policy-doc.html.md.erb

---
title: Pivotal Cloud Foundry® for AWS Policy Document
owner: Ops Manager
---

<strong><%= modified_date %></strong>

Use this policy document to complete the [Create an IAM User for Pivotal Cloud Foundry&reg;](./pcf-aws-manual-config.html#pcfaws-iam-user) step of the Manually Configuring AWS for [Pivotal Cloud Foundry&reg;](https://network.pivotal.io/products/pivotal-cf) (PCF) procedure.

From the AWS console, copy and paste the following text in the **Policy Document** field.

<p class="note"><strong>Note</strong>: Ensure that you edit the <code>S3_BUCKET_NAME</code> placeholder text with the names of the buckets that you created.</p>

<pre class="code">

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Effect": "Deny",
        "Action": [
            "iam:*"
        ],
        "Resource": [
            "*"
        ]
    },
    {
        "Sid": "OpsMgrInfrastructureIaasConfiguration",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeKeypairs",
            "ec2:DescribeVpcs",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeAvailibilityZones",
            "ec2:DescribeAccountAttributes"
        ],
        "Resource": "*"
    },
    {
        "Sid": "OpsMgrInfrastructureDirectorConfiguration",
        "Effect": "Allow",
        "Action": [
            "s3:*"
        ],
        "Resource": [
            "arn:aws:s3:::OPS_MANAGER_S3_BUCKET",
		    "arn:aws:s3:::OPS_MANAGER_S3_BUCKET/*",
		    "arn:aws:s3:::ELASTIC_RUNTIME_S3_BUCKET",
		    "arn:aws:s3:::ELASTIC_RUNTIME_S3_BUCKET/*"
        ]
    },
    {
        "Sid": "OpsMgrInfrastructureAvailibilityZones",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeAvailabilityZones"
        ],
        "Resource": "*"
    },
    {
        "Sid": "OpsMgrInfrastructureNetworks",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeSubnets"
        ],
        "Resource": "*"
    },
    {
        "Sid": "DeployMicroBosh",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeImages",
            "ec2:RunInstances",
            "ec2:DescribeInstances",
            "ec2:TerminateInstances",
            "ec2:RebootInstances",
            "elasticloadbalancing:DescribeLoadBalancers",
            "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
            "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
            "ec2:DescribeAddresses",
            "ec2:DisassociateAddress",
            "ec2:AssociateAddress",
            "ec2:CreateTags",
            "ec2:DescribeVolumes",
            "ec2:CreateVolume",
            "ec2:AttachVolume",
            "ec2:DeleteVolume",
            "ec2:DetachVolume",
            "ec2:CreateSnapshot",
            "ec2:DeleteSnapshot",
            "ec2:DescribeSnapshots",
            "ec2:DescribeRegions"
        ],
        "Resource": "*"
    }
]
}


</pre>