0

What is the minimal IAM policy to grant CreateSnapshot via UI? The action set must be explicit because "PEP 20" and potential exposure of confidential configuration.

Some background: A month ago I created this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": "ec2:CreateSnapshot",
        "Resource": [
            "arn:aws:ec2:eu-central-1::volume/vol-xxxxx",
            "arn:aws:ec2:eu-central-1::snapshot/*"
        ]
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeAvailabilityZones",
            "ec2:DescribeSnapshotAttribute",
            "ec2:DescribeVolumes",
            "ec2:DescribeSnapshots"
        ],
        "Resource": "*"
    }
  ]
}

which was working as expected after a few iterations. Today it failed for the associated user and CloudTrail reports Client.UnauthorizedOperation without further details. Since policies may take their time to load this policy may have not been in effect when we successfully created the first snapshot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.