stack_iam_deployment_role.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ECRandAppRunner",
            "Effect": "Allow",
            "Action": [
                "ecr:PutLifecyclePolicy",
                "ecr:PutImageTagMutability",
                "apprunner:DeleteAutoScalingConfiguration",
                "ecr:StartImageScan",
                "apprunner:DeleteService",
                "ecr:CreateRepository",
                "ecr:PutImageScanningConfiguration",
                "ecr:UploadLayerPart",
                "ecr:BatchDeleteImage",
                "ecr:DeleteLifecyclePolicy",
                "apprunner:UpdateService",
                "ecr:DeleteRepository",
                "ecr:PutImage",
                "apprunner:CreateService",
                "apprunner:CreateAutoScalingConfiguration",
                "apprunner:UntagResource",
                "apprunner:DescribeService",
                "ecr:CompleteLayerUpload",
                "apprunner:DescribeAutoScalingConfiguration",
                "ecr:StartLifecyclePolicyPreview",
                "ecr:InitiateLayerUpload",
                "ecr:DeleteRepositoryPolicy",
                "ecr:BatchCheckLayerAvailability",
                "apprunner:TagResource"
            ],
            "Resource": [
                "arn:aws:ecr:${AWSRegion}:${AWSAccountId}:repository/aws-app-runner",
                "arn:aws:apprunner:*:${AWSAccountId}:autoscalingconfiguration/*/*/*",
                "arn:aws:apprunner:${AWSRegion}:${AWSAccountId}:service/aws-app-runner-example/*",
                "arn:aws:apprunner:*:${AWSAccountId}:connection/*/*"
            ]
        },
        {
            "Sid": "ECRAuth",
            "Effect": "Allow",
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*"
        },
        {
            "Sid": "CloudFormation",
            "Effect": "Allow",
            "Action": [
                "cloudformation:DescribeStackEvents",
                "cloudformation:CreateStack",
                "cloudformation:TagResource",
                "cloudformation:CreateChangeSet",
                "cloudformation:DescribeChangeSet",
                "cloudformation:ExecuteChangeSet",
                "cloudformation:GetTemplateSummary",
                "cloudformation:DescribeStacks",
                "cloudformation:DeleteChangeSet"
            ],
            "Resource": [
                "arn:aws:cloudformation:*:${AWSAccountId}:stackset/*:*",
                "arn:aws:cloudformation:*:${AWSAccountId}:stack/aws-app-runner-example/*"
            ]
        },
        {
            "Sid": "IAM",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:UpdateAssumeRolePolicy",
                "iam:PassRole",
                "iam:DetachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:TagRole",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:GetRolePolicy",
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "arn:aws:iam::${AWSAccountId}:role/aws-app-runner-example-ECRAccessRole-*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::*:role/aws-service-role/apprunner.amazonaws.com/AWSServiceRoleForAppRunner",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "apprunner.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": "apprunner.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey",
                "kms:CreateGrant"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AppRunnerAdminAccess",
            "Effect": "Allow",
            "Action": "apprunner:*",
            "Resource": "*"
        }
    ]
}