IAM Policies: Allow Users to Create or Update CloudFormation Stacks Using Specific Templates Only

My Saved Presets

An IAM policy that allows users to create new or update existing CloudFormation stacks, as long as the template URL used is allowed (by using the cloudformation:TemplateURL condition key). This policy also provides the permissions necessary to complete this action on the console.

Missing Parameters

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "cloudformation:UpdateStack",
                "cloudformation:DeleteStack"
            ],
            "Resource": "*",
            "Effect": "Deny",
            "Condition": {
                "StringNotEquals": {
                    "cloudformation:TemplateURL": [
                        ""
                    ]
                }
            }
        },
        {
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:UpdateStack"
            ],
            "Resource": "*",
            "Effect": "Deny",
            "Condition": {
                "Null": {
                    "cloudformation:TemplateURL": "true"
                }
            }
        }
    ]
}

* Required field

Loading Library ...

Allow Users to Create or Update CloudFormation Stacks Using Specific Templates Only

Actions

Customize Template

Policy Parameters