policy-doc.html.md.erb

---
title: Ops Manager for AWS Policy Document
owner: Ops Manager
---

Use this policy document to complete _Step 3: Create an IAM User for <%= vars.platform_name %>_ in [Preparing to Deploy Ops Manager on AWS Manually](/platform/ops-manager/<%= vars.current_major_version.sub('.', '-') %>/aws/prepare-env-manual.html#create-iam).


## <a id="policy-code"></a> The Policy Document Base Code

<p class='note'><strong>Note:</strong> For the S3 Bucket policy sections, make sure to update the generic bucket naming with your custom/unique bucket names.</p>

From the AWS Management Console, copy and paste the following text in the **Policy Document** field.

You may want to consider adding more policies to enable additional features. See [Add Additional AWS Policies](#add-policies) below.

<pre class="code">

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Deny",
        "Action": [
            "iam:*"
        ],
        "Resource": [
            "*"
        ]
    },
    {
        "Sid": "OpsMgrInfrastructureIaasConfiguration",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeKeypairs",
            "ec2:DescribeVpcs",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeAccountAttributes"
        ],
        "Resource": "*"
    },
    {
        "Sid": "OpsMgrInfrastructureDirectorConfiguration",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::<%= vars.product_name_lc %>-ops-manager-bucket",
		    "arn:aws:s3:::<%= vars.product_name_lc %>-ops-manager-bucket/*",
            "arn:aws:s3:::<%= vars.product_name_lc %>-buildpacks-bucket",
            "arn:aws:s3:::<%= vars.product_name_lc %>-buildpacks-bucket/*",
		    "arn:aws:s3:::<%= vars.product_name_lc %>-packages-bucket",
		    "arn:aws:s3:::<%= vars.product_name_lc %>-packages-bucket/*",
            "arn:aws:s3:::<%= vars.product_name_lc %>-resources-bucket",
            "arn:aws:s3:::<%= vars.product_name_lc %>-resources-bucket/*",
            "arn:aws:s3:::<%= vars.product_name_lc %>-droplets-bucket",
            "arn:aws:s3:::<%= vars.product_name_lc %>-droplets-bucket/*"
        ]
    },
    {
        "Sid": "OpsMgrInfrastructureAvailabilityZones",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeAvailabilityZones"
        ],
        "Resource": "*"
    },
    {
        "Sid": "OpsMgrInfrastructureNetworks",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeSubnets"
        ],
        "Resource": "*"
    },
    {
        "Sid": "DeployMicroBosh",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeImages",
            "ec2:RunInstances",
            "ec2:DescribeInstances",
            "ec2:TerminateInstances",
            "ec2:RebootInstances",
            "elasticloadbalancing:DescribeLoadBalancers",
            "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
            "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
            "ec2:DescribeAddresses",
            "ec2:DisassociateAddress",
            "ec2:AssociateAddress",
            "ec2:CreateTags",
            "ec2:DescribeVolumes",
            "ec2:CreateVolume",
            "ec2:AttachVolume",
            "ec2:DeleteVolume",
            "ec2:DetachVolume",
            "ec2:CreateSnapshot",
            "ec2:DeleteSnapshot",
            "ec2:DescribeSnapshots",
            "ec2:DescribeRegions"
        ],
        "Resource": "*"
    }
]
}


</pre>


## <a id="add-policies"></a> Add Additional AWS Policies

To perform specific tasks, you may need to add additional policies to your **Policy Document** field in the AWS Management Console.

Consult the table below to determine what additional policies you may want to include. Then paste the code from the corresponding row. Enter the code in your existing policy after any `},`.

<table>
    <tr>
        <th>I need to...</th>
        <th>So I paste this code.</th>
    </tr>
    <tr>
        <td>Encrypt EBS volumes with AWS Key Management Service (KMS).</td>
        <td><pre class="code" style="max-height: 7em; max-width:30em; overflow: auto">
{
    "Sid": "RequiredIfUsingHeavyStemcells",
    "Effect": "Allow",
    "Action": [
        "ec2:RegisterImage",
        "ec2:DeregisterImage"
    ],
    "Resource": "*"
},
{
    "Sid": "RequiredIfEncryptingStemcells",
    "Effect": "Allow",
    "Action": [
        "ec2:CopyImage"
    ],
    "Resource": "*"
},
</pre></td>
    </tr>
    <tr>
        <td>Use a custom KMS encryption key that I created in AWS.</td>
        <td><pre class="code" style="max-height: 7em; max-width:30em; overflow: auto">
{
    "Sid": "RequiredIfUsingCustomKMSKeys",
    "Effect": "Allow",
    "Action": [
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:CreateGrant",
        "kms:DescribeKey*"
    ],
    "Resource": [
        "((kms_key_arn))"
    ]
},
</pre></td>
    </tr>
    <tr>
        <td>Use the load balancer target group.</td>
        <td>
            <pre class="code" style="max-height: 7em; max-width:30em; overflow: auto">
{
    "Sid": "RequiredIfUsingLBTargetGroupCloudProperties",
    "Effect": "Allow",
    "Action": [
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeTargetGroups",
        "elasticloadbalancing:DescribeTargetHealth",
        "elasticloadbalancing:RegisterTargets"
    ],
    "Resource": "*"
},
</pre>
        </td>
    </tr>
    <tr>
        <td>Use the AWS Spot instance advisor.</td>
        <td>
            <pre class="code" style="max-height: 7em; max-width:30em; overflow: auto">
{
    "Sid": "RequiredIfUsingSpotBidPriceCloudProperties",
    "Effect": "Allow",
    "Action": [
        "ec2:CancelSpotInstanceRequests",
        "ec2:DescribeSpotInstanceRequests",
        "ec2:RequestSpotInstances"
    ],
    "Resource": "*"
},
</pre>
        </td>
        </tr>
    <tr>
        <td>Create and replace AWS routes.</td>
        <td>
            <pre class="code" style="max-height: 7em; max-width:30em; overflow: auto">
{
    "Sid": "RequiredIfUsingAdvertisedRoutesCloudProperties",
    "Effect": "Allow",
    "Action": [
        "ec2:CreateRoute",
        "ec2:DescribeRouteTables",
        "ec2:ReplaceRoute"
    ],
    "Resource": "*"
},
</pre>
        </td>
        </tr>
</table>

For more information about AWS policies, see [Example Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_examples.html) in the AWS documentation.