I have a root account and I want to create 3 IAM users, one for each app: iamapp1, iamapp2 and iamapp3. I want them to have full access to ec2 resources, i.e listing, launching and configuring ec2 instances, in a way that the ec2 instances provided by iamapp1 are completely isolated from the instances provided by iamapp2 and iamapp3, but root account should still see everything. Does anybody knows if this is possible?
For your scenario I recommend creating separate AWS accounts for each user.
However, you can accomplish your objective using Tags and Policies in a single account.
- Create a Lambda function that will automatically tag EC2 resources created by each user with their identity. This will provide the magic key that your policies can use to control access.
- Create a Tag based resource policy for each user. This will prevent users from accessing resources that are not tagged with their user identity.
This link shows how to do everything. Includes some nice graphics showing how everything works.