{"action":"opened","issue":{"url":"https://api.github.com/repos/azavea/nyc-trees/issues/603","labels_url":"https://api.github.com/repos/azavea/nyc-trees/issues/603/labels{/name}","comments_url":"https://api.github.com/repos/azavea/nyc-trees/issues/603/comments","events_url":"https://api.github.com/repos/azavea/nyc-trees/issues/603/events","html_url":"https://github.com/azavea/nyc-trees/issues/603","id":57930446,"number":603,"title":"Add certificate management policy actions to IAM accounts","user":{"login":"hectcastro","id":43639,"avatar_url":"https://avatars.githubusercontent.com/u/43639?v=3","gravatar_id":"","url":"https://api.github.com/users/hectcastro","html_url":"https://github.com/hectcastro","followers_url":"https://api.github.com/users/hectcastro/followers","following_url":"https://api.github.com/users/hectcastro/following{/other_user}","gists_url":"https://api.github.com/users/hectcastro/gists{/gist_id}","starred_url":"https://api.github.com/users/hectcastro/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hectcastro/subscriptions","organizations_url":"https://api.github.com/users/hectcastro/orgs","repos_url":"https://api.github.com/users/hectcastro/repos","events_url":"https://api.github.com/users/hectcastro/events{/privacy}","received_events_url":"https://api.github.com/users/hectcastro/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/azavea/nyc-trees/labels/parks","name":"parks","color":"5319e7"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-17T14:29:51Z","updated_at":"2015-02-17T14:29:51Z","closed_at":null,"body":"Our IAM staging and production accounts do not have permissions to manage certificates on the NYC Parks AWS accounts. The following steps allowed me to manage certificates on an Azavea AWS account that we have full control over:\r\n\r\n1.) Create a new custom policy\r\n\r\n![fullscreen_2_17_15__09_14](https://cloud.githubusercontent.com/assets/43639/6229581/9825c554-b686-11e4-8f16-d2a23460d57b.png)\r\n\r\n2.) Use the policy generator\r\n\r\n![fullscreen_2_17_15__09_15](https://cloud.githubusercontent.com/assets/43639/6229595/a587cb34-b686-11e4-8de7-29961ececdb5.png)\r\n\r\n3.) Select \"AWS Identity and Access Management\" as the AWS Service and any actions that deal with certificates (there should be **9**)\r\n\r\n![fullscreen_2_17_15__09_16](https://cloud.githubusercontent.com/assets/43639/6229630/d102bf4e-b686-11e4-8776-dc43dbbfe0e6.png)\r\n\r\n4.) Use `*` for the Amazon Resource Name\r\n\r\n![fullscreen_2_17_15__09_18](https://cloud.githubusercontent.com/assets/43639/6229637/dfe49b9a-b686-11e4-86f0-b8dc71f7b998.png)\r\n\r\n5.) Add the statement\r\n\r\n![fullscreen_2_17_15__09_18 2](https://cloud.githubusercontent.com/assets/43639/6229642/e7b93f38-b686-11e4-9744-d16320ea7973.png)\r\n\r\n6.) Finalize the policy\r\n\r\n![fullscreen_2_17_15__09_19](https://cloud.githubusercontent.com/assets/43639/6229649/f23af320-b686-11e4-9e8a-971e6e227a8c.png)\r\n\r\n7.) Associate the policy under each account with the `azavea-stg` and `azavea-prd` IAM accounts\r\n\r\n(We need a similar policy under both accounts because we'd like to apply a certificate to the staging environment as well for testing.)"}}