the following policy:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "connect:DescribeInstance",
                "connect:CreateInstance",
                "connect:ModifyInstance",
                "connect:ListInstances",
                "connect:GetFederationTokens",
                "connect:DestroyInstance",
                "connect:GetFederationToken"
            ],
            "Resource": "*"
        }
    ]
}
</code></pre>

<p>There's a warning on the action part saying:</p>

<ul>
<li>connect:DescribeInstance action requires 7 more actions to provide full permissions</li>
<li>connect:CreateInstance action requires 13 more actions to provide full permissions</li>
<li>connect:ModifyInstance action requires 10 more actions to provide full permissions</li>
</ul>

<p>Each of them says:</p>

<p>To allow an entity to call 'DescribeInstance', grant all of the following required permissions.</p>

<ul>
<li>firehose:DescribeDeliveryStream</li>
<li>firehose:ListDeliveryStreams</li>
<li>kinesis:DescribeStream</li>
<li>kinesis:ListStreams</li>
<li>kms:DescribeKey</li>
<li>kms:ListAliases</li>
<li>s3:ListAllMyBuckets</li>
</ul>

<p>To allow an entity to call 'CreateInstance', grant all of the following required permissions.</p>

<ul>
<li>ds:CreateAlias</li>
<li>ds:DeleteDirectory</li>
<li>ds:DescribeDirectories</li>
<li>firehose:DescribeDeliveryStream</li>
<li>firehose:ListDeliveryStreams</li>
<li>kinesis:DescribeStream</li>
<li>kinesis:ListStreams</li>
<li>kms:CreateGrant</li>
<li>kms:DescribeKey</li>
<li>kms:ListAliases</li>
<li>kms:RetireGrant</li>
<li>s3:CreateBucket</li>
<li>s3:ListAllMyBuckets</li>
</ul>

<p>To allow an entity to call 'ModifyInstance', grant all of the following required permissions.</p>

<ul>
<li>firehose:DescribeDeliveryStream</li>
<li>firehose:ListDeliveryStreams</li>
<li>kinesis:DescribeStream</li>
<li>kinesis:ListStreams</li>
<li>kms:CreateGrant</li>
<li>kms:DescribeKey</li>
<li>kms:ListAliases</li>
<li>kms:RetireGrant</li>
<li>s3:CreateBucket</li>
<li>s3:ListAllMyBuckets</li>
</ul>

<p>Which once compiled gives the following policy when not filtering on any resource:</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "connect:DescribeInstance",
                "connect:ModifyInstance",
                "connect:GetFederationTokens",
                "s3:CreateBucket",
                "kinesis:DescribeStream",
                "kms:RetireGrant",
                "connect:DestroyInstance",
                "firehose:DescribeDeliveryStream",
                "kinesis:ListStreams",
                "connect:CreateInstance",
                "s3:ListAllMyBuckets",
                "connect:ListInstances",
                "kms:ListAliases",
                "ds:DescribeDirectories",
                "kms:DescribeKey",
                "firehose:ListDeliveryStreams",
                "ds:CreateAlias",
                "kms:CreateGrant",
                "connect:GetFederationToken",
                "ds:DeleteDirectory"
            ],
            "Resource": "*"
        }
    ]
}
</code></pre>

CC BY-SA 3.0
2018-03-21T13:09:54.493Z
Thanks for the answer. I don't know how I have missed this.
mrktos
CC BY-SA 3.0
2018-03-26T00:21:04.257Z
Be sure to accept the answer, @mrktos
Rilindo
CC BY-SA 3.0
2018-03-21T12:44:57.647Z
2018-03-21T12:44:57.647Z
Tensibai
<p>I was trying to lock down user account just to Amazon Connect, Lambda and S3. I was able to give permissions to S3 and Lambda but I cannot find permissions for Amazon Connect. I have went through the documentation etc. but I cannot find out the proper name of that service so I will be able to write a policy for it. Would you be able to help? </p>

<amazon-web-services><amazon-s3><aws-lambda>
Amazon AWS - Amazon Connect IAM policies
mrktos
# Amazon AWS - Amazon Connect IAM policies

(Asked by: username_0 on 2018-03-21)

I was trying to lock down user account just to Amazon Connect, Lambda and S3. I was able to give permissions to S3 and Lambda but I cannot find permissions for Amazon Connect. I have went through the documentation etc. but I cannot find out the proper name of that service so I will be able to write a policy for it. Would you be able to help?

**Tags:** amazon-web-services, amazon-s3, aws-lambda


---

## 1 answers

### Answer by username_1 on 2018-03-21. Score: 3 | Accepted answer

There's a generator for policies in IAM (Into IAM -> Policies -> Create), choosing connect gives me the following policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "connect:DescribeInstance",
                "connect:CreateInstance",
                "connect:ModifyInstance",
                "connect:ListInstances",
                "connect:GetFederationTokens",
                "connect:DestroyInstance",
                "connect:GetFederationToken"
            ],
            "Resource": "*"
        }
    ]
}

There's a warning on the action part saying:

connect:DescribeInstance action requires 7 more actions to provide full permissions
connect:CreateInstance action requires 13 more actions to provide full permissions
connect:ModifyInstance action requires 10 more actions to provide full permissions

Each of them says:
To allow an entity to call 'DescribeInstance', grant all of the following required permissions.

firehose:DescribeDeliveryStream
firehose:ListDeliveryStreams
kinesis:DescribeStream
kinesis:ListStreams
kms:DescribeKey
kms:ListAliases
s3:ListAllMyBuckets

To allow an entity to call 'CreateInstance', grant all of the following required permissions.

ds:CreateAlias
ds:DeleteDirectory
ds:DescribeDirectories
firehose:DescribeDeliveryStream
firehose:ListDeliveryStreams
kinesis:DescribeStream
kinesis:ListStreams
kms:CreateGrant
kms:DescribeKey
kms:ListAliases
kms:RetireGrant
s3:CreateBucket
s3:ListAllMyBuckets

To allow an entity to call 'ModifyInstance', grant all of the following required permissions.

firehose:DescribeDeliveryStream
firehose:ListDeliveryStreams
kinesis:DescribeStream
kinesis:ListStreams
kms:CreateGrant
kms:DescribeKey
kms:ListAliases
kms:RetireGrant
s3:CreateBucket
s3:ListAllMyBuckets

Which once compiled gives the following policy when not filtering on any resource:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "connect:DescribeInstance",
                "connect:ModifyInstance",
                "connect:GetFederationTokens",
                "s3:CreateBucket",
                "kinesis:DescribeStream",
                "kms:RetireGrant",
                "connect:DestroyInstance",
                "firehose:DescribeDeliveryStream",
                "kinesis:ListStreams",
                "connect:CreateInstance",
                "s3:ListAllMyBuckets",
                "connect:ListInstances",
                "kms:ListAliases",
                "ds:DescribeDirectories",
                "kms:DescribeKey",
                "firehose:ListDeliveryStreams",
                "ds:CreateAlias",
                "kms:CreateGrant",
                "connect:GetFederationToken",
                "ds:DeleteDirectory"
            ],
            "Resource": "*"
        }
    ]
}

> **Comments:**
> **username_0**: Thanks for the answer. I don't know how I have missed this.  
> **username_2**: Be sure to accept the answer, @username_0  

---

