Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 3 down vote favorite

I would like to:

  1. Create an IAM user
  2. Restrict that user to be able to have full management over a single EC2 Instance only.

Example: While the AWS EC2 account has 10 instances, the new user, UserA, can start or stop InstanceA but can do nothing else on the account (No launching of instances, no messing with volumes, etc).

Is there a simple method for giving a single user full access to a single resource like this, but no access to anything else?

share|improve this question

1 Answer

up vote 5 down vote accepted

EC2 instances do not have a "Amazon Resource Name" (ARN) so you are not able to write a IAM policy to allow a user access to a single instance.

If I can suggest another approach. The easiest way to handle this type of request is probably by giving the user SSH access to the instance and allowing them to sudo the commands you want them to be able to do such as reboot.

EDITED: Forgot to mention there is a nice AWS Policy Generator tool online which is very helpful. http://awspolicygen.s3.amazonaws.com/policygen.html

share|improve this answer
Well this result is disappointing, but I really appreciate the answer and the link to the policy generator. – Frankston Ralphington III May 5 '11 at 18:59
No problem. The way they continue to grow that environment and the services, it would not surprise me if the ability to manage individual EC2 instances through IAM policy doesn't happen in the near future. – Shocm May 5 '11 at 19:32
I agree. I'm sure it will happen. For now, I'm able to split off separate EC2 Amazon accounts and utilize consolidated billing to our master account. – Frankston Ralphington III May 5 '11 at 19:45
1  
any movement on this ? – Sirex Aug 1 '12 at 23:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.