Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [amazon-iam]

IAM is Amazon Web Services' Identity and Access Management service

0
votes
0answers
7 views

provision EC2 services using Terraform using IAM role

I want to provision EC2 services using Terraform but without using the Secret and Access keys instead using IAM role. Can anyone help me with the related Terraform configuration, How it can do ...
1
vote
0answers
49 views

How to give AWS users access to more than 10+ accounts in an organization?

We have 10+ accounts clustered under a single root account, all in one organization. Our ops personnel gets a user in the root account and can access any "sub" account in the organization if said user ...
3
votes
0answers
21 views

IAM policy: Allow user to List only some instances/projects/resources

I created a new CodeStar project for a local user group activity and created some project members. Using the AWS CodeStar dashboard I created a member with the policy that allows them to be a ...
3
votes
1answer
126 views

AWS Permissions: Lambda access Denied to S3

I have created a Lambda Python function through AWS Cloud 9 but have hit an issue when trying to write to an S3 bucket from the Lambda Function. When I test in Cloud 9 the Python codes runs fine and ...
0
votes
1answer
41 views

Can I use existing AWS IAM role to create S3 bucket via Cloudformation template?

I want to create a S3 Bucket via CloudFormation template. I found there is a way to do it for EC2 instance on this link. Do we have a way to create S3 bucket using existing IAM role via ...
1
vote
1answer
20 views

User assigned IAM Admin role cannot see VPCs

In AWS, I created a user and gave this user AdministratorAcess permissions. The way I understand it, this user can do everything the root administrator can: clicking on the AdministratorAccess ...
0
votes
1answer
37 views

How can I create Cloudtrail trail to log events of only a specific user/resource

How can we monitor API usage only a specific user in Amazon-Web-Services. I tried creating Cloudtrail trail but it logs events of all users' all activity to the s3 bucket I configured to log it to. I ...
1
vote
2answers
98 views

Share IAM Policy across accounts in Organizations

While setting up my Organization in AWS I stumbled upon a problem. We plan to use AWS Organizations to separate different departments (Dev, Operations, IT, Projects) into different AWS Accounts and ...
0
votes
0answers
67 views

AWS Systems Manager Linux Instance Patching - “The specified service role is invalid”

I'm trying to set up AWS Systems Manager (SSM) to patch a production Amazon Linux 1 instance. I've tried setting SSM tasks up from scratch a few times but I keep getting the error message "The ...
0
votes
0answers
28 views

possible for ec2 to have cross account bucket access without using iam user?

Currently I have an ec2 which accesses my own s3 bucket using role instead of iam user as I am trying to get ride of using the keys. I have googled around and see some cross-account bucket access but ...
1
vote
1answer
30 views

EC2 IAM - restrict CreateTags permission to instances which were started from an AMI with a particular tag

Does anyone know of a way to create the following permission on AWS IAM: Allows tagging of any EC2 instance, on the condition that: The AMI from which the instance was created has the tag "foo" with ...
1
vote
0answers
85 views

Why does AWS Lambda need to pass ecsTaskExecutionRole to ECS task

I am writing an AWS Lambda function to trigger an ECS Fargate task. I am following the example provided at Run tasks with AWS Fargate and Lambda. While my setup works, there is one of the parts ...
1
vote
1answer
35 views

AWS set s3 bucket directory access with policy

I'm trying to create a policy on AWS that allows access to specific folders in an s3 bucket. According to the documentation this can be done with the following policy { "Version": "2012-10-17", ...
1
vote
2answers
68 views

Reverting S3 BucketPolicy

I was playing around with AWS S3 BucketPolicy. My intention was to allow access to bucket only to my username. I wrote following incorrect policy: { "Id": "Policy1542608345364", "Version": "2012-...
3
votes
2answers
78 views

Restrict access to S3 bucket folders to specific website users? (not using IAM Users)

I have a website where users need to log in. They can upload and delete their own pictures BUT these pictures are supposed to be private so images are not set to public that anyone can view. I know ...
2
votes
1answer
124 views

How can one configure an AWS ElasticSearch access policy using CloudFormation?

The AWS documentation on ElasticSearch access control talks about how to grant access to the ES domains subresources while preventing changes to the domain's configuration by creating an ES domain ...
2
votes
1answer
45 views

Can you use IAM roles to connect from a non-AWS application to AWS services?

We have some hybrid environment where some applications are running in our own datacenter and other services are running on AWS cloud. Now we have some application which needs to write files to S3. ...
1
vote
1answer
63 views

SSM Managed instance using AWS CLI and assume-role

I have a requirement for a non AWS host to perform a scheduled scripted task with an S3 bucket. I have this working as expected with access/secret access keys related to the S3 role. This non AWS ...
0
votes
1answer
31 views

Ssh key management in AWS like gcp

Google Cloud really Nails the SSH Key Management thing out of the box and AWS leaves it all up to you. In gcp your gcp login credentials are also used for SSH access. gcp automatically creates SSH ...
0
votes
0answers
30 views

Cannot list ephemeral drives in EC2 instance

I recently created one instance m5d.4xlarge with purpose to use as MS SQL server. Since instance comes with ephemeral drives it was an idea to use them as storage for tempdb. Mz problem is that I ...
-2
votes
1answer
34 views

IAM policy for restricting Glue resources

I want to limit a user to a specific database. User should be able to do all the actions to that database and its tables. All the examples I found in the documentations limit the Action, but never ...
0
votes
0answers
37 views

Allowing non-technical users to spin up EC2 instances

I'm looking for a simple (hopefully existing) solution to allow my sales guys to spin up EC2 instances for sales demos. I have an AMI setup, so the mechanics are in place. However, the AWS console is ...
0
votes
0answers
57 views

restrict terraform destroy on aws ec2 instances

im trying to restrict destroying instances via aws iam policy, i have a custom policy and also the aws full ec2 access policy attached to a user group, which one takes precedence? this is my custom ...
0
votes
1answer
148 views

IAM policy for ansible dynamic inventory in ec2

So, I am using the ec2.py script (provisioned by Ansible) for generating dynamic inventories. I have created the following IAM policy: { "Version": "2012-10-17", "Statement": [ { ...
0
votes
1answer
410 views

AWS IAM role RDS authentication failure

Trying to create a process for IAM role based authentication to my RDS instance per AWS wiki, but no matter what I seem to do I get a basic auth failure akin to a bad password, with no logging ...
2
votes
1answer
83 views

MFA Authentication in AWS

What is the difference between two conditions below? This condition is being append to a customer managed policy which is attached to an user. The policy will enable the user to perform any operation ...
1
vote
1answer
95 views

Why does creating a service in AWS ECS require the ecs:CreateService permission on all resources?

I'm trying to create a service on AWS ECS, using CloudFormation. The user trying to create service has a role granting it the ecs:CreateService permission on the cluster that will host the service. ...
0
votes
0answers
31 views

Minimal set of IAM policy actions to execute ec2:CreateSnapshot via UI?

What is the minimal IAM policy to grant CreateSnapshot via UI? The action set must be explicit because "PEP 20" and potential exposure of confidential configuration. Some background: A month ago I ...
1
vote
1answer
123 views

How would I determine that an S3 bucket and key is accessible to a redshift cluster?

I'm trying to determine if there is a connection from a redshift cluster is possible between a S3 bucket+key and a redshift cluster. Additionally I would love to find out if it has read and/or write ...
1
vote
0answers
36 views

AWS: identifying Access keys usage origin

In the process of trying to achieve a Well Architected Framework, one of the relevant issues to remediate in the Security pillar is the one related to the following question: "How are you managing ...
0
votes
1answer
58 views

AWS Lambda Policy - Allow to edit lambda functions depending on the user

When creating AWS Policies, is there a way to create a policy that Allow to view, edit and create lambda functions depending on the user that create that function before? I'm trying to do that, but I ...
1
vote
1answer
118 views

Authenticating embedded devices to send push notifications using Amazon SNS

I am designing a platform where a large number of cloud-enabled embedded devices will be sending push notifications to mobile apps using Amazon SNS. Each embedded device should create a SNS topic and ...
2
votes
0answers
1k views

Allow other AWS services to invoke Lambda using IAM

Is it possible to grant AWS services (e.g. API gateway, Secrets Manager) permission to invoke a Lambda function using only IAM roles? Normally this is done in the function's policy (resource-based ...
0
votes
0answers
72 views

How to create an IAM Role to Use for integration with an external Jenkins

We have a local Jenkins server that has access to our local bitbucket server. The goal is to achieve that Jenkins grabs code from that bitbucket server, and pushes it to AWS. I am trying to follow ...
0
votes
0answers
134 views

AWS Force MFA Policy Issue

I am following the AWS tutorial, Enable Your Users to Configure Their Own Credentials and MFA Settings. Section 1, point 4, last bullet point: The sixth and final statement uses a combination of "...
0
votes
0answers
201 views

AuthorizedKeysCommand is not working

I have tried many solutions, though in the auth.log it does not seem like the script command is called at all. Is there any other required settings that I would need to set in the sshd_config in order ...
2
votes
1answer
515 views

AWS elastic beanstalk: Errno 404 downloading file from S3 on deployment

I'm following the docs on fetching certificates from s3 when a new instance is deployed to elastic beanstalk. The instructions are fairly straightforward: create a config file under app-root/....
1
vote
2answers
232 views

Can AWS IAM be used on any non-ec2 instances?

Currently, we use ec2 instances in our environment. For the purpose to avoid credentials exposed to source code, we use IAM Roles to delegate access to users, applications, or services. However, ...
1
vote
0answers
363 views

Can ansible ec2 module use iam role instead of aws_access_keys?

Normally, when we are using ansible ec2 module to do operations, it is like this: - name: Creating ELB ec2_elb_lb: aws_access_key: "{{ AWS_ACCESS_KEY_ID }}" aws_secret_key: "{{ ...
0
votes
2answers
139 views

AWS access token for user assuming role

How to have access token per user assuming a role in another account? I have users which have an Access Token on the root account. They have access to another account (dev) through assumed role. I'm ...
0
votes
1answer
113 views

IAM user policy to RW to specific folders

I am trying out CloudBerry Drive tool to attach S3 buckets as my network drive. I have a bucket and 2 folders inside that, assuming the bucket name as environment and 2 folders as dev and prod. I have ...
0
votes
0answers
21 views

How can I restrict IAM credentials to a specific server role?

I'd like to create a user that is "effectively root" AWS wise (meaning too many service:* perms), but only allow this user to operate from servers with a specific role. The reason I don't want to give ...
1
vote
1answer
422 views

IAM policy to enforce tagging not working

0 down vote favorite I have created an IAM policy to deny creating EBS volumes if it is not tagged with both the keys "empname" and "team". The policy is attached to a test user. When I try to create ...
0
votes
1answer
60 views

IAM policy doesn't let me start instances

I've attached the following policy to a user, so that they can start and stop one specific instance. { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", ...
0
votes
2answers
1k views

How to configure Cloudwatch events to trigger on IAM API calls?

So I'm having trouble setting up Cloudwatch events to trigger a Lambda function. In the current scenario I want to trigger a Lambda when anyone/thing changes anything in IAM. Currently I have a ...
1
vote
1answer
149 views

Minimum AWS policy actions required for retrieving Glacier files through S3?

I'm trying to create a policy for an IAM account that will allow an employee to have full read permissions for our S3 (lifecycled to Glacier) buckets, with no unnecessary write abilities as to avoid ...
0
votes
1answer
69 views

How to allow another AWS account to list my AWS IAM roles?

I have an AWS account. Let's say my AWS account number is 123456789012. I have created these IAM roles: arn:aws:iam::123456789012:role/tiger-123 arn:aws:iam::123456789012:role/tiger-124 arn:aws:iam::...
0
votes
1answer
60 views

Cloudformation list IAM Policies

Can you dynamically list IAM Polices as a drop down menu within the Cloudformation options? The usual use case for this is adding instance types to a drop down. This is written manually though in all ...
1
vote
1answer
167 views

Isolated IAM users in AWS

I have a root account and I want to create 3 IAM users, one for each app: iamapp1, iamapp2 and iamapp3. I want them to have full access to ec2 resources, i.e listing, launching and configuring ec2 ...
2
votes
2answers
260 views

Determine IAM requirements for Cloudformation Stack

I'm currently developing and launching a relatively simple cloudformation stack. Just some simple RDS stuff, triggered through and external CI+CD service. However, my current cycle for development is ...