Questions tagged [amazon-iam]

IAM is Amazon Web Services' Identity and Access Management service

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

AWS Automatic IAM Roles for Service Users

I have an EC2 instance that has an assigned/assumed role. When I run: aws sts get-caller-identity as the main login user or with sudo it returns the account information expected. However, I have a ...
thaimin's user avatar
  • 123
0 votes
1 answer
24 views

How to get friend/business partner to view and edit Lex bots with me in AWS?

Long story short, I want my friend who's also my partner in my startup to help me with developing, testing, and deploying AI chatbots in Amazon Lex via AWS. I have him registered as a user in Identity ...
user avatar
0 votes
0 answers
33 views

IAM Roles AnyWhere

I've been using the IAM roles anywhere. To Authenticate from your environment Your non AWS workloads authenticate via a certificate trusted by your trust anchor and obtain temporary credentials from a ...
Sijin's user avatar
  • 1
0 votes
1 answer
39 views

Local terraform repository, remote ec2 with assumed role

My current setup is: My local machine (actually one for each developper) A git repository containing my terraform configuration An EC2 instance which assumes an IAM role which grants it permissions ...
Camusensei's user avatar
1 vote
0 answers
33 views

AWS API Gateway + Cognito + IAM

I'm working on an API for my company. I'm trying to restrict external users from accessing specific methods of a specific endpoint using IAM + Cognito. Currently I have a single Cognito user pool, ...
Devin Gardner's user avatar
0 votes
0 answers
65 views

DynamoDB Auto-Scaling, Application Auto-Scaling

I'm trying to setup a set of boto3 python AWS scripts which can create new users and dynamoDB tables, so that the web app I'm working on can add new users with properly scoped permissions. I'm having ...
Devin Ceartas's user avatar
0 votes
1 answer
725 views

Cross Account SSM session: AccessDeniedException

I have two AWS accounts and one role in each account: Account-A have RoleA and Account-B have RoleB. RoleA will assume the RoleB to be able to connect in an EC2 instance in Account-B through ssm start-...
Arrow Root's user avatar
0 votes
0 answers
173 views

Restrict connection to RDS database based on IAM Role and RDS tag

G'day! I have IAM Authentication turned on for my RDS databases. I can successfully connect using an authorised role and am denied when using an unauthorised role. However, I have a role that I would ...
Line Noise's user avatar
0 votes
2 answers
194 views

How can I set up AWS Client VPN using IAM roles for authentication?

Context: I am trying to set up Postgres RDS in a private_isolated subnet of a VPC. I want to use pgAdmin to do work on it, which means I either need a bastion or a VPN connection. A bastion requires a ...
Adam A's user avatar
  • 151
1 vote
1 answer
516 views

AWS IAM: deny users from creating policies on specific resources

I want to be able to give my admin users the permission to create policies in IAM, but I want to make sure that they aren't able to create a policy that affects a specific resource. To be more ...
Jamie Forrest's user avatar
0 votes
1 answer
159 views

How to fix permission error of Ebs volume using Amazon Data lifecycle manager?

I applied the terraform code in this link, which contains code to apply the specific roles and permission s to service dlm lifecycle for ebs volumes. But still I am getting access errors. Please ...
Meghana d's user avatar
0 votes
0 answers
57 views

Switch to a different AWS accounts in the UI

I currently have AWS configuration set up with my access key id and secret access key (i.e. I see this when going to 'aws configure' in the CLI). I then login through my company's OKTA to then access ...
KristiLuna's user avatar
0 votes
0 answers
88 views

Mimic user permissions on AWS EC2 instances using IAM roles

I'm setting up an AWS account with several users. Each of these users has policies attached that restrict their access to specific S3 buckets/objects and the EC2 instance types / Autoscaling Groups ...
Marcelo Villa's user avatar
0 votes
1 answer
670 views

Is it impossible to access rds and elasticache redis in AWS fargate only by setting a role?

I tried to access the aws service rds and elasticache redis through fargate's task role. I connected the full access of the service to the task role, but it was not connected, so I allowed the subnet ...
john_smith's user avatar
0 votes
1 answer
76 views

Limit what kind of policies and roles an admin role can create in AWS

Is there a way in AWS to limit what kind of roles and policies another role can create? In my setup, I have two kinds of admin roles: AccountAdmin and InfraAdmin. The AccountAdmin one having more ...
mikoni's user avatar
  • 103
0 votes
0 answers
34 views

How to assign an IAM role having the same permission set as the IPs have?

How to update the IAM policy below so that the IAM role, arn:aws:iam::7574333677569:role/dev-abc-webserver, also have permissions? { "Version": "2012-10-17", "Id":...
sam23's user avatar
  • 59
2 votes
1 answer
2k views

How do i fix terraform invalid JSON policy

I am trying to use a file which contains load balancer iam policy for my AWS in terraform. However when i run the terraform script, i get an error stating: Error: "policy" contains an ...
eagercoder's user avatar
1 vote
1 answer
1k views

EC2 instance won't recognize IAM role?

I'm trying to download ECR images on my EC2 instance without having to provide a credentials file. So I created a role with the policy AmazonEC2ContainerRegistryReadOnly and attached to my running ...
rodorgas's user avatar
1 vote
1 answer
1k views

RDS PostgreSQL Import+Export to/from S3

Is it possible to enable both importing and exporting with an RDS PostgreSQL instance to an S3 bucket? I've been able to use the following pattern to enable one or the other with consistent success: ...
Jerbot's user avatar
  • 394
1 vote
1 answer
502 views

How can I call "complete-lifecycle-action"?

There is an AWS EC2 instance which is launched by an auto-scaling-group. I wish to put this instance to Pending state during initialization. This is very easy with the lifecycle hooks: This hook will ...
Daniel's user avatar
  • 191
0 votes
1 answer
412 views

A user is blocked from using MFA though I added the permissions for their AWS IAM account

I hold admin powers on one of the AWS accounts that we use at the company where I work. I am trying to make MFA mandatory for all users. I followed this tutorial: https://docs.aws.amazon.com/IAM/...
charlottesville's user avatar
0 votes
1 answer
142 views

Automatic EC2 Role Assignment

Trying to understand AWS IAM resources/concepts a little better. I know there is a way to configure an EC2 (either possibly via its underlying AMI or a launch template) so that when it launches for ...
hotmeatballsoup's user avatar
1 vote
1 answer
2k views

Pod assigned node role instead of service account role on AWS EKS

First some info about the setup: EKS version: 1.21 eksctl version: 0.77.0 AWS Go SDK verion: v1.44.28 Deploying using kubectl I have a k8s cluster on AWS EKS on which I am deploying a custom k8s ...
asr9's user avatar
  • 131
1 vote
2 answers
670 views

Sharing an AWS "instance role" across accounts, as with other resources?

What works We have several EC2 instances that pull things out of an S3 bucket on boot (and at other times). To allow this, we have an IAM policy granting read-only access... "Effect": "...
Ti Strga's user avatar
  • 111
1 vote
1 answer
1k views

S3 access control based on bucket tags

i hope you can help me out. I have read a couple of docs now, and I am still unsure whether this actually works. I want to give access in different levels to AWS users based on S3 tags. Example: S3 ...
flypenguin's user avatar
1 vote
1 answer
826 views

Quicksight Error: This user name already exists in this account

When I want to login to view my Quicksight dashboard I get this error: This user name already exists in this account. Contact your QuickSight administrator, and ask them to invite you with a unique ...
Fariman Kashani's user avatar
0 votes
1 answer
207 views

Best practice for AWS root account or superuser?

Normally, we have the rule of 3 people having superuser access with 3 username/passwords and if anyone is ever offboarded(they leave or are fired), on vacation, out sick, different time-zone, someone ...
Dean Hiller's user avatar
6 votes
3 answers
8k views

Getting "Fargate requires task definition to have execution role ARN to support ECR images." when creating Fargate task but the role is defined

I am trying to deploy a very simple web application to AWS Fargate. I have pushed a docker image of the backend of the application to ECR and I am trying to setup a Fargate task definition for the ...
Brandon's user avatar
  • 181
0 votes
1 answer
919 views

AWS Policy to Read/write RDS

In my scenario , I want a policy that will allow reading and writing of abc-database-backups/rds/postgresql-backup on S3? We'll want the my servers to have that access added. Is creating a role and ...
samtech's user avatar
1 vote
1 answer
477 views

Safely store AWS IAM User Keys (Access and Secret) created by IaC

I've the following setup: Infrastructure is setup using AWS CDK; I've one Stack/Environment (Production, Staging...); Each Stack has a different S3 Bucket (used for website hosting); I've a Stack ...
viniciuskneves's user avatar
1 vote
1 answer
207 views

How do you set a self-destruct or maximum uptime in AWS?

Situation We have a sandbox AWS account for trying things out. It is not for production, purely just for playing around with all the toys that AWS provide. We want to encourage everyone to explore and ...
James Geddes's user avatar
0 votes
1 answer
83 views

AWS CLI Usage Issue

In our scenario, We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is ...
samtech 2021's user avatar
0 votes
0 answers
112 views

Individual Local Accounts on AWS

I'm my scenario, Currently, we have all developers connect to ec2 instances using the ec2-user account. Is there a better way to do this so we can see which actions developers take on the machines? I'...
samtech 2021's user avatar
0 votes
1 answer
164 views

S3 Logs event Issue

Is there a way to see what actions the 'g2' IAM user is performing in S3, and which IP(s) they are running from? I have already enabled the logging of S3 actions. One point I’m still not able to ...
samtech 2021's user avatar
0 votes
0 answers
21 views

AWS IAM user with special permissions

I am having following task to do. I want to create 10 IAM users each user should have login username and password and each IAM user should have separate ec2 instance that can not be visible to others. ...
anil's user avatar
  • 15
0 votes
2 answers
259 views

Best Practice for AWS IAM access keys for use with AWS SDK

I want to know the best practice used by big company's for programmatic access for multiple AWS services as there are multiple programs needing access to different-2 services so how it is managed? Did ...
Rocky's user avatar
  • 49
3 votes
1 answer
9k views

Is it possible to grant a "read everything" role in AWS?

Is there a default policy that can provide read-only access to all services with AWS? Is there are naming convention for permissions that could be followed such as "Allow" : "Get*" ...
Andrew Theken's user avatar
0 votes
1 answer
307 views

How to use aws-iam-authenticator with remote Terraform Cloud Runs?

I am already successfully using Terraform with the Kubernetes provider to manage various part of and services on an EKS cluster in AWS. I would like to use Terraform Cloud to manage it (and take ...
Adam C's user avatar
  • 5,242
0 votes
0 answers
400 views

Increasing general AWS console timeout

The AWS console appears to kick you out after 24-hours, and I'd like to increase it slightly. This has nothing to do with SSO. Is this a fundamental requirement or can it be tweaked somewhere?
Dustin Oprea's user avatar
1 vote
1 answer
954 views

What is the new policy action needed to allow the new DescribeSecurityGroupRules

We have IAM policies in place that used to permit the roles to edit a security group rules { "Version": "2012-10-17", "Statement": [ { "...
gsempe's user avatar
  • 113
1 vote
0 answers
3k views

Converting specific folder of S3 into browsable directory list without making it public

I have a bucket that I'd like to access using a browser similar to http://data.openspending.org/ and I'd like only a subfolder to be visible. So if Bucket1 has multiple folders, I only wanna show and ...
Kohini's user avatar
  • 113
3 votes
0 answers
923 views

EKS - Use IAM roles for service accounts on multiple clusters

I am trying to use IAM roles for service accounts in EKS. https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html When it comes to create the IAM role to be assigned to a ...
signaleleven's user avatar
3 votes
1 answer
8k views

AWS IAM Roles: What is a trusted entity exactly?

I have a role attached to a LaunchConfiguration for an EC2 instance, that gives the EC2 instance privs to do certain things like do Cloudwatch logs (the context isn't important to the question). In ...
spinkus's user avatar
  • 207
0 votes
0 answers
503 views

Can i access an EKS cluster , if i don't have access to iam user that created it?

An AWS admin , created an IAM user , and that user created an EKS cluster. Now , we don't have access to that IAM user. If , we try to execute , kubectl , commands on that EKS cluster from a new IAM ...
Dawood Abbas 's user avatar
1 vote
1 answer
1k views

AWS S3 Policy: One non-public bucket, separate sub-folders for each user, restricted access

at the moment I'm struggling how to create a secure policy for my Amazon S3 bucket. My plan is to have one bucket with several sub-folders for separate (IAM) users. Access should only be ...
keitaro.urashima's user avatar
2 votes
0 answers
285 views

Facilitating arbitrary code execution on AWS Lambda

I am developing a SaaS where a user will be able to upload a custom JavaScript function that runs when an event happens. In order to preserve the integrity of the system, I am using AWS Lambda to run ...
Nexuist's user avatar
  • 121
2 votes
2 answers
1k views

Permissions for choosing tags in Cloudwatch

When trying to create a Cloudwatch dashboard I get "You don't have permission to access tags and properties. Retry". What permissions does my IAM account have to have in order to be able to ...
jshbrntt's user avatar
  • 121
0 votes
1 answer
489 views

AWS-IAM - How to give a combining specific access to specific region with some resource tags

Hello I am trying to combine some rights access for a user using IAM policies: Full access to one region ONLY (i.e: ap-east-1) ReadOnlyAccess to another region (i.e: us-east-1) Write access only to (...
serialp's user avatar
  • 13
1 vote
0 answers
74 views

Autoscaling - lifecylehook implementation

I'm trying to implement my first ASG with a lifecycle hook and I am having this issue: LifecycleHandlerFunction: Encountered unsupported property Role The following resource(s) failed to create: [...
serialp's user avatar
  • 13
7 votes
3 answers
5k views

Impossible to delete AWS backup vault, backup plans?

I swear, I've read all the docs I can find, and have tried everything including the AWS policy generator UI and manually editing policy JSON, but no matter what I try, when I try to delete any of ...
Tom Wilson's user avatar

1
2 3 4 5 6