IAM: Demonstrate Your Skills - Developer access (2/3)

Question

Developer access (2/3)I have completed the developer access question 1 with the following policy:{&nbsp; &nbsp; "Version": "2012-10-17",&nbsp; &nbsp; "Statement": [&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Sid": "VisualEditor0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Effect": "Allow",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Action": "iam:PassRole",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Resource": "arn:aws:iam::147026630027:role/*",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Condition": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "StringEquals": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:PassedToService": "lambda.amazonaws.com"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Sid": "VisualEditor1",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Effect": "Allow",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Action": "lambda:*",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Resource": "*"&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Sid": "VisualEditor2",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Effect": "Deny",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Action": "lambda:*",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Resource": "arn:aws:lambda:us-east-1:147026630027:function:virus-scanner"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]}Currently stuck on the Developer access 2 question:Update the developers-lambda policy, with the following additional permissions:Ensure the policy allows CreatePolicy, CreateRole, GetRole, GetPolicy, GetPolicyVersion, ListRoles, ListPolicies, ListRolePolicies, and ListAttachedRolePolicies actions for all resources.Ensure the policy allows role policy attachment to all resources, but only when the developers-s3 arn:aws:iam::147026630027:policy/developers-s3 policy is present as a permissions boundary. This essentially restricts the maximum permissions of any developer-created role. Leave any condition qualifiers as default and ArnEquals as the condition.I have this code but is not working:{&nbsp; &nbsp; "Version": "2012-10-17",&nbsp; &nbsp; "Statement": [&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Sid": "VisualEditor0",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Effect": "Allow",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Action": "iam:PassRole",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Resource": "arn:aws:iam::147026630027:role/*",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Condition": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "StringEquals": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:PassedToService": "lambda.amazonaws.com"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Sid": "VisualEditor1",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Effect": "Allow",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Action": [&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "lambda:*",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:CreatePolicy",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:CreateRole",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:GetRole",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:GetPolicy",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:GetPolicyVersion",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:ListRoles",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:ListPolicies",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:ListRolePolicies"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Resource": "*",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Condition": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "StringEquals": {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "iam:PermissionsBoundary": "arn:aws:iam::147026630027:policy/developers-s3"&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; },&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Sid": "VisualEditor3",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Effect": "Deny",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Action": "lambda:*",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; "Resource": "arn:aws:lambda:us-east-1:147026630027:function:virus-scanner"&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; ]}Any help would be great full. Thanks

netcat · Answer

Implement the 2nd bullet point first, then implement the 1st bullet point.