AWS LoadBalancer IAM Readonly Rule Error

Question

I have created custom IAM policy to have a read access to loadbalancer. But I am getting error as...

An error occurred fetching load balancer data: User: arn:aws:iam::000000000000:user/xxxxxxxx is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers

Bellow is the policy.

{
  "Version": "2012-10-17",
  "Statement":[{
    "Effect": "Allow",
    "Action": [
                "elasticloadbalancing:Describe*",
        ],
    "Resource": "arn:aws:elasticloadbalancing:us-west-2:000000000000:loadbalancer/*"
  }]
}

Please some one help with this.

---

Thanks

Sreekanth

Answer 1

Generally speaking, the Describe* actions do not support resource-level permissions.

For Describe* actions, you need to use * as your resource, otherwise, the commands will fail as not permitted.

Documentation and more information: http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html#elb-resource-level-permissions

Answer 2

Here is the solution I figured out. Bellow is the policies.

Read only AWS LB Access Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "elasticloadbalancing:Describe*"
            ],
            "Resource": "*"
        }
    ]
}