I'm trying to understand the security implications of granting access to the create-image EC2 action. The docs say that the create-image action does not support IAM resources so it seems like granting access to this action will allow anyone with access to image any of our EC2 instances. Is that correct?
Further, if a user can create-image and then run-instance, I believe they can launch the new instance with their keypair and gain access to an otherwise off-limit sensitive information within the node. Is that correct?
This blog post suggests that we can use resource-level permissions to limit which AMIs a user can run, but my understanding is that IAM can allow us to control who can create-tags but not limit which tags they can create/modify, or which EC2 nodes or AMIs are tag-able.
This is all leading to is my core XY question.
Is there a way to grant some developers the ability to image some EC2 nodes without exposing secure credentials that might exist on other EC2 nodes?