2

I am trying to create an IAM user for the AWS Console with permission to list and perform action on only 1 instance.

So I have a total of 6 Instances and I tried hiding 5 of them via IAM Policies by adding the below policy:

Breakdown
1. First took all the permissions away
2. Added permission to only one instance

    {
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "condition": {}
            }
        },
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef",
            "Condition": {
                "condition": {}
            }
        }
    ]
}

This works for the 1st part only ie Denying to all Instances.
The 2nd part doesn't seem to work.

AWS Console with no permission to any instance data

Don't the permissions work like that? Any help would be appreciated.

3

Your current policy would work in the AWS-CLI, e.g. aws ec2 stop-instance should work.

However to actually use the web console you need a few more read-only permissions because the console tries to list and describe all the instances to build the list.

You may need at least ec2:DescribeInstances to get a basic half-broken list.

If you only care about preventing that IAM user from modifying other instances you can give him a read-only access with ec2:Describe* - that should make the console usable while preventing him from modifying any non-permitted instances.

I'm not aware of a way to restrict the listing of instances only to the one he can work with, he will probably see them all but can only manage that single one.

Hope that helps :)

0

You have to deny all, but in your condition, use ArnNotEquals "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef"

This will basically deny all other instance that does not have the same ARN as the instance that you want to be allowed.

See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN for more information

0

Thank you MLu and Sharuzzaman Ahmat Raslan!

Your inputs really helped me to get this done. I am adding the summary of what I did below for others in case:

  1. First, need to make sure the right policy is attached to the user group or in my case, the right policy is detached. The user had no EC2 access.
  2. Next, I used the Inline Policy to add access. I added the below policy which, as mentioned by MLu would allow not stop listing the instances but will not allow updating of the other instances

    {
    "Version": "2012-10-17", 
    "Statement": [ 
            {
                "Effect": "Allow",
                "Action": "ec2:Describe*",
                "Resource": "*"
            },
            {
                "Effect": "Allow",
                "Action": "*)",
                "Resource": "arn:aws:ec2:us-east-1:1234567890123:instance/i-xxxxxxxxxxxxxxxxx"
            }
       ]
    }
    

Hope this helps someone stuck to save some time.

  • Where normally 4 leading spaces pre-format text/code in an itemized list you instead need to use 8 spaces – HBruijn Apr 15 at 9:06
  • @HBruijn Thanks a lot! – ServerInsights Apr 15 at 12:52
0

Regarding hiding all instances but one from the user

This cannot be done using IAM policies. The ec2:Describe* commands (including ec2:DescribeInstances) do not support resource-level permissions. So you can only allow or deny ec2:Describe* for everything (*). So your user can see all instances, or none.

Regarding trying to deny all, then override an allow

The order of the policy statements does not change the result of the policy. So don't try to write or interpret it "top down".

Policies work like this:

  1. The policy starts implicitly denying everything (this is implied deny)
  2. Any "Allow" statements override any implied denies (this is an explicit allow)
  3. Any "Deny" statements override all allows (this is an explicit deny)

So once you have a "Deny" statement, nothing can override that.

To be able to "pigeon hole" an allow, like you're trying to do, you must do one of these:

  • Don't deny anything, allow only what you want to allow, or
  • Deny everything except what you want to allow (in a single statement)

To accomplish what you want

The closest you'll get is to allow your user to "see" everything, but operate only on the one EC2 instance. You'll need 2 statements:

{
    "Version": "2012-10-17", 
    "Statement": [ 
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "arn:aws:ec2:us-east-1:1234567890123:instance/i-12345678"
        }
    ]
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.