Background
I was handed over one AWS account at the root level by a business owner which runs different EC2 machines (staging/prod etc). What I want to do is simply create different IAM accounts that have restricted access. For example now I would like to create an IAM account that only has access to run, terminate a specific EC2 Instance.
What I have tried
I basically followed instructions here. I created an IAM group (called superAdmin
), and I created a new IAM account and I assigned a new user (user_1
) to that group.
Then I proceeded to create a policy, and attached it to the superAdmin
group, the policy looks like this
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt15094*****",
"Effect": "Allow",
"Action": [
"ec2:*"
],
"Resource": [
"arn:aws:ec2:eu-west-1:%my-account-id%:instance/i-%instance-id%"
]
}
]
}
I made sure the resource follows the resource policy to the dot. (note: the instances are running in Ireland, which according to this is the same as eu-west-1
)
I then called this policy staging_access
and attached it to the user_1
(but also removed all other policies):
Problem
The problem is that when I login as user_1
, I cannot see anything:
and when I go to the instances page, nothing shows:
update
I noticed that if I simply made the resource a wild card.. everything would work:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1509458879000",
"Effect": "Allow",
"Action": [
"ec2:*"
],
"Resource": [
"*"
]
}
]
}
The interesting part is that even if I set the resource as a wild card on all ec2 like so:
"Resource": [
"arn:aws:ec2:*"
]
it still doesn't work. Which means that accessing the console UI is a different service namespace than ec2.
I would like to create an IAM account that only has access to run, terminate a specific EC2 Instance
do you mean stop/start existing EC2 or terminate/launch a new one?