Questions tagged [amazon-iam]

IAM is Amazon Web Services' Identity and Access Management service

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

IAM for restricting specific request values

I would like to make an IAM user which was access to the AWS Lightsail CreateInstances API, but only if they make a request where bundleId is nano_2_0. I am aware of condition keys in AWS, but ...
2
votes
1answer
70 views

AWS Cloud Provider Integration with Kubernetes - Nodes stuck with “uninitialized: true” taint after bootstrapping

Summary I am attempting to bootstrap a Kubernetes cluster on AWS using Kubeadm. Please before you suggest them, I am not interested in using EKS or another bootstrapping solution like Kops, Kubespray,...
1
vote
2answers
101 views

How can switch to an EC2 instance role locally as a user?

I apply ec2 instance roles to my servers but I want to switch to those roles myself locally first to test permissions Id tried switching to one but I get an error: aws sts assume-role --role-arn arn:...
1
vote
1answer
36 views

Can only log into AWS console with IAM user if password was auto-generated

Scenario: I create a new IAM user and choose "AWS Management Console access" for "Access type". For "Console password", I choose "Custom password" and set a password. I attach a policy to the user ...
0
votes
1answer
43 views

Billing access denied, tho Ive granted all access to an IAM user

I currently cant watch or edit Billing (through IAM User Access to Billing Information) because the AWS console says that I dont have permissions. I am the only user in the account, with a full IAM ...
1
vote
2answers
26 views

Restrict access of IAM user to delete Route53 hostedzone NS and SOA record sets

I have written IAM Policy to restrict IAM users to just use a single hosted zone for testing but how can I restrict IAM users to delete this hosted zone's NS record and SOA record sets. PFB my IAM ...
1
vote
0answers
17 views

Can an instance profile's condition reference EC2 instance's tags?

I'm trying to setup an instance profile for an EC2 instance that limits its access to a particular path within an S3 bucket, based on the Name tag of that EC2 instance. I've gotten a policy that's ...
0
votes
0answers
40 views

how to create aws AWSServiceRoleForClientVPN service-linked role manually

I need "AWSServiceRoleForClientVPN" IAM Role to create client VPN endpoint in AWS but I do not have "create service-linked role" permission. So I need to ask administrator to create ...
0
votes
0answers
28 views

Faulty elasticache permissions with Elastic Beanstalk

I'm using ElastiCache with Elastic Beanstalk, and everything is working fine, but I get the following events in my logs every 7 days: Updating Auto Scaling group named: awseb-e-xxx-stack-...
2
votes
1answer
107 views

Non-null password_last_used for (supposedly passwordless) AWS root_account?

As I was auditing an org's AWS IAM, I did: aws iam generate-credential-report # a bit later, download the CSV aws iam get-credential-report During viewing the report, one thing struck me as highly ...
0
votes
1answer
33 views

AWS- adding organisation members in a specific OU

We have multiple OU's in our AWS organisation. We use AWS cli to create new AWS organisation members. For eg. aws organizations create-account --email test@example.com --account-name "testaccount" ...
1
vote
1answer
32 views

AWS- Limiting resource access for member of organisational accounts

We have certain AWS labs which we offer to our customers. Every time a user opens the lab, a new member account is created and added to the organisational account. This only happens the first time ...
0
votes
1answer
457 views

Access Denied using S3 upload function

I have a lambda function with the following policy { "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListBucket" ], "...
0
votes
1answer
54 views

AWS Cross Account Role Allowing Assumed Role

I have other accounts running services (on EC2 etc). I have one account running a metrics UI site as part of an ECS cluster that assumes a role while operating (arn:aws:sts::1111111111:assumed-role/...
0
votes
0answers
91 views

How can I create AWS QuickSight users connected to SSO accounts?

My organization uses SSO to access AWS, so our account names look something like this: GodSSO/owner@domain.com DevSSO/coder@domain.com DevSSO/writer@domain.com ReadSSO/auditor@domain.com ReadSSO/...
0
votes
1answer
27 views

Grant access to role in another AWS account to all objects in my bucket

So I want to grant a role that exists in account A the get-object permission on items in a bucket owned by account B. I read The AWS docs' example policies and created a bucket policy like this: { ...
0
votes
1answer
276 views

AWS IAM won't let my users change their passwords

My password policy is configured to allow users to change their passwords, but when I create a new user with the "must change password" option, the user gets told they need "iam:ChangePassword" ...
1
vote
1answer
69 views

AWS: How to figure out where an explicit deny is coming from?

So my manager have left the company a few months back, leaving me to manage things on my own, and now, I'm looking through cloud trail events, and found that in one of our accounts, I have an explicit ...
2
votes
0answers
50 views

AWS EC2 : IAM policy to allow inbound SecurityGroup with PORT Range

I want to allow the access to specific ec2 security group to one of the developer. For that I know that we can use something like this : { "Version": "2012-10-17", "Statement": [ { ...
1
vote
1answer
49 views

AWS - deny services deployment in public subnet

We are building some security boundaries for our internal teams and would like to limit their ability to deploy services in Public Subnets. I can build a boundary policy for EC2 not to be deployed in ...
0
votes
1answer
53 views

IAM policy for managing EKS pods for users

Does anyone know what resources need to be granted to a user in order to run kubectl commands on an EKS cluster? At the moment, we have a couple of users who are associated with AdministratorAccess (...
0
votes
0answers
48 views

How to clone RDS instances between AWS account roles?

I'm using an AWS account which has different roles for the different environments we use. For example, we have a Development role for our development environment and a Production role for our ...
0
votes
0answers
13 views

How To Set Up AWS Console Access to Browse and Restore Files in S3 Bucket That Were Lifecycled to Glacier?

I am trying to set up a mostly read-only IAM profile for a team member to browse our S3 buckets and to be able to initiate a restore from Glacier when needed in order to download / access certain ...
0
votes
1answer
68 views

What permissions are required to run AWS TransferUtility?

Using the AWS .NET SDK's TransferUtility, I can download files using an access key ID for myself, but when I set up a restricted user with read-only access, I get "The remote server returned an error: ...
1
vote
1answer
660 views

AWS system manager : Verify that the IAM instance profile attached to the instance includes the required permissions

I am trying to access an ec2 instance using AWS systems manager for that I've created a role attached to the following policies. AmazonEC2RoleforSSM AmazonSSMAutomationApproverAccess ...
2
votes
1answer
119 views

Securely storing AWS access credentials in an on-premise server

What is the best way to store AWS IAM access credentials in a physical/virtual server so services running in it can access it? This is a problem which was fixed long ago for EC2 instances through ...
0
votes
0answers
48 views

AWS IoT Analytics use custom S3 Bucket as DataStore

I set up an AWS IoT Analytics Channel, Pipeline and Datastore. Everything is working as expected when I'm using service-managed S3-Buckets for the datastore. However, I want to change from the ...
1
vote
0answers
157 views

AWS organization accounts, full AWS access, and S3 permissions

I have an Organization that has three accounts in it, and I have attached a FullAWSAccess control policy to one of those accounts A. This policy grants * action to * resources. A logged in to the AWS ...
0
votes
0answers
13 views

How to set “Used as” attribute in managed policy?

Using SAM template(wrapper of CloudFormation template), we are creating a resource of type AWS::IAM::ManagedPolicy, after deploying, we see Used as attribute empty, as shown below: SAM template ...
0
votes
0answers
57 views

AWS Lambda invoke says permission denied on wide open assumed role

I use the .aws/credentials file to set up access to a central account, which then uses assumable roles to access other accounts. As such my aws cli command asks for the MFA token occasionally. I am ...
0
votes
1answer
2k views

What permissions do I need to access a SQS queue?

I am trying to open a SQS queue but I got this error: 2019-07-09 07:20:31,855 pid 3604 tid 800 ERROR connection <?xml version="1.0 "?><ErrorResponse xmlns="http://queue.amazonaws.com/doc/...
0
votes
0answers
203 views

AWS AssumeRole keeps returning access denied

I created a new policy { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "sts:AssumeRole", "sts:...
0
votes
2answers
1k views

How can I 'aws s3 sync' two buckets, which are located in different accounts

I'm trying to use 'aws s3 sync' on the awscli between two accounts. Account A, I own. Account B, Owned by a third party. Account B has given a user:jon on account A permission to a bucket through a ...
2
votes
1answer
53 views

AWS IAM policy JSON with time limit and time zone

I want to add IAM policy with time limit. But in the time limit it didn't have way to specify the time zone. How can define the time zone or what is the time zone considered here? { "Effect":...
1
vote
1answer
69 views

Switch Role on Windows10 Fails with AWS Source IP

When a user on Windows 10 tries to switch roles in AWS it fails with Failed authentication We have a Condition in our sts:AssumeRole policy to only allow the role to switch if the user is ...
2
votes
3answers
156 views

AWS - Bastion checking IAM permissions?

Is it possible to set up a bastion host in AWS that would be checking IAM to check if given user can connect to specific EC2 instance? It might be a bit blurry but the idea is following. Let's ...
0
votes
1answer
15 views

On AWS, how to filter which services are using a role?

On AWS, I want to review all permissions grant or revoked to our services and redefine them when necessary. Considering a specific role set on AWS IAM. How can I filter which services, instances or ...
0
votes
1answer
63 views

How to limit the permissions AWS IAM RoleA can grant to a role (Role B) it creates

In order to allow my developers to use the Serverless Framework to deploy new AWS Lambda functions, they have to be able to create roles. I'd like to give them permissions to create roles that can ...
0
votes
1answer
753 views

Enforcing EBS Encryption within AWS Organization using SCP (Service Control Policy)

Is it possible to enforce that all accounts within an AWS organization can only create encrypted EBS volumes? I know you can enforce it using IAM roles, but I want to know if it can be done with SCP. ...
1
vote
0answers
35 views

Which KMS permissions does ACM require?

I would like to have ACM manage a TLS certificate that I upload in the console. However, the AWS role I am assuming can access KMS actions, but only from a certain set of IPv4 addresses. I will ...
0
votes
2answers
145 views

AWS describe-configuration-settings returns InsufficientPrivilegesException

I've created a "Programmatic access" user with full read and list permissions on Elastic Beanstalk, provided by a Policy I've created specifically. This means that when I go to the Policy Summary page ...
3
votes
4answers
1k views

AWS IAM: Restrict Console Access to only One Instance

I am trying to create an IAM user for the AWS Console with permission to list and perform action on only 1 instance. So I have a total of 6 Instances and I tried hiding 5 of them via IAM Policies by ...
0
votes
1answer
107 views

how to show an IAM user's roles with 'aws iam'?

If I run $ aws iam get-user --user-name anthony, I get result like this { "User": { "Path": "/", "UserName": "anthony", "UserId": "E2S4XZIL9NRNSBIDBI5U6", "Arn": "...
0
votes
1answer
860 views

AWS RDS Cannot modify database instance due to IAM DB Authentication

I have a MySQL 8.0.13 instance running on AWS RDS. AWS documentation says that MySQL 8.0.* does not support IAM DB Authentication. This seems to be true, however my DB somehow has IAM DB ...
1
vote
0answers
115 views

How to give AWS users access to more than 10+ accounts in an organization?

We have 10+ accounts clustered under a single root account, all in one organization. Our ops personnel gets a user in the root account and can access any "sub" account in the organization if said user ...
3
votes
0answers
42 views

IAM policy: Allow user to List only some instances/projects/resources

I created a new CodeStar project for a local user group activity and created some project members. Using the AWS CodeStar dashboard I created a member with the policy that allows them to be a ...
4
votes
1answer
3k views

AWS Permissions: Lambda access Denied to S3

I have created a Lambda Python function through AWS Cloud 9 but have hit an issue when trying to write to an S3 bucket from the Lambda Function. When I test in Cloud 9 the Python codes runs fine and ...
0
votes
1answer
413 views

Can I use existing AWS IAM role to create S3 bucket via Cloudformation template?

I want to create a S3 Bucket via CloudFormation template. I found there is a way to do it for EC2 instance on this link. Do we have a way to create S3 bucket using existing IAM role via ...
1
vote
1answer
22 views

User assigned IAM Admin role cannot see VPCs

In AWS, I created a user and gave this user AdministratorAcess permissions. The way I understand it, this user can do everything the root administrator can: clicking on the AdministratorAccess ...
0
votes
1answer
45 views

How can I create Cloudtrail trail to log events of only a specific user/resource

How can we monitor API usage only a specific user in Amazon-Web-Services. I tried creating Cloudtrail trail but it logs events of all users' all activity to the s3 bucket I configured to log it to. I ...

1
2 3 4 5