Example: Strict AWS IAM Permission Boundary
Last updated: July 14, 2026
Restrictive Permission Boundaries are achievable while still allowing deployment and operation of your Snowplow pipeline. If you're intending to take this approach as a customer, please reach out to our Support team for assistance.
The example Permission Boundary below has been called SnowplowBoundary and is attached to the SnowplowAdmin / SnowplowDeployment roles. It is used for all deployments in the account.
{
"Statement": [
{
"Action": [
"iam:PutUserPermissionsBoundary",
"iam:PutRolePermissionsBoundary",
"iam:CreateUser",
"iam:CreateRole"
],
"Condition": {
"StringNotEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::{Customer Account Id}:policy/SnowplowBoundary"
}
},
"Effect": "Deny",
"Resource": "*",
"Sid": "CreateUsersOrRolesOnlyWithBoundary"
},
{
"Action": "iam:*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "{Customer Account Id}"
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "AllowIam"
},
{
"Action": [
"route53resolver:*",
"route53:*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "{Customer Account Id}"
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "AllowR53"
},
{
"Action": [
"iam:UpdateRoleDescription",
"iam:UpdateRole",
"iam:UpdateAssumeRolePolicy",
"iam:UntagRole",
"iam:TagRole",
"iam:PutRolePermissionsBoundary",
"iam:PassRole",
"iam:DeleteRolePermissionsBoundary",
"iam:DeleteRole",
"iam:CreateRole"
],
"Effect": "Deny",
"Resource": "arn:aws:iam::{Customer Account Id}:role/SnowplowAdmin",
"Sid": "DenyAdminRoleBoundaryEdit"
},
{
"Action": [
"iam:SetDefaultPolicyVersion",
"iam:DeletePolicyVersion",
"iam:DeletePolicy",
"iam:CreatePolicyVersion"
],
"Effect": "Deny",
"Resource": "arn:aws:iam::{Customer Account Id}:policy/SnowplowBoundary",
"Sid": "DenyBoundaryPolicyEdit"
},
{
"Action": [
"iam:DeleteUserPermissionsBoundary",
"iam:DeleteRolePermissionsBoundary"
],
"Condition": {
"StringEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::{Customer Account Id}:policy/SnowplowBoundary"
}
},
"Effect": "Deny",
"Resource": "*",
"Sid": "NoRemoveBoundary"
},
{
"Action": [
"wafv2:List*",
"wafv2:Describe*",
"wafv2:Get*",
"support:*",
"ssm:*",
"sqs:*",
"sns:*",
"secretsmanager:TagResource",
"secretsmanager:PutSecretValue",
"secretsmanager:GetSecretValue",
"secretsmanager:GetResourcePolicy",
"secretsmanager:DescribeSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:CreateSecret",
"servicequotas:*",
"s3:*",
"redshift:*",
"rds:*",
"logs:*",
"lambda:*",
"kms:List*",
"kms:DescribeKey",
"kms:CreateKey",
"kms:PutKeyPolicy",
"kms:GetKeyPolicy",
"kms:GetKeyRotationStatus",
"kms:ScheduleKeyDeletion",
"kms:CreateAlias",
"kms:TagResource",
"kms:Decrypt",
"sts:AssumeRole",
"tag:GetResources",
"kinesisanalytics:*",
"kinesis:*",
"execute-api:*",
"events:*",
"es:*",
"elasticmapreduce:*",
"elasticloadbalancing:*",
"elasticbeanstalk:*",
"elasticache:*",
"eks:*",
"ecs:*",
"ecr:*",
"ec2:*",
"dynamodb:*",
"cloudwatch:*",
"cloudfront:*",
"cloudformation:*",
"aws-marketplace:ViewSubscriptions",
"aws-marketplace:Unsubscribe",
"aws-marketplace:Subscribe",
"autoscaling:*",
"application-autoscaling:*",
"apigateway:*",
"acm:*"
],
"Condition": {
"StringEquals": {
"aws:RequestedRegion": [
"{list of regions that the customer allows the account to access - normally just needs the one being deployed in}"
],
"aws:ResourceAccount": "{Customer Account Id}"
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "SnowplowAdminActionsAccountAndRegions"
},
{
"Action": "ec2:RunInstances",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": [
"{list of regions that the customer allows the account to access - normally just needs the one being deployed in}"
]
}
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:{Customer Account Id}:*/*",
"arn:aws:ec2:*:*:snapshot/*",
"arn:aws:ec2:*:*:image/*"
],
"Sid": "SnowplowAdminRunInstances"
},
{
"Action": [
"s3:ListMultipartUploadParts",
"s3:ListBucket*",
"s3:GetObject*",
"s3:GetBucket*"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::snowplow-hosted-assets-proprietary-eu-west-1/*",
"arn:aws:s3:::snowplow-hosted-assets-proprietary-eu-west-1",
"arn:aws:s3:::snowplow-hosted-assets-eu-west-1/*",
"arn:aws:s3:::snowplow-hosted-assets-eu-west-1",
"arn:aws:s3:::snowplow-hosted-assets/*",
"arn:aws:s3:::snowplow-hosted-assets"
],
"Sid": "SnowplowAdminListReadTheirBucket"
},
{
"Action": [
"ec2:GetManagedPrefixListEntries",
"ec2:GetManagedPrefixListAssociations"
],
"Condition": {
"StringEquals": {
"aws:RequestedRegion": [
"{list of regions that the customer allows the account to access - normally just needs the one being deployed in}"
]
}
},
"Effect": "Allow",
"Resource": "arn:aws:ec2:*:*:prefix-list/*",
"Sid": "SnowplowAdminGetEC2Prefix"
},
{
"Action": [
"iam:ListPolicyVersions",
"iam:ListPolicies",
"iam:GetPolicyVersion",
"iam:GetPolicy"
],
"Effect": "Allow",
"Resource": "arn:aws:iam::*:policy/*",
"Sid": "SnowplowAdminGetAWSManagedPolicies"
},
{
"Action": "ec2:DescribeImage*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": [
"{list of regions that the customer allows the account to access - normally just needs the one being deployed in}"
]
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "SnowplowAdminListAMIs"
},
{
"Action": [
"sns:*",
"cloudwatch:*"
],
"Condition": {
"StringEquals": {
"aws:RequestedRegion": [
"us-east-1"
]
}
},
"Effect": "Allow",
"Resource": "*",
"Sid": "LimitedUsEast1"
}
],
{
"Action": [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:DescribeImages",
"ecr:DescribeImageScanFindings",
"ecr:DescribeRepositories",
"ecr:GetAuthorizationToken",
"ecr:GetDownloadUrlForLayer",
"ecr:GetLifecyclePolicy",
"ecr:GetLifecyclePolicyPreview",
"ecr:GetRepositoryPolicy",
"ecr:ListImages",
"ecr:ListTagsForResource"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"servicequotas:*"
],
"Effect": "Allow",
"Resource": "*"
}
"Version": "2012-10-17"
}