cloudformation:UpdateStackSet is a Write access-level action in the cloudformation service. Grants permission to update a stackset as specified in the template
ARNs that cloudformation:UpdateStackSet can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants cloudformation:UpdateStackSet.
Filters access by the tags that are passed in the request
Filters access by the tag keys that are passed in the request
Filters access by the ARN of an IAM service role. Use to control which service role IAM users can use to work with stacks or change sets
Filters access by stack set target region. Use to control which regions IAM users can use when they create or update stack sets
Filters access by an Amazon S3 template URL. Use to control which templates IAM users can use when they create or update stacks
Filters access by the tags associated with the resource
A minimal policy that allows cloudformation:UpdateStackSet. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCloudformationUpdateStackSet",
"Effect": "Allow",
"Action": "cloudformation:UpdateStackSet",
"Resource": "*"
}
]
}