Effective DevOps with AWS

Updating the IAM profile through CloudFormation

In order to add the new privileges to the instance profile, we are going to edit the template we created earlier in the chapter.

Edit the file jenkins-cf-template.py we created earlier. We are going to add a policy to grant permissions to the Jenkins instance to communicate with CodePipeline. This step is very similar to the change we made to grant S3 access to our web server.

Above the instance variable instantiation, add the following:

t.add_resource(IAMPolicy("Policy", 
    PolicyName="AllowCodePipeline", 
    PolicyDocument=Policy( 
        Statement=[ 
            Statement(Effect=Allow, 
                Action=[Action("codepipeline", "*")], 
                Resource=["*"]) 
        ] 
    ), 
    Roles=[Ref("Role")] 
)) 

Then, save the changes and regenerate the template. ...