IAM / devops / cloudformation

AWS CloudFormation (IAM)

JSON →
AWScloudformationdevops

AWS CloudFormation is an infrastructure as code (IaC) service for modeling and provisioning AWS resources using templates.

iamaws
docs ↗
Permissions
Actions in this service
cloudformation:ListStacks
cloudformation:DescribeStacks
cloudformation:CreateStack
cloudformation:UpdateStack
cloudformation:GetTemplate
cloudformation:ListChangeSets
cloudformation:DescribeChangeSet
cloudformation:TagResource
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:GetTemplate", "cloudformation:ListChangeSets", "cloudformation:DescribeChangeSet", "cloudformation:TagResource" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid cloudformation:* — grants full control including stack deletion and resource modification
Avoid cloudformation:DeleteStack unless needed — can delete entire stacks and all resources
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/cloudformation/cloudformation.json ↗