Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible (using ARN) to make several groups of instances. Then using different policies to grant access to a group of instance only and not the other instances?

For example :

{
  "Statement": [
    {
      "Action": "ec2:*",
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "elasticloadbalancing:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "cloudwatch:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "autoscaling:*",
      "Resource": "*"
    }
  ]
}

Instead of "*" could we use a group or something like that? like a specific subnet? a Tag? or whatever...

Thanks for your help

share|improve this question
add comment

1 Answer

No EC2 doesn't provide any way to do this with instances. ARN resource names are only available for products that are listed with a check in the Resource column and there is no other method of filtering out resources.

http://docs.amazonwebservices.com/IAM/latest/UserGuide/Using_SpecificProducts.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.