[Feedback] IAM policy for Read-only users

Page: under /cli/teams

Feedback:

IAM policy for read-only users, who are able to execute amplify init, amplify mock and amplify add, would be super helpful for front-end developers. In the section “cli/teams”, describes how full-stack developers manage multiple env, but front-end developer should be prohibited to execute amplify push from local env in most cases.

BTW, IAM policy generated by IAM Access Analyzer should be like below

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "amplify:ListApps",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "amplify:CreateBackendEnvironment",
                "amplify:GetApp",
                "amplify:GetBackendEnvironment",
                "amplify:ListBackendEnvironments"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:CreateBucket",
            "Resource": "arn:aws:s3:::*"
        }
    ]
}

[josefaidt]

Hey @kopkunka55 👋 are you looking for an example that allows everything but amplify push?

@maziarzamani to clarify, when you say “only need read” permissions can you describe the workflow you’re aiming to achieve? Are you looking for permissions where front-end developers are able to initialize the project locally but not add/update/remove resources using the CLI?

[maziarzamani]

I have a similar use-case running an Amplify Application on a production account where front-end developers only need read abilities to the application and its environments.