1

I would like to create a user that has full console access (API too) specifically to just one VPC in our AWS environment.

The result should be such that when clicking on EC2 Instances, the user would only see machines in the specified VPC.

I attempted the following and it did not work:

{
  "Statement": [
    {
      "Sid": "Stmt1393948025170",
      "Action": "ec2:*",
      "Effect": "Allow",
      "Resource": "arn:aws:ec2:*:*:vpc/<vpc-id>"
    }
  ]
}
1
  • It should be possible. I couldn't make it work either. I will ask Amazon about it. You should be able to make it work with something like ` "Condition": { "ArnEquals": { "ec2:Vpc": "arn:aws:ec2:<your-region>:<your-account>:vpc/vpc-id" } }` but it's not working for me either.
    – Rico
    Mar 5, 2014 at 5:20

1 Answer 1

4

Got back from Amazon Support:

Unfortunately, there is not a way to do this at this time. While we do now offer resource level permissions for EC2 resources, (more info here... http://aws.typepad.com/aws/2013/07/resource-permissions-for-ec2-and-rds-resources.html) conditionally controlling access based on a specif VPC is not supported.

They mentioned this is because this link: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html#ec2-supported-iam-actions-resources show that there are a limited number of EC2 API actions supported and none of them support VPC as a ARN.

There's also a limitation on "ec2:Describe*", which cannot be specified by a resource ARN at all, and cannot be conditionally controlled.

There's a workaround using the conditional statement "ResourceTag/tag-key" which is usable by most API calls. So you can potentially tag your instances with "Control":"Allow" and don't include the create or remove tag privileges in the policy to be attached to the user in question. Your policy would look like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:RebootInstances",
                "ec2:TerminateInstances"
            ],
            "Resource": "arn:aws:ec2:REGION:ACCOUNTNUMBER:instance/*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/Control": "Allow"
                }
            }
        }
    ]
}

Then you can restrict the user to launch instance just in a particular VPC using its subnet-id:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:region:account:instance/*",
                "arn:aws:ec2:region:account:subnet/SUBNET-ID-HERE",
                "arn:aws:ec2:region:account:volume/*",
                "arn:aws:ec2:region:account:network-interface/*",
                "arn:aws:ec2:region:account:key-pair/*",
                "arn:aws:ec2:region:account:security-group/*",
                "arn:aws:ec2:region::image/ami-*"
            ]
        }
    ]
}

Hope this helps.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .