cloudformation:UpdateStack is a Write access-level action in the cloudformation service. Grants permission to update a stack as specified in the template
ARNs that cloudformation:UpdateStack can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants cloudformation:UpdateStack.
Filters access by the tags that are passed in the request
Filters access by the tag keys that are passed in the request
Filters access by the template resource types, such as AWS::EC2::Instance. Use to control which resource types IAM users can work with when they create or update a stack
Filters access by the ARN of an IAM service role. Use to control which service role IAM users can use to work with stacks or change sets
Filters access by an Amazon S3 stack policy URL. Use to control which stack policies IAM users can associate with a stack during a create or update stack action
Filters access by an Amazon S3 template URL. Use to control which templates IAM users can use when they create or update stacks
Filters access by the tags associated with the resource
A minimal policy that allows cloudformation:UpdateStack. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCloudformationUpdateStack",
"Effect": "Allow",
"Action": "cloudformation:UpdateStack",
"Resource": "*"
}
]
}