0

Background

I was handed over one AWS account at the root level by a business owner which runs different EC2 machines (staging/prod etc). What I want to do is simply create different IAM accounts that have restricted access. For example now I would like to create an IAM account that only has access to run, terminate a specific EC2 Instance.

What I have tried

I basically followed instructions here. I created an IAM group (called superAdmin), and I created a new IAM account and I assigned a new user (user_1) to that group.

Then I proceeded to create a policy, and attached it to the superAdmin group, the policy looks like this

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt15094*****",
            "Effect": "Allow",
            "Action": [
                "ec2:*"
            ],
            "Resource": [
                "arn:aws:ec2:eu-west-1:%my-account-id%:instance/i-%instance-id%"
            ]
        }
    ]
}

I made sure the resource follows the resource policy to the dot. (note: the instances are running in Ireland, which according to this is the same as eu-west-1)

I then called this policy staging_access and attached it to the user_1 (but also removed all other policies):

enter image description here

Problem

The problem is that when I login as user_1, I cannot see anything:

enter image description here

and when I go to the instances page, nothing shows:

enter image description here

update

I noticed that if I simply made the resource a wild card.. everything would work:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1509458879000",
            "Effect": "Allow",
            "Action": [
                "ec2:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

The interesting part is that even if I set the resource as a wild card on all ec2 like so:

         "Resource": [
            "arn:aws:ec2:*"
        ]

it still doesn't work. Which means that accessing the console UI is a different service namespace than ec2.

2
  • I would like to create an IAM account that only has access to run, terminate a specific EC2 Instance do you mean stop/start existing EC2 or terminate/launch a new one?
    – ALex_hha
    Nov 1, 2017 at 11:47
  • @ALex_hha i want both of them
    – abbood
    Nov 1, 2017 at 12:15

2 Answers 2

1

You are defining the policy based upon EC2 Instance ID. You need to add more permissions so that the user can display things like key pairs, volumes, instances, etc. There is a difference between assigning permissions to manage an EC2 instance from the command line, which can be very tight, versus the permissions needed to access the Amazon Management Console.

Also, your policy has % characters. Is this actually in your policy or is this just there to show in your question?

[Updated]

A better approach to controlling access to resources is to use Tags. For example to only allow user XYZ to access certain EC2 instances, tag the instances. Here is an example policy using tags. This policy allows the user to list all EC2 instances, but only allows all EC2 actions on instances tagged with their username.

{
     "Version" : "2012-10-17",
          "Statement" :
     [
          {
               "Effect" : "Allow",
               "Action" : "ec2:*",
               "Resource" : "*",
               "Condition" : {
                    "StringEquals" : {
                         "ec2:ResourceTag/UserName" : "${aws:username}"
                    }
               }
          },
          {
               "Effect" : "Allow",
               "Action" : "ec2:Describe*",
               "Resource" : "*"
          },
          {
               "Effect" : "Deny",
               "Action" :
                    [
                         "ec2:CreateTags",
                         "ec2:DeleteTags"
                    ],
               "Resource" : "*"
          }
     ]
}
8
  • in general the % character is to indicate a variable name.. naturally i won't show my actual instance id etc hehe
    – abbood
    Nov 1, 2017 at 5:47
  • You need to add more permissions so that the user can display things like key pairs, volumes, instances, etc. There is a difference between assigning permissions to manage an EC2 instance from the command line so what will the permission json above look for all of those things? I'm more interested in console access rather than CLI access
    – abbood
    Nov 1, 2017 at 5:48
  • see my update, it shows that what you're saying is incorrect
    – abbood
    Nov 1, 2017 at 6:36
  • Just FYI sharing instance IDs is most likely safe. You can't even access them and it's your account. Knowing an instance ID doesn't give any access.
    – Tim
    Nov 1, 2017 at 8:08
  • @abbood. What is incorrect in my answer? Nov 2, 2017 at 0:10
0

work around answer

This isn't really the answer i was looking for, but it serves my needs none the less. I created two policies and applied both to the same user

policy 1: give them "spectator" access to everything:

Show Policy

 {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "***",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

policy 2: allow them to control a specific IAM

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "***",
            "Effect": "Allow",
            "Action": [
                "ec2:*"
            ],
            "Resource": [
                "arn:aws:ec2:eu-west-1:%account-id%:instance/i-%instance-id%"
            ]
        }
    ]
}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .