I have a root account and I want to create 3 IAM users, one for each app: iamapp1, iamapp2 and iamapp3. I want them to have full access to ec2 resources, i.e listing, launching and configuring ec2 instances​, in a way that the ec2 instances provided by iamapp1 are completely isolated from the instances provided by iamapp2 and iamapp3, but root account should still see everything. Does anybody knows if this is possible?


For your scenario I recommend creating separate AWS accounts for each user.

However, you can accomplish your objective using Tags and Policies in a single account.

  1. Create a Lambda function that will automatically tag EC2 resources created by each user with their identity. This will provide the magic key that your policies can use to control access.
  2. Create a Tag based resource policy for each user. This will prevent users from accessing resources that are not tagged with their user identity.

This link shows how to do everything. Includes some nice graphics showing how everything works.

Automatically Tag EC2 Resource

  • I tried creating multiple AWS accounts using AWS Organizations, but it didn't work (it looks like they released this service while it's still buggy). I will take a look at the link you attached, thank you very much. – Simon Ernesto Cardenas Zarate Nov 24 '17 at 1:13
  • AWS Organizations works usually fine. I reommend contacting AWS Support – M. Glatki Nov 24 '17 at 11:52
  • I have used AWS Organizations many times. For most of my customers this is standard practice. I have not seen any problems either setting up Organizations, adding accounts to, etc. As @M. Glatki mentioned, contact AWS support if you still have issues as no software is perfect. – John Hanley Nov 24 '17 at 17:44
  • I requested a ticket to AWS support. They fixed AWS organizations for me, and it worked like a charm. Thank you guys! – Simon Ernesto Cardenas Zarate Dec 2 '17 at 23:16
  • Can you share what the problem was and the solution? – John Hanley Dec 2 '17 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.