AWS Custom Console view

Question

We are running our internal company infrastructure on AWS. Currently, I (as an infrastructure admin) am the only one who has access to the AWS console (as a root console user).

Now a requirement has come to allow certain users (from Finance department) to be able to start one particular EC2 instance by themselves. I have the permissions stuff already set up (custom IAM role with permissions only for that instance).

The question is if there is a way to create customized views in AWS console. Similar to Atlassian Jira where you can define custom dashboards with custom configurable widgets.

Ideally this custom dashboard would just contain a single button "Turn on" that would be connected to a AWS Lambda function that would turn the specified instance on.

The user from finance department would then log in and see this simplified version of AWS Console without the need for them to crawl their way through the standard console (e.g. EC2 -> Instances -> find the correct one -> find the Start command)

Answer 1

I don't think that's possible. You've got a couple of other options though.

1) Give them a direct URL of the instance config

It will look something like this:

https://ap-southeast-2.console.aws.amazon.com/ec2/v2/home?region=ap-southeast-2#Instances:instanceId=i-01234567890;sort=availabilityZone

That will save them from having to click through the console to find the right screen and the right instance.

---

2) Auto start/stop the instance

If they need the instance running on a predictable, periodic schedule - e.g. during business hours, or every Monday, or every 1st of month - you can automatically start and stop it for them.

Here is a simple CloudFormation template that does just that: https://github.com/mludvig/ec2-start-stop

Modify to suit your needs. You will probably want to point it to an existing Instance instead of creating a new one; however the scheduler and the Lambda should be reusable.

---

3) Create a simple start/stop app

If you want to give them a single start/stop button on a screen you will have to write an app for it. It can be a trivial PHP script running on a t2.nano where this instance will have the appropriate IAM Role with permissions to start / stop the target EC2 instance.

Or if you want to go completely serverless write your app in jQuery, React, Angular or something like that, store it on S3 and make it talk to a Lambda backend that will be starting and stopping the finance dept instance. Again the Lambda will have the appropriate IAM Role with permissions to start / stop the target EC2 instance.

In both these cases you will want to handle user authentication somehow. It may be a simple, shared password right up to a full-on AD authentication through AWS Cognito or similar.

---

4) Create a start/stop script on their laptop

As Tim suggests install aws-cli on one of their laptops and create a simple start-instance and stop-instance script. However if they use Windows (as they probably do) they may freak out if you ask them to use a command line :)

---

5) Create a self-service menu system

On a t2.nano EC2 instance create a local user whose login-script will present 2 options:

Finance department server is currently: running

[1] Reboot
[2] Stop
[Q] Quit

Your choice [1/2/Q]: _

They can SSH to it e.g. from PuTTY (it can be all pre-configured) and simply choose what they want. I've had a similar system for our users who occasionally needed to restart a certain application but I didn't want to give them shell access.

---

Hope some of it works for you :)

BTW Every time they choose to Stop it you may also want to create a snapshot, just in case...

Answer 2

If you can't schedule the instance as suggested above, the simplest way is probably to set up the AWS CLI on their PC and have batch files to start and stop the instance. You can create shortcuts to the batch files on their desktop so they can double click to start or stop their instance.

Here's the rough steps to achieve this.

Create an IAM user

Create an IAM user with an access and secret key. You could give them console access if you like, but it's not required.

Ensure the IAM user has only the permissions required to start / stop that instance.

Install the AWS CLI on their PC

Steps to install the CLI (use the link as it will be more up to date than this answer):

1. Download the installer.

2. Install Python

3. Set up paths (see the link above for more details)

4. Configure the access credentials

Run the "aws configure" command then plug in your keys and region.

> aws configure

AWS Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key [None]: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
Default region name [None]: us-west-2
Default output format [None]: json

Create two batch files

Start the instance

aws ec2 start-instances --instance-ids i-1234567890abcdef0

Stop the instance

aws ec2 stop-instances --instance-ids i-1234567890abcdef0