I'm looking for a way to restrict the visibility ec2 instances to certain IAM accounts. I'd really like a way for a particular account to only be able to see the instances that it has created i.e. when it does a describeInstances only those it has created are present.

I've been looking into using custom IAM policies based on resource tags to do this and while the management looks to be ok, each account can still see instances created by other users using describeInstances.

Really I'm looking for a way to hide resources created by different IAM accounts from one another. Is this currently possible?

  • When you say 'IAM accounts', I presume you mean multiple 'IAM users' within a single 'AWS account'? Mar 17 '14 at 17:52

If your user's resources don't need to inter-operate, then a different option is to use multiple separate AWS accounts, then set up consolidated billing so that bills for all accounts are put together on one bill.

Each of your users would have their own AWS account. They would see only the resources in their own account.

  • I was holding this in reserve as a last resort but I did not know about the consolidated billing. I think I'll have to go this route.
    – sgargan
    Mar 18 '14 at 20:20

Unfortunately AWS Identity and Access Management (IAM) doesn't fully cover this particular aspect as of today, because the recently introduced Resource-Level Permissions for EC2 and RDS Resources are not yet available for all API actions, see this note from Amazon Resource Names for Amazon EC2:

Important Currently, not all API actions support individual ARNs; we'll add support for additional API actions and ARNs for additional Amazon EC2 resources later. For information about which ARNs you can use with which Amazon EC2 API actions, as well as supported condition keys for each ARN, see Supported Resources and Conditions for Amazon EC2 API Actions.

You will find that all ec2:Describe* actions are indeed absent still from Supported Resources and Conditions for Amazon EC2 API Actions at the time of this writing.

See also Granting IAM Users Required Permissions for Amazon EC2 Resources for a concise summary of the above and details on the ARNs and Amazon EC2 condition keys that you can use in an IAM policy statement to grant users permission to create or modify particular Amazon EC2 resources - this page also mentions that AWS will add support for additional actions, ARNs, and condition keys in 2014.

  • This is a pity! I'll keep an eye out for its availability. Thanks for your answer.
    – sgargan
    Mar 18 '14 at 20:21
  • Has there been any change in this status? Is it possible to achieve the same as of Oct 2014? Oct 9 '14 at 6:38
  • @AnshuPrateek - while the list of Supported Resources and Conditions for Amazon EC2 API Actions for resource-level permissions has been expanded over time, it still doesn't include the ec2:Describe* API actions as of today, unfortunately (and somewhat surprisingly too). Oct 9 '14 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.