Using identity-based policies for CodeGuru Profiler (original) (raw)

By default, IAM users and roles don't have permission to create or modify CodeGuru Profiler resources. They also can't perform tasks using the AWS Management Console, AWS CLI, or AWS API. An IAM administrator must create IAM policies that grant users and roles permission to perform specific API operations on the specified resources they need. The administrator must then attach those policies to the IAM users or groups that require those permissions. To learn how to attach policies to an IAM user or group, see Adding and removing IAM identity permissions in the IAM User Guide.

To learn how to create an IAM identity-based policy using example JSON policy documents, see Creating policies on the JSON tab in the_IAM User Guide_.

Topics

Policy best practices

Identity-based policies determine whether someone can create, access, or delete CodeGuru Profiler resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations:

For more information about best practices in IAM, see Security best practices in IAM in the IAM User Guide.

Permissions required to use the CodeGuru Profiler console

A user who uses the CodeGuru Profiler console must have a minimum set of permissions that allows them to describe other AWS resources for the AWS account. You must have permissions from the following services:

If you create an IAM policy that is more restrictive than the minimum required permissions, the console won't function as intended.

Permissions required by the CodeGuru Profiler profiling agent

The CodeGuru Profiler profiling agent is imported into your profiled application. When your application runs, the agent starts in a different thread to profile your application. The following permissions are required to submit data to CodeGuru Profiler:

For more information, see Enabling the agent with code.

The following example policy grants the current AWS user permission to write to a single profiling group in the current AWS Region. 

{
   "Statement": [{
      "Effect": "Allow",
      "Action": [
         "codeguru-profiler:ConfigureAgent",
         "codeguru-profiler:PostAgentProfile"
      ],
      "Resource": "arn:aws:codeguru-profiler:region-id:aws-account-id:profilingGroup/profilingGroupName"
   }]
}

Permissions required to access CodeGuru Profiler data

Data collected and submitted to CodeGuru Profiler by an agent is used to create application profiles for visualizations:

For more information, see Working with visualizations.

The following is an example.

{
   "Statement": [{
      "Effect": "Allow",
      "Action": [
         "codeguru-profiler:GetProfile",
         "codeguru-profiler:DescribeProfilingGroup"           
      ],
      "Resource": "arn:aws:codeguru-profiler:region-id:aws-account-id:profilingGroup/profilingGroupName"        
   }]
}

For the CodeGuru Profiler console, it can be useful to have an additional policy statement providing ListProfilingGroups permissions to allow users to see the list ofProfilingGroups. For example, the following allows users to see a list of all profiling groups in their AWS account and Region. 

{
   "Statement": [{
      "Effect": "Allow",
      "Action": [
         "codeguru-profiler:ListProfilingGroups"
      ],
      "Resource": "*"
   }]
}

For more information, see ConfigureAgent, PostAgentProfile, GetProfile, DescribeProfilingGroup, and ListProfilingGroups in the Amazon CodeGuru Profiler API Reference.

AWS managed (predefined) policies for CodeGuru Profiler

AWS addresses many common use cases by providing standalone IAM policies that are created and administered by AWS. These AWS managed policies grant necessary permissions for common use cases so you can avoid having to investigate what permissions are needed. For more information, see AWS Managed Policies in the IAM User Guide.

To create and manage CodeGuru Profiler service roles, you must also attach the AWS managed policy named IAMFullAccess.

You can also create your own custom IAM policies to allow permissions for CodeGuru Profiler actions and resources. You can attach these custom policies to the IAM users or groups that require those permissions.

The following AWS managed policies, which you can attach to users in your account, are specific to CodeGuru Profiler.

Topics

AmazonCodeGuruProfilerFullAccess

AmazonCodeGuruProfilerFullAccess – Provides full access to CodeGuru Profiler, including permissions to create, update, and delete profiling groups. Apply this only to administrative-level users who you want to grant full control over CodeGuru Profiler profiling groups and related resources in your AWS account, including the ability to delete profiling groups.

The AmazonCodeGuruProfilerFullAccess policy contains the following statement.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "codeguru-profiler:*",
                "iam:ListRoles",
                "iam:ListUsers",
                "codeguru:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

AmazonCodeGuruProfilerReadOnlyAccess

AmazonCodeGuruProfilerReadOnlyAccess – Grants read-only access to CodeGuru Profiler and related resources in other AWS services. Apply this policy to users who you want to grant the ability to view profiling group visualizations, but not make any changes to them.

The AmazonCodeGuruProfilerReadOnlyAccess policy contains the following statement.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "codeguru-profiler:Get*",
                "codeguru-profiler:Describe*",
                "codeguru-profiler:List*",
                "iam:ListRoles",
                "iam:ListUsers",
                "codeguru:Get*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

AmazonCodeGuruProfilerAgentAccess

AmazonCodeGuruProfilerAgentAccess – Provides access to CodeGuru Profiler agent to create a Profiling Group, refresh its configuration and submit profiles to the CodeGuru Profiler service.

The AmazonCodeGuruProfilerAgentAccess policy contains the following statement.

{
   "Version": "2012-10-17",
   "Statement": [
       {
         "Action": [
             "codeguru-profiler:ConfigureAgent",
             "codeguru-profiler:CreateProfilingGroup",
             "codeguru-profiler:PostAgentProfile",
         ],
         "Effect": "Allow",
         "Resource": "*"
      }
   ]
}

Customer managed policy examples

You can create your own custom IAM policies to allow permissions for CodeGuru Profiler actions and resources. You can attach these custom policies to the IAM users, roles, or groups that require those permissions. You can also create your own custom IAM policies for integration between CodeGuru Profiler and other AWS services.

The following example IAM policies grant permissions for various CodeGuru Profiler actions. Use them to limit CodeGuru Profiler access for your IAM users and roles. These policies control the ability to perform actions by using the CodeGuru Profiler console, API, AWS SDKs, or the AWS CLI.

Note

All examples use the US East (Ohio) Region (us-east-2) and contain fictitious account IDs.

Examples

Example 1: Allow a user to see all profiling groups and the visualizations of only one profiling group

The following example policy grants permissions for the AWS user with account ID 123456789012 to see a list of all profiling groups in their AWS account and Region. That user can see visualizations for only one profiling group named my-profiling-group. 

{
   "Statement": [
      {
         "Effect": "Allow",
         "Action": [
            "codeguru-profiler:GetProfile",
            "codeguru-profiler:DescribeProfilingGroup"
         ],
         "Resource": "arn:aws:codeguru-profiler:us-east-2:123456789012:profilingGroup/my-profiling-group"
      },
      {
         "Effect": "Allow",
         "Action": [
            "codeguru-profiler:ListProfilingGroups"
         ],
         "Resource": "*"
      }
   ]
}

Example 2: Allow a user to perform CodeGuru Profiler operations in a single Region

The following permissions policy uses a wildcard character ("codeguru-profiler:*") to allow users to perform all CodeGuru Profiler actions in the us-east-2 Region and not from other AWS Regions.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "codeguru-profiler:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "us-east-2"
        }
      }
    }
  ]
}

Example 3: Allow a user connecting from a specified IP address range access to a profiling group

You can create a policy that allows users to view a CodeGuru Profiler profiling group only if their IP address is within a certain IP address range. Because theGetFindingsReportAccountSummary and ListProfilingGroups actions don't support resource-level permissions, their resource is specified as wildcard character (*) in a separate statement. For more information, see the Amazon CodeGuru Profiler permissions reference.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "codeguru-profiler:*",
        "iam:ListRoles",
        "iam:ListUsers",
        "codeguru:*"
      ],
      "Resource": "arn:aws:codeguru-profiler:us-east-2:544120495673:profilingGroup/DemoProfilingGroup",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "codeguru-profiler:GetFindingsReportAccountSummary",
        "codeguru-profiler:ListProfilingGroups"
      ],
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}