0

I have two VPC's in my account. One for DEV and One for Production. I want to create a IAM User which, the user should only see the DEV EC2 instances in the console and should able to create or reboot the instances. He should not able to see the Production EC2 instances. I tried with bellow policy and got error as "An error occurred fetching address data: You are not authorized to perform this operation." My IAM Policy...

 {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "ec2:Describe*",
                    "ec2:RebootInstances",
                    "ec2:RunInstances",
                    "ec2:CreateTags"
                ],
                "Effect": "Allow",
                "Resource": "*",
                "Condition": {
                    "StringEquals": {
                        "ec2:Region:VPC": "us-west-2:vpc/vpc-00000000"
                    }
                }
            }
        ]
    }

I could able to do some thing here with the policy bellow. But not able to apply the Tags. The thing is User should not able to rename any other Tags other tags in PRODUCTION VPC when I insert the bellow rule then user could able to change the Tags of Other VPC instances as well ...

 {
    "Effect": "Allow",
    "Action": "ec2:CreateTags",
    "Resource": [
    "*"
    ]
    }

Here is my current rule which can read other VPC instances but only readonly. I am fine with it. But I am not able to create the instances with Tags...

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "NonResourceBasedReadOnlyPermissions",
            "Action": [
                "ec2:Describe*",
                "ec2:CreateKeyPair",
                "ec2:CreateSecurityGroup",
                "iam:GetInstanceProfiles",
                "iam:ListInstanceProfiles"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Sid": "IAMPassRoleToInstance",
            "Action": [
                "iam:PassRole"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::818755641843:role/EC2LaunchVansDEV"
        },
        {
            "Sid": "AllowInstanceActions",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "ec2:AttachVolume",
                "ec2:DetachVolume",
                "ec2:CreateTags"
            ],
            "Resource": "arn:aws:ec2:us-west-2:818755641843:instance/*",
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::818755641843:instance-profile/EC2LaunchVansDEV"
                }
            }
        },
        {
            "Sid": "EC2RunInstances",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances",
                "ec2:CreateTags"
            ],
            "Resource": "arn:aws:ec2:us-west-2:818755641843:instance/*",
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceProfile": "arn:aws:iam::818755641843:instance-profile/EC2LaunchVansDEV"
                }
            }
        },
        {
            "Sid": "EC2RunInstancesSubnet",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances",
                "ec2:CreateTags"
            ],
            "Resource": "arn:aws:ec2:us-west-2:818755641843:subnet/*",
            "Condition": {
                "StringEquals": {
                    "ec2:vpc": "arn:aws:ec2:us-west-2:818755641843:vpc/vpc-5b0f3c3f"
                }
            }
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:us-west-2:818755641843:volume/*",
                "arn:aws:ec2:us-west-2::image/*",
                "arn:aws:ec2:us-west-2::snapshot/*",
                "arn:aws:ec2:us-west-2:818755641843:network-interface/*",
                "arn:aws:ec2:us-west-2:818755641843:key-pair/*",
                "arn:aws:ec2:us-west-2:818755641843:security-group/*"
            ]
        },
        {
            "Sid": "EC2VpcNonresourceSpecificActions",
            "Effect": "Allow",
            "Action": [
                "ec2:DeleteNetworkAcl",
                "ec2:DeleteNetworkAclEntry",
                "ec2:DeleteRoute",
                "ec2:DeleteRouteTable",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:CreateTags"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:vpc": "arn:aws:ec2:us-west-2:818755641843:vpc/vpc-5b0f3c3f"
                }
            }
        }
    ]
}
1

The DescribeInstances action cannot be limited by a ec2:Vpc condition. In fact it is part of a set of API actions that do not allow Resource level permissions, see a full list here:

http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html#ec2-api-unsupported-resource-permissions

I believe you're best bet is to separate into multiple accounts and have the separation occur there.

See also:

  • Not Worked. When I open EC2 console... I am getting this error.... "An error occurred fetching instance data: You are not authorized to perform this operation." – Sreekanth Sagar Aug 29 '16 at 16:28
0

Right now it is impossible without additional tricks e.g. by tags because these actions do not support VPC in conditions:

RebootInstances
StartInstances
StopInstances
TerminateInstances

But all of them support region in conditions, so you may want to move dev environment to specific region.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.