Questions tagged [amazon-iam]

IAM is Amazon Web Services' Identity and Access Management service

Filter by
Sorted by
Tagged with
-3
votes
1answer
66 views

How to create a sandbox aws account for training purpose with limited access? [closed]

I want to create a aws sandbox account and provide to people where they can just explore around aws with limited resources like (ec2, s3 etc..) Including some functionalities with Iam . And after say ...
-1
votes
0answers
13 views

Basic AWS access policy

How do I set up two different user groups in AWS where one group has access to everything and the other group only access to the resources that they create themselves?
-1
votes
0answers
13 views

How to diagnose cross account RDS connection with vpc flow logs on AWS? [duplicate]

In AWS, made 2 accounts. account 1: A | Deployed EC2 account 2: B | Deployed RDS Want to connect from account 1's EC2 to account 2's RDS, but doesn't work. So enabled VPC flow logs to diagnose where ...
2
votes
0answers
34 views

Facilitating arbitrary code execution on AWS Lambda

I am developing a SaaS where a user will be able to upload a custom JavaScript function that runs when an event happens. In order to preserve the integrity of the system, I am using AWS Lambda to run ...
0
votes
0answers
22 views

kube2iam and iam-role-session-ttl argument - how can kube2iam set session validity?

kube2iam has a --iam-role-session-ttl argument that defaults to 15 minutes. The description of this option is Length of session when assuming the roles (default 15m) I thought the STS credentials ...
1
vote
2answers
47 views

Permissions for choosing tags in Cloudwatch

When trying to create a Cloudwatch dashboard I get "You don't have permission to access tags and properties. Retry". What permissions does my IAM account have to have in order to be able to ...
0
votes
1answer
82 views

AWS-IAM - How to give a combining specific access to specific region with some resource tags

Hello I am trying to combine some rights access for a user using IAM policies: Full access to one region ONLY (i.e: ap-east-1) ReadOnlyAccess to another region (i.e: us-east-1) Write access only to (...
1
vote
0answers
24 views

Autoscaling - lifecylehook implementation

I'm trying to implement my first ASG with a lifecycle hook and I am having this issue: LifecycleHandlerFunction: Encountered unsupported property Role The following resource(s) failed to create: [...
0
votes
0answers
67 views

Tag-based AWS IAM Policy for power user without explicitly listing all actions

I'm trying to create an IAM Managed Policy on AWS for power users to allow almost all actions if the value of their Role's tags (client, project, environment-type) match the respected ResourceTag and ...
1
vote
0answers
545 views

Impossible to delete AWS backup vault, backup plans?

I swear, I've read all the docs I can find, and have tried everything including the AWS policy generator UI and manually editing policy JSON, but no matter what I try, when I try to delete any of ...
1
vote
1answer
24 views

How do I enforce a policy to block access to specific regions without updating all of my policies?

I want to block all user access to almost all aws regions. You cant "disable" a region that is enabled by default. Also I am aware of permissions that are account level and cant be ...
1
vote
1answer
70 views

ec2 permissions to manage only firewall access

I'd like to allow some developers to manage firewall rules, specifically rules in ec2 security groups, (or some of them ideally) so that they can, eg, update their changing IP addresses to access ...
1
vote
1answer
56 views

AWS: How do I restrict deployment to ECS clusters using IAM

I have multiple Fargate clusters in a single AWS account. I wish to ensure that a given service account (used by the build pipeline) can only update Services within a given Fargate clusters. The IAM ...
0
votes
0answers
18 views

IAM Policy allowing to set ONLY one option (MaxSize)

I would like to create an auto scaling service by using AWS Lambda. This Lambda function should be allowed to set ONLY MaxSize of selected Auto Scaling Group. response = client....
0
votes
1answer
18 views

AWS Resource deletion should require 2 user's approval

We have a business requirement wherein the deletion of resources in AWS account should require approval of 2 users - may be an admin and the manager. There doesn't seem to be a straightforward, out-of-...
2
votes
2answers
41 views

Create a role to read from AWS Secrets Manager

I use AWS Secrets Manager to store passwords which I need to read from services launched in my EC2 instances. In order to do that one solution that I thought about where creating a role which can ...
0
votes
1answer
69 views

AWS ec2 instance IAM user but root user not seeing

I have a client and he has given me IAM access to my email to his AWS account. and I have logged in successfully and then lunch an EC2 instance to his account as IAM user. But the client not seeing ...
0
votes
1answer
119 views

AWS IAM policy to allow user to edit one specific Security Group only

I'm trying to allow a user to modify inbound rules on one particular security group. Here's what I tried. I thought it would be straight forward, but this doesn't work. What other permissions do I ...
1
vote
0answers
247 views

How to restrict AWS SSM access by EC2 tag

https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awssystemsmanager.html#awssystemsmanager-policy-keys I cant find an answer that clears this up for me Im looking at this example: https://docs.aws....
1
vote
2answers
180 views

s3 bucket/IAM user policy “Deny takes priority above all other access”?

Two policies, got one "Deny", I should not be able to do any operations to bucket, but I can still list and view bucket objects. Why? Thanks S3 bucket policy { "Sid": "...
0
votes
0answers
16 views

IAM for restricting specific request values

I would like to make an IAM user which was access to the AWS Lightsail CreateInstances API, but only if they make a request where bundleId is nano_2_0. I am aware of condition keys in AWS, but ...
2
votes
1answer
463 views

AWS Cloud Provider Integration with Kubernetes - Nodes stuck with “uninitialized: true” taint after bootstrapping

Summary I am attempting to bootstrap a Kubernetes cluster on AWS using Kubeadm. Please before you suggest them, I am not interested in using EKS or another bootstrapping solution like Kops, Kubespray,...
1
vote
2answers
237 views

How can switch to an EC2 instance role locally as a user?

I apply ec2 instance roles to my servers but I want to switch to those roles myself locally first to test permissions Id tried switching to one but I get an error: aws sts assume-role --role-arn arn:...
1
vote
1answer
130 views

Can only log into AWS console with IAM user if password was auto-generated

Scenario: I create a new IAM user and choose "AWS Management Console access" for "Access type". For "Console password", I choose "Custom password" and set a password. I attach a policy to the user ...
0
votes
1answer
256 views

Billing access denied, tho Ive granted all access to an IAM user

I currently cant watch or edit Billing (through IAM User Access to Billing Information) because the AWS console says that I dont have permissions. I am the only user in the account, with a full IAM ...
1
vote
2answers
115 views

Restrict access of IAM user to delete Route53 hostedzone NS and SOA record sets

I have written IAM Policy to restrict IAM users to just use a single hosted zone for testing but how can I restrict IAM users to delete this hosted zone's NS record and SOA record sets. PFB my IAM ...
1
vote
0answers
39 views

Can an instance profile's condition reference EC2 instance's tags?

I'm trying to setup an instance profile for an EC2 instance that limits its access to a particular path within an S3 bucket, based on the Name tag of that EC2 instance. I've gotten a policy that's ...
2
votes
1answer
128 views

Non-null password_last_used for (supposedly passwordless) AWS root_account?

As I was auditing an org's AWS IAM, I did: aws iam generate-credential-report # a bit later, download the CSV aws iam get-credential-report During viewing the report, one thing struck me as highly ...
0
votes
1answer
41 views

AWS- adding organisation members in a specific OU

We have multiple OU's in our AWS organisation. We use AWS cli to create new AWS organisation members. For eg. aws organizations create-account --email test@example.com --account-name "testaccount" ...
1
vote
1answer
33 views

AWS- Limiting resource access for member of organisational accounts

We have certain AWS labs which we offer to our customers. Every time a user opens the lab, a new member account is created and added to the organisational account. This only happens the first time ...
0
votes
1answer
1k views

Access Denied using S3 upload function

I have a lambda function with the following policy { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListBucket" ], "...
0
votes
1answer
161 views

AWS Cross Account Role Allowing Assumed Role

I have other accounts running services (on EC2 etc). I have one account running a metrics UI site as part of an ECS cluster that assumes a role while operating (arn:aws:sts::1111111111:assumed-role/...
0
votes
1answer
112 views

Grant access to role in another AWS account to all objects in my bucket

So I want to grant a role that exists in account A the get-object permission on items in a bucket owned by account B. I read The AWS docs' example policies and created a bucket policy like this: { ...
1
vote
3answers
3k views

AWS IAM won't let my users change their passwords

My password policy is configured to allow users to change their passwords, but when I create a new user with the "must change password" option, the user gets told they need "iam:ChangePassword" ...
4
votes
1answer
235 views

AWS: How to figure out where an explicit deny is coming from?

So my manager have left the company a few months back, leaving me to manage things on my own, and now, I'm looking through cloud trail events, and found that in one of our accounts, I have an explicit ...
2
votes
0answers
88 views

AWS EC2 : IAM policy to allow inbound SecurityGroup with PORT Range

I want to allow the access to specific ec2 security group to one of the developer. For that I know that we can use something like this : { "Version": "2012-10-17", "Statement": [ { ...
1
vote
1answer
51 views

AWS - deny services deployment in public subnet

We are building some security boundaries for our internal teams and would like to limit their ability to deploy services in Public Subnets. I can build a boundary policy for EC2 not to be deployed in ...
0
votes
1answer
56 views

IAM policy for managing EKS pods for users

Does anyone know what resources need to be granted to a user in order to run kubectl commands on an EKS cluster? At the moment, we have a couple of users who are associated with AdministratorAccess (...
0
votes
1answer
228 views

What permissions are required to run AWS TransferUtility?

Using the AWS .NET SDK's TransferUtility, I can download files using an access key ID for myself, but when I set up a restricted user with read-only access, I get "The remote server returned an error: ...
1
vote
1answer
1k views

AWS system manager : Verify that the IAM instance profile attached to the instance includes the required permissions

I am trying to access an ec2 instance using AWS systems manager for that I've created a role attached to the following policies. AmazonEC2RoleforSSM AmazonSSMAutomationApproverAccess ...
3
votes
1answer
331 views

Securely storing AWS access credentials in an on-premise server

What is the best way to store AWS IAM access credentials in a physical/virtual server so services running in it can access it? This is a problem which was fixed long ago for EC2 instances through ...
1
vote
0answers
270 views

AWS organization accounts, full AWS access, and S3 permissions

I have an Organization that has three accounts in it, and I have attached a FullAWSAccess control policy to one of those accounts A. This policy grants * action to * resources. A logged in to the AWS ...
0
votes
1answer
6k views

What permissions do I need to access a SQS queue?

I am trying to open a SQS queue but I got this error: 2019-07-09 07:20:31,855 pid 3604 tid 800 ERROR connection <?xml version="1.0 "?><ErrorResponse xmlns="http://queue.amazonaws.com/doc/...
0
votes
0answers
253 views

AWS AssumeRole keeps returning access denied

I created a new policy { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:...
0
votes
2answers
4k views

How can I 'aws s3 sync' two buckets, which are located in different accounts

I'm trying to use 'aws s3 sync' on the awscli between two accounts. Account A, I own. Account B, Owned by a third party. Account B has given a user:jon on account A permission to a bucket through a ...
2
votes
1answer
81 views

AWS IAM policy JSON with time limit and time zone

I want to add IAM policy with time limit. But in the time limit it didn't have way to specify the time zone. How can define the time zone or what is the time zone considered here? { "Effect":...
1
vote
1answer
72 views

Switch Role on Windows10 Fails with AWS Source IP

When a user on Windows 10 tries to switch roles in AWS it fails with Failed authentication We have a Condition in our sts:AssumeRole policy to only allow the role to switch if the user is ...
2
votes
3answers
259 views

AWS - Bastion checking IAM permissions?

Is it possible to set up a bastion host in AWS that would be checking IAM to check if given user can connect to specific EC2 instance? It might be a bit blurry but the idea is following. Let's ...
0
votes
1answer
15 views

On AWS, how to filter which services are using a role?

On AWS, I want to review all permissions grant or revoked to our services and redefine them when necessary. Considering a specific role set on AWS IAM. How can I filter which services, instances or ...
0
votes
1answer
89 views

How to limit the permissions AWS IAM RoleA can grant to a role (Role B) it creates

In order to allow my developers to use the Serverless Framework to deploy new AWS Lambda functions, they have to be able to create roles. I'd like to give them permissions to create roles that can ...

1
2 3 4 5