Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have volumes mounted on EC2 instances of which I would like to make snapshots.

I created a new IAM user with the following policy:

{
  "Statement": [
    {
      "Sid": "...",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSnapshot",
        "ec2:CreateTags",
        "ec2:DeleteSnapshot",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeSnapshots",
        "ec2:DescribeTags",
        "ec2:DescribeVolumeAttribute",
        "ec2:DescribeVolumeStatus",
        "ec2:DescribeVolumes"
      ],
      "Resource": [
        "arn:aws:ec2:eu-west-1:MY_USER_ID"
      ]
    }
  ]
}

I have added the access key and secret to my ~/.bashrc and sourced it. When I run ec2-describe-snapshots I get this response: Client.UnauthorizedOperation: You are not authorized to perform this operation.

When my "Resource" was just "*" I was able to list all types of Amazon's snapshots. I am looking to create snapshots owned by/visible to just me in the eu-west-1 region.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

As wisely posted at http://stackoverflow.com/questions/23832819/how-can-i-limit-ec2-describe-images-permissions Resource level permissions are not implemented at all on ec2:Describe* actions.

In Reality you need to limit access based on other things and not the resource ARN.

share|improve this answer
    
I see! Well I tried directly just creating a snapshot with the same policy but I still encountered an error. I changed my Resource to * again and I was able to create the snapshot. Can I assume that the snapshots will always be created as private to my account? –  juuga Jun 10 at 12:42
    
By default yes. The snapshots are private unless set to public –  zeridon Jun 10 at 12:57
    
Thanks, I will work with this. –  juuga Jun 10 at 13:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.