IAM Policy Add-On

Overview

The IAM Policy add-on allows you to create and manage custom AWS Identity and Access Management (IAM) policies for your Tapitalee applications. This provides fine-grained access control to AWS services beyond the default permissions, enabling your applications to securely interact with additional AWS resources like S3 buckets, SQS queues, SNS topics, and other AWS services.

Use Cases

Common Scenarios

• Bedrock: Grant your application access to Amazon Bedrock

Basic Policy Structure

IAM policies use JSON format with the following structure:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "service:action"
      ],
      "Resource": "arn:aws:service:region:account:resource"
    }
  ]
}

Commands

Import IAM Policy

Create a custom IAM policy from a JSON file and attach it to the app’s task role

tapit import iam_policy name=policy_name < policy.json

Parameters

• name: Name for the custom policy (required)
• policy_json: The JSON document for the policy. Optionally used in tool-calling, when not importing via the CLI.

Imports custom IAM policies for advanced AWS service access.

Examples

# Create a simple policy file granting S3 read access
cat > s3-read-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": "*"
    }
  ]
}
EOF

# Import the policy
tapit import iam_policy name=s3-read < s3-read-policy.json

Create Managed IAM Policy

Attach an AWS managed IAM policy to the app’s task role

tapit create managed_iam_policy name=policy_name policy_arn=arn:aws:iam::aws:policy/ReadOnlyAccess

Parameters

• name: Name for this policy attachment (required)
• policy_arn: ARN of the AWS managed policy to attach (required)

Attaches an AWS-managed IAM policy to your application by ARN. Use this when you want to grant your application permissions defined by a policy that AWS manages for you — such as ReadOnlyAccess, AmazonS3ReadOnlyAccess, or any other policy found in the AWS managed policy library. You supply only the ARN; there is no policy document to maintain.

Examples

# Attach the AWS-managed AmazonBedrockFullAccess policy
tapit create managed_iam_policy name=bedrock policy_arn=arn:aws:iam::aws:policy/AmazonBedrockFullAccess

List IAM Policies

List all add-ons attached to the app with their state and configuration

tapit list addons [-w|--wait]

Parameters

• -w|--wait: Wait until all add-ons reach a stable state (fully ready or fully deleted); exits non-zero if any add-on is in a failed state

Shows all add-ons including IAM policies. Look for entries with type iam-policy.

Delete IAM Policy

Delete an add-on and all its associated AWS resources

tapit delete addon name=addon_name

Parameters

• name: Name of the add-on to delete (required)

Removes an IAM policy from your application. The policy will be detached from all application processes.

Environment Integration

Automatic Role Assignment

When you import an IAM policy, Tapitalee automatically:

1. Creates an IAM policy in your AWS account
2. Attaches the policy to your application’s IAM role — this role is shared by every container and EC2 instance in your app