6

I looked through the official docs and couldn't seem to find any reference as to which permissions the IAM user needs in order to be able to use this command.

I want the IAM user to only be able to create images for this one particular instance, so I had my policy set up like this:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt999",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateImage"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:ec2:us-east-1:<my account id>:instance/<my instance id>"
      ]
    }
  ]
} 

But I kept getting Access Denied errors when using the EC2 CLI. I changed the Resource part to just "*" and now it works, but now my IAM user can create AMI's (therefore cause reboots) to any EC2 instances in my account.

How can I lock this down?

6

Unfortunately you can't lock this down on a resource level at the moment. There are a bunch of EC2 actions that doesn't support resource level permissions and ec2:CreateImage is one of them.

  • 1
    Boo! Well let's hope they eventually allow for that - I don't like to grant overly broad permissions. Thanks for the link – wwarren Mar 3 '15 at 21:20
  • 1
    @wwarren: Let's certainly hope so, I couldn't agree more. When it comes to permissions, stars are rarely ideal. – Bazze Mar 3 '15 at 21:26
7

Creating image also involves creation of snapshots attached to that instance. Below IAM policy should work.

{     
  "Effect": "Allow",
  "Action": [
    "ec2:Describe*",
    "ec2:CreateSnapshot",
    "ec2:CreateImage"
  ],
  "Resource": [
    "*"
  ]
}
0

You can't lock/limit CreateImage on resource level and @nkryption answer was right. http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html

0

Use the IAM Role as stated Try setting flag "--no-reboot" while using create-image. This will stop your server from rebooting while creating AMIs' for e.g.:

 ## Take the actual ami backup, and store the ami id in "AMI"
 AMI=$(aws ec2 create-image --instance-id ${instance-id} --name ${Random-Name}.AutoScript.${DATE} --description 'This is created by amibackup.sh' --no-reboot | ${GREP} -i ami)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.