Examples: Trust and permission policies

Trust policy 

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Principal": { "AWS": "arn:aws:iam::1234567890123:role/OomnitzaSampleRole" },
     "Action": "sts:AssumeRole",
     "Condition": {
       "StringEquals": { "sts:ExternalId": "ext-123e4567-e89b-12d3-a456-426614174000" }
     }
   }
 ]
}

Permission policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadOnlyDescribe",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "rds:Describe*",
        "redshift:Describe*",
        "s3:List*",
        "iam:List*",
        "workspaces:Describe*",
        "organizations:ListAccounts"
      ],
      "Resource": "*"
    }
  ]
}

You can expand the Action section in the Permission policy to match all the services that you run through Oomnitza such as redshift:Describe*, s3:List*, workspaces:Describe*, iam:List*.

Important
Required for account discovery.Include organizations:ListAccounts in the IAM role’s permissions as in the template.