Questions tagged [amazon-iam]

IAM is Amazon Web Services' Identity and Access Management service

Filter by
Sorted by
Tagged with
0 votes
1 answer
23 views

Best practice for AWS root account or superuser?

Normally, we have the rule of 3 people having superuser access with 3 username/passwords and if anyone is ever offboarded(they leave or are fired), on vacation, out sick, different time-zone, someone ...
user avatar
0 votes
0 answers
12 views

AWS EKS - EIA attached on node not reachable by Pod

I'm using a standard AWS EKS cluster, all cloud based (K8S 1.21) with multiple node groups, one of which uses a Launch Template that defines an Elastic Inference Accelerator attached to the instances (...
user avatar
1 vote
0 answers
85 views

Getting "Fargate requires task definition to have execution role ARN to support ECR images." when creating Fargate task but the role is defined

I am trying to deploy a very simple web application to AWS Fargate. I have pushed a docker image of the backend of the application to ECR and I am trying to setup a Fargate task definition for the ...
user avatar
  • 131
0 votes
1 answer
31 views

AWS Policy to Read/write RDS

In my scenario , I want a policy that will allow reading and writing of abc-database-backups/rds/postgresql-backup on S3? We'll want the my servers to have that access added. Is creating a role and ...
user avatar
  • 11
0 votes
0 answers
11 views

AWS CLI restrict restart of only one instance at a time

We have hub and spoke model in our AWS environment. We are allowed to perform AWS CLI commands from our HUB instances on all other instances. This includes Stop/Start, so we would like to restrict ...
user avatar
0 votes
0 answers
20 views

AWS/IAM: Implementing 2-person rule with IAM permissions

I would like to implement a 2-person rule with IAM permissions in AWS. Essentially, for certain privileged operations exposed by AWS services, I would like to require the approval of a second ...
user avatar
1 vote
1 answer
56 views

Safely store AWS IAM User Keys (Access and Secret) created by IaC

I've the following setup: Infrastructure is setup using AWS CDK; I've one Stack/Environment (Production, Staging...); Each Stack has a different S3 Bucket (used for website hosting); I've a Stack ...
user avatar
1 vote
1 answer
43 views

How do you set a self-destruct or maximum uptime in AWS?

Situation We have a sandbox AWS account for trying things out. It is not for production, purely just for playing around with all the toys that AWS provide. We want to encourage everyone to explore and ...
user avatar
0 votes
1 answer
62 views

AWS CLI Usage Issue

In our scenario, We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is ...
user avatar
0 votes
0 answers
44 views

Individual Local Accounts on AWS

I'm my scenario, Currently, we have all developers connect to ec2 instances using the ec2-user account. Is there a better way to do this so we can see which actions developers take on the machines? I'...
user avatar
0 votes
1 answer
96 views

S3 Logs event Issue

Is there a way to see what actions the 'g2' IAM user is performing in S3, and which IP(s) they are running from? I have already enabled the logging of S3 actions. One point I’m still not able to ...
user avatar
0 votes
0 answers
60 views

IAM Profile allows create VPC IPV6 Subnet in some regions. Why does it fail in other regions?

In a test environment to mockup a larger issue, I have an IAM user with a directly attached IAM profile. I have also tried with the profile attached to an IAM Role which the IAM user has assumed. The ...
user avatar
0 votes
0 answers
16 views

AWS IAM user with special permissions

I am having following task to do. I want to create 10 IAM users each user should have login username and password and each IAM user should have separate ec2 instance that can not be visible to others. ...
user avatar
  • 15
0 votes
0 answers
51 views

Accessing HTTP API using IAM policy

I am using an HTTP API Gateway with {proxy+} route, $default stage and ANY method with IAM Authorization. Before activating IAM Authorization the API responds to every request and to none after ...
user avatar
0 votes
2 answers
99 views

Best Practice for AWS IAM access keys for use with AWS SDK

I want to know the best practice used by big company's for programmatic access for multiple AWS services as there are multiple programs needing access to different-2 services so how it is managed? Did ...
user avatar
  • 49
0 votes
1 answer
1k views

Is it possible to grant a "read everything" role in AWS?

Is there a default policy that can provide read-only access to all services with AWS? Is there are naming convention for permissions that could be followed such as "Allow" : "Get*" ...
user avatar
0 votes
1 answer
160 views

How to use aws-iam-authenticator with remote Terraform Cloud Runs?

I am already successfully using Terraform with the Kubernetes provider to manage various part of and services on an EKS cluster in AWS. I would like to use Terraform Cloud to manage it (and take ...
user avatar
  • 5,122
0 votes
0 answers
45 views

Setting AWS ECS permissions to restrict docker-pull to certain tags

I have desperately looked for documentation, examples, and posts that hint at a way to restrict certain policies to certain Docker image tags, but haven't been able to find a single example or even a ...
user avatar
0 votes
0 answers
85 views

Increasing general AWS console timeout

The AWS console appears to kick you out after 24-hours, and I'd like to increase it slightly. This has nothing to do with SSO. Is this a fundamental requirement or can it be tweaked somewhere?
user avatar
1 vote
1 answer
502 views

What is the new policy action needed to allow the new DescribeSecurityGroupRules

We have IAM policies in place that used to permit the roles to edit a security group rules { "Version": "2012-10-17", "Statement": [ { "...
user avatar
  • 113
1 vote
0 answers
1k views

Converting specific folder of S3 into browsable directory list without making it public

I have a bucket that I'd like to access using a browser similar to http://data.openspending.org/ and I'd like only a subfolder to be visible. So if Bucket1 has multiple folders, I only wanna show and ...
user avatar
  • 13
1 vote
0 answers
253 views

EKS - Use IAM roles for service accounts on multiple clusters

I am trying to use IAM roles for service accounts in EKS. https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html When it comes to create the IAM role to be assigned to a ...
user avatar
1 vote
1 answer
2k views

AWS IAM Roles: What is a trusted entity exactly?

I have a role attached to a LaunchConfiguration for an EC2 instance, that gives the EC2 instance privs to do certain things like do Cloudwatch logs (the context isn't important to the question). In ...
user avatar
  • 158
0 votes
0 answers
192 views

Can i access an EKS cluster , if i don't have access to iam user that created it?

An AWS admin , created an IAM user , and that user created an EKS cluster. Now , we don't have access to that IAM user. If , we try to execute , kubectl , commands on that EKS cluster from a new IAM ...
user avatar
1 vote
1 answer
417 views

AWS S3 Policy: One non-public bucket, separate sub-folders for each user, restricted access

at the moment I'm struggling how to create a secure policy for my Amazon S3 bucket. My plan is to have one bucket with several sub-folders for separate (IAM) users. Access should only be ...
user avatar
2 votes
0 answers
136 views

Facilitating arbitrary code execution on AWS Lambda

I am developing a SaaS where a user will be able to upload a custom JavaScript function that runs when an event happens. In order to preserve the integrity of the system, I am using AWS Lambda to run ...
user avatar
  • 121
2 votes
2 answers
368 views

Permissions for choosing tags in Cloudwatch

When trying to create a Cloudwatch dashboard I get "You don't have permission to access tags and properties. Retry". What permissions does my IAM account have to have in order to be able to ...
user avatar
0 votes
1 answer
303 views

AWS-IAM - How to give a combining specific access to specific region with some resource tags

Hello I am trying to combine some rights access for a user using IAM policies: Full access to one region ONLY (i.e: ap-east-1) ReadOnlyAccess to another region (i.e: us-east-1) Write access only to (...
user avatar
  • 13
1 vote
0 answers
33 views

Autoscaling - lifecylehook implementation

I'm trying to implement my first ASG with a lifecycle hook and I am having this issue: LifecycleHandlerFunction: Encountered unsupported property Role The following resource(s) failed to create: [...
user avatar
  • 13
2 votes
0 answers
2k views

Impossible to delete AWS backup vault, backup plans?

I swear, I've read all the docs I can find, and have tried everything including the AWS policy generator UI and manually editing policy JSON, but no matter what I try, when I try to delete any of ...
user avatar
1 vote
1 answer
279 views

How do I enforce a policy to block access to specific regions without updating all of my policies?

I want to block all user access to almost all aws regions. You cant "disable" a region that is enabled by default. Also I am aware of permissions that are account level and cant be ...
user avatar
  • 3,969
1 vote
1 answer
72 views

ec2 permissions to manage only firewall access

I'd like to allow some developers to manage firewall rules, specifically rules in ec2 security groups, (or some of them ideally) so that they can, eg, update their changing IP addresses to access ...
user avatar
  • 11
1 vote
1 answer
699 views

AWS: How do I restrict deployment to ECS clusters using IAM

I have multiple Fargate clusters in a single AWS account. I wish to ensure that a given service account (used by the build pipeline) can only update Services within a given Fargate clusters. The IAM ...
user avatar
0 votes
1 answer
44 views

AWS Resource deletion should require 2 user's approval

We have a business requirement wherein the deletion of resources in AWS account should require approval of 2 users - may be an admin and the manager. There doesn't seem to be a straightforward, out-of-...
user avatar
  • 111
2 votes
2 answers
119 views

Create a role to read from AWS Secrets Manager

I use AWS Secrets Manager to store passwords which I need to read from services launched in my EC2 instances. In order to do that one solution that I thought about where creating a role which can ...
user avatar
  • 23
0 votes
1 answer
170 views

AWS ec2 instance IAM user but root user not seeing

I have a client and he has given me IAM access to my email to his AWS account. and I have logged in successfully and then lunch an EC2 instance to his account as IAM user. But the client not seeing ...
user avatar
0 votes
1 answer
646 views

AWS IAM policy to allow user to edit one specific Security Group only

I'm trying to allow a user to modify inbound rules on one particular security group. Here's what I tried. I thought it would be straight forward, but this doesn't work. What other permissions do I ...
user avatar
  • 117
1 vote
1 answer
801 views

How to restrict AWS SSM access by EC2 tag

https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awssystemsmanager.html#awssystemsmanager-policy-keys I cant find an answer that clears this up for me Im looking at this example: https://docs.aws....
user avatar
  • 3,969
1 vote
2 answers
538 views

s3 bucket/IAM user policy "Deny takes priority above all other access"?

Two policies, got one "Deny", I should not be able to do any operations to bucket, but I can still list and view bucket objects. Why? Thanks S3 bucket policy { "Sid": "...
user avatar
  • 11
0 votes
0 answers
18 views

IAM for restricting specific request values

I would like to make an IAM user which was access to the AWS Lightsail CreateInstances API, but only if they make a request where bundleId is nano_2_0. I am aware of condition keys in AWS, but ...
user avatar
2 votes
1 answer
804 views

AWS Cloud Provider Integration with Kubernetes - Nodes stuck with "uninitialized: true" taint after bootstrapping

Summary I am attempting to bootstrap a Kubernetes cluster on AWS using Kubeadm. Please before you suggest them, I am not interested in using EKS or another bootstrapping solution like Kops, Kubespray,...
user avatar
2 votes
2 answers
460 views

How can switch to an EC2 instance role locally as a user?

I apply ec2 instance roles to my servers but I want to switch to those roles myself locally first to test permissions Id tried switching to one but I get an error: aws sts assume-role --role-arn arn:...
user avatar
  • 3,969
1 vote
1 answer
304 views

Can only log into AWS console with IAM user if password was auto-generated

Scenario: I create a new IAM user and choose "AWS Management Console access" for "Access type". For "Console password", I choose "Custom password" and set a password. I attach a policy to the user ...
user avatar
0 votes
1 answer
620 views

Billing access denied, tho Ive granted all access to an IAM user

I currently cant watch or edit Billing (through IAM User Access to Billing Information) because the AWS console says that I dont have permissions. I am the only user in the account, with a full IAM ...
user avatar
  • 101
1 vote
2 answers
365 views

Restrict access of IAM user to delete Route53 hostedzone NS and SOA record sets

I have written IAM Policy to restrict IAM users to just use a single hosted zone for testing but how can I restrict IAM users to delete this hosted zone's NS record and SOA record sets. PFB my IAM ...
user avatar
  • 13
1 vote
0 answers
127 views

Can an instance profile's condition reference EC2 instance's tags?

I'm trying to setup an instance profile for an EC2 instance that limits its access to a particular path within an S3 bucket, based on the Name tag of that EC2 instance. I've gotten a policy that's ...
user avatar
  • 265
2 votes
1 answer
178 views

Non-null password_last_used for (supposedly passwordless) AWS root_account?

As I was auditing an org's AWS IAM, I did: aws iam generate-credential-report # a bit later, download the CSV aws iam get-credential-report During viewing the report, one thing struck me as highly ...
user avatar
  • 386
0 votes
1 answer
64 views

AWS- adding organisation members in a specific OU

We have multiple OU's in our AWS organisation. We use AWS cli to create new AWS organisation members. For eg. aws organizations create-account --email test@example.com --account-name "testaccount" ...
user avatar
  • 183
1 vote
1 answer
56 views

AWS- Limiting resource access for member of organisational accounts

We have certain AWS labs which we offer to our customers. Every time a user opens the lab, a new member account is created and added to the organisational account. This only happens the first time ...
user avatar
  • 183
0 votes
1 answer
2k views

Access Denied using S3 upload function

I have a lambda function with the following policy { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListBucket" ], "...
user avatar
  • 121

1
2 3 4 5