replace '*' in IAM role permission with action level permissions (#1090)

Author: yijiezh

reinforcement_learning/common/markdown_helper.py

@@ -185,13 +185,36 @@ def generate_help_for_experiment_manager_permissions(role):
         {
             "Effect": "Allow",
             "Action": [
-                "firehose:*",
-                "cloudformation:*",
-                "dynamodb:*",
-                "iam:*",
-                "cloudwatch:*",
-                "glue:*",
-                "athena:*"
+                "cloudformation:DescribeStacks",
+                "cloudformation:ValidateTemplate",
+                "cloudformation:CreateStack",
+                "dynamodb:DescribeTable",
+                "dynamodb:CreateTable",
+                "dynamodb:DeleteTable",
+                "dynamodb:PutItem",
+                "dynamodb:UpdateItem",
+                "dynamodb:DeleteItem",
+                "dynamodb:Query",
+                "dynamodb:BatchWriteItem",
+                "iam:CreateRole",
+                "iam:GetRole",
+                "iam:PutRolePolicy",
+                "iam:DeleteRolePolicy",
+                "iam:DeleteRole",
+                "iam:PassRole",
+                "cloudwatch:PutDashboard",
+                "firehose:ListDeliveryStreams",
+                "firehose:DeleteDeliveryStream",
+                "firehose:DescribeDeliveryStream",
+                "firehose:CreateDeliveryStream",
+                "athena:StartQueryExecution",
+                "athena:GetQueryExecution",
+                "glue:GetTable",
+                "glue:DeleteTable",
+                "glue:GetPartitions",
+                "glue:UpdateTable",
+                "glue:CreateTable",
+                "glue:GetDatabase"
             ],
             "Resource": [
                 "*"

reinforcement_learning/common/sagemaker_rl/orchestrator/cloudformation.yaml

@@ -135,8 +135,10 @@ Resources:
               - "ecr:BatchCheckLayerAvailability"
               - "ecr:GetDownloadUrlForLayer"
               - "ecr:BatchGetImage"
-              - "dynamodb:*"
-              - "firehose:*"
+              - "dynamodb:Query"
+              - "dynamodb:DescribeTable"
+              - "firehose:PutRecord"
+              - "firehose:PutRecordBatch"
             Resource:
               - "*"
       PolicyName: SageMakerAssumedRolePolicy