0

With this link, I can restrict user only to poweron/off a machine and terminate option is removed.

But, I want to restrict user to access only few machines assigned to the user and not show other machines.

With only the Owner or any custom tag we can filter.

How to do that?

Improve this question

1 Answer 1

Reset to default
0

Depends on how far you want to restrict that access and it will depend on how you define the IAM policy / role that you assign to the user.

For example, you can't prevent the user from seeing instances that don't match their custom tag filter because the DescribeInstances action doesn't accept Condition Keys. On the other hand, RunInstances does allow for aws:ResourceTag/${TagKey} condition keys to be applied, same for StartInstances and StopInstances.

You can have a look at https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html for the full list of actions and condition keys that apply.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .