Creating the SCConnectLaunch role

To create SCConnectLaunch role

1. Create this policy: AWSCloudFormationFullAccess policy. Choose create policy and add this code in the JSON editor:

   
   {
      "Version":"2012-10-17",
      "Statement":[
         {
            "Effect":"Allow",
            "Action":[
               "cloudformation:DescribeStackResource",
               "cloudformation:DescribeStackResources",
               "cloudformation:GetTemplate",
               "cloudformation:List*",
               "cloudformation:DescribeStackEvents",
               "cloudformation:DescribeStacks",
               "cloudformation:CreateStack",
               "cloudformation:DeleteStack",
               "cloudformation:DescribeStackEvents",
               "cloudformation:DescribeStacks",
               "cloudformation:GetTemplateSummary",
               "cloudformation:SetStackPolicy",
               "cloudformation:ValidateTemplate",
               "cloudformation:UpdateStack",
               "cloudformation:CreateChangeSet",
               "cloudformation:DescribeChangeSet",
               "cloudformation:ExecuteChangeSet",
               "cloudformation:DeleteChangeSet",
               "s3:GetObject"
            ],
            "Resource":"*"
         }
      ]
   }
                   

   Note

   AWSCloudFormationFullAccess includes additional permissions for ChangeSets.

2. Create this policy: ServicecodeCatalogSSMActionsBaseline. Follow the instructions in Creating IAM policies, and add this code in the JSON editor:

   {
      "Version":"2012-10-17",
      "Statement":[
         {
            "Sid":"Stmt1536341175150",
            "Action":[
               "servicecatalog:AssociateResource",
               "servicecatalog:DisassociateResource",
               "servicecatalog:ListServiceActionsForProvisioningArtifact",
               "servicecatalog:ExecuteprovisionedProductServiceAction",
               "ssm:DescribeDocument",
               "ssm:GetAutomationExecution",
               "ssm:StartAutomationExecution",
               "ssm:StopAutomationExecution",
               "ssm:StartChangeRequestExecution",
               "cloudformation:ListStackResources",
               "ec2:DescribeInstanceStatus",
               "ec2:StartInstances",
               "ec2:StopInstances"
            ],
            "Effect":"Allow",
            "Resource":"*"
         },
         {
            "Effect":"Allow",
            "Action":"iam:PassRole",
            "Resource":"*",
            "Condition":{
               "StringEquals":{
                  "iam:PassedToService":"ssm.amazonaws.com"
               }
            }
         }
      ]
   }
                   

3. Create the SCConnectLaunch role. Then assign the trust relationship to Service Catalog.

   
                               {
             "Version": "2012-10-17",
             "Statement": [
               {
                 "Sid": "",
                 "Effect": "Allow",
                 "Principal": {
                   "Service": "servicecatalog.amazonaws.com"
                 },
                 "Action": "sts:AssumeRole"
               }
             ]
           }
                           

4. Attach the relevant policies to the SCConnectLaunch role.

   We recommend you customize and scope your launch policies to the specific AWS Services, which are in the associated CloudFormation template for the given Service Catalog product.

   For example, to provision EC2 and S3 products, your role policies are as follows:

   • AmazonEC2FullAccess AWS managed policy)

   • AmazonS3FullAccess AWS managed policy)

   • AWSCloudFormationFullAccess (custom managed policy)

   • ServiceCatalogSSMActionsBaseline (custom managed policy)