Questions tagged [amazon-iam]
IAM is Amazon Web Services' Identity and Access Management service
261
questions
0
votes
1
answer
111
views
Cross Account SSM session: AccessDeniedException
I have two AWS accounts and one role in each account: Account-A have RoleA and Account-B have RoleB.
RoleA will assume the RoleB to be able to connect in an EC2 instance in Account-B through ssm start-...
- 84
0
votes
0
answers
62
views
Restrict connection to RDS database based on IAM Role and RDS tag
G'day!
I have IAM Authentication turned on for my RDS databases.
I can successfully connect using an authorised role and am denied when using an unauthorised role.
However, I have a role that I would ...
0
votes
2
answers
68
views
How can I set up AWS Client VPN using IAM roles for authentication?
Context: I am trying to set up Postgres RDS in a private_isolated subnet of a VPC. I want to use pgAdmin to do work on it, which means I either need a bastion or a VPN connection. A bastion requires a ...
- 151
1
vote
1
answer
93
views
AWS IAM: deny users from creating policies on specific resources
I want to be able to give my admin users the permission to create policies in IAM, but I want to make sure that they aren't able to create a policy that affects a specific resource.
To be more ...
- 113
0
votes
0
answers
69
views
How to fix permission error of Ebs volume using Amazon Data lifecycle manager?
I applied the terraform code in this link, which contains code to apply the specific roles and permission s to service dlm lifecycle for ebs volumes.
But still I am getting access errors.
Please ...
0
votes
0
answers
167
views
the policy type identity_policy does not support the principal element, how to fix that?
I am trying to create this policy through AWS web console instead of terraform.
But getting error as in below screen.
Please suggest
- 26
0
votes
0
answers
39
views
Switch to a different AWS accounts in the UI
I currently have AWS configuration set up with my access key id and secret access key (i.e. I see this when going to 'aws configure' in the CLI). I then login through my company's OKTA to then access ...
- 101
0
votes
0
answers
35
views
Mimic user permissions on AWS EC2 instances using IAM roles
I'm setting up an AWS account with several users. Each of these users has policies attached that restrict their access to specific S3 buckets/objects and the EC2 instance types / Autoscaling Groups ...
0
votes
1
answer
247
views
Is it impossible to access rds and elasticache redis in AWS fargate only by setting a role?
I tried to access the aws service rds and elasticache redis through fargate's task role.
I connected the full access of the service to the task role, but it was not connected, so I allowed the subnet ...
0
votes
1
answer
48
views
Limit what kind of policies and roles an admin role can create in AWS
Is there a way in AWS to limit what kind of roles and policies another role can create?
In my setup, I have two kinds of admin roles: AccountAdmin and InfraAdmin. The AccountAdmin one having more ...
- 103
0
votes
0
answers
23
views
How to assign an IAM role having the same permission set as the IPs have?
How to update the IAM policy below so that the IAM role, arn:aws:iam::7574333677569:role/dev-abc-webserver, also have permissions?
{
"Version": "2012-10-17",
"Id":...
- 49
0
votes
0
answers
90
views
One way s3 sync - Bucket to local only
This is the scenario:
Company A creates a bucket, and periodically uploads images to it, deletes or replaces some, etc
Company B needs to sync with the bucket - they download the images from it and ...
- 123
2
votes
1
answer
1k
views
How do i fix terraform invalid JSON policy
I am trying to use a file which contains load balancer iam policy for my AWS in terraform. However when i run the terraform script, i get an error stating:
Error: "policy" contains an ...
- 123
1
vote
1
answer
358
views
EC2 instance won't recognize IAM role?
I'm trying to download ECR images on my EC2 instance without having to provide a credentials file. So I created a role with the policy AmazonEC2ContainerRegistryReadOnly and attached to my running ...
- 81
0
votes
0
answers
66
views
Unable to use resource-level permissions and conditions with some EC2 API actions
According to the docs, a bunch of VPC-related API actions (such as AssociateAddress, CreateRoute, etc) should allow resource-level permissions and conditions.
For example, if I understand it correctly,...
- 1,423
1
vote
1
answer
736
views
RDS PostgreSQL Import+Export to/from S3
Is it possible to enable both importing and exporting with an RDS PostgreSQL instance to an S3 bucket? I've been able to use the following pattern to enable one or the other with consistent success:
...
- 394
1
vote
1
answer
271
views
How can I call "complete-lifecycle-action"?
There is an AWS EC2 instance which is launched by an auto-scaling-group. I wish to put this instance to Pending state during initialization.
This is very easy with the lifecycle hooks:
This hook will ...
- 191
0
votes
1
answer
258
views
A user is blocked from using MFA though I added the permissions for their AWS IAM account
I hold admin powers on one of the AWS accounts that we use at the company where I work. I am trying to make MFA mandatory for all users. I followed this tutorial:
https://docs.aws.amazon.com/IAM/...
- 153
0
votes
1
answer
80
views
Automatic EC2 Role Assignment
Trying to understand AWS IAM resources/concepts a little better. I know there is a way to configure an EC2 (either possibly via its underlying AMI or a launch template) so that when it launches for ...
- 143
0
votes
1
answer
1k
views
Pod assigned node role instead of service account role on AWS EKS
First some info about the setup:
EKS version: 1.21
eksctl version: 0.77.0
AWS Go SDK verion: v1.44.28
Deploying using kubectl
I have a k8s cluster on AWS EKS on which I am deploying a custom k8s ...
- 111
0
votes
2
answers
287
views
Sharing an AWS "instance role" across accounts, as with other resources?
What works
We have several EC2 instances that pull things out of an S3 bucket on boot (and at other times). To allow this, we have an IAM policy granting read-only access...
"Effect": "...
- 101
1
vote
1
answer
683
views
S3 access control based on bucket tags
i hope you can help me out. I have read a couple of docs now, and I am still unsure whether this actually works.
I want to give access in different levels to AWS users based on S3 tags.
Example:
S3 ...
- 203
1
vote
1
answer
562
views
Quicksight Error: This user name already exists in this account
When I want to login to view my Quicksight dashboard I get this error:
This user name already exists in this account.
Contact your QuickSight administrator, and ask
them to invite you with a unique ...
- 137
0
votes
1
answer
115
views
Best practice for AWS root account or superuser?
Normally, we have the rule of 3 people having superuser access with 3 username/passwords and if anyone is ever offboarded(they leave or are fired), on vacation, out sick, different time-zone, someone ...
- 911
4
votes
3
answers
5k
views
Getting "Fargate requires task definition to have execution role ARN to support ECR images." when creating Fargate task but the role is defined
I am trying to deploy a very simple web application to AWS Fargate. I have pushed a docker image of the backend of the application to ECR and I am trying to setup a Fargate task definition for the ...
- 161
0
votes
1
answer
603
views
AWS Policy to Read/write RDS
In my scenario , I want a policy that will allow reading and writing of abc-database-backups/rds/postgresql-backup on S3? We'll want the my servers to have that access added.
Is creating a role and ...
- 1
1
vote
1
answer
263
views
Safely store AWS IAM User Keys (Access and Secret) created by IaC
I've the following setup:
Infrastructure is setup using AWS CDK;
I've one Stack/Environment (Production, Staging...);
Each Stack has a different S3 Bucket (used for website hosting);
I've a Stack ...
1
vote
1
answer
145
views
How do you set a self-destruct or maximum uptime in AWS?
Situation
We have a sandbox AWS account for trying things out. It is not for production, purely just for playing around with all the toys that AWS provide. We want to encourage everyone to explore and ...
- 131
0
votes
1
answer
77
views
AWS CLI Usage Issue
In our scenario, We previously had some AWS keys. The IAM interface show/showed no usage for it but the employee has been able to upload resources. Could anyone advise how to check if the interface is ...
- 71
0
votes
0
answers
79
views
Individual Local Accounts on AWS
I'm my scenario, Currently, we have all developers connect to ec2 instances using the ec2-user account. Is there a better way to do this so we can see which actions developers take on the machines?
I'...
- 71
0
votes
1
answer
132
views
S3 Logs event Issue
Is there a way to see what actions the 'g2' IAM user is performing in S3, and which IP(s) they are running from? I have already enabled the logging of S3 actions.
One point I’m still not able to ...
- 71
0
votes
0
answers
19
views
AWS IAM user with special permissions
I am having following task to do.
I want to create 10 IAM users each user should have login username and password
and each IAM user should have separate ec2 instance that can not be visible to others.
...
- 15
0
votes
2
answers
232
views
Best Practice for AWS IAM access keys for use with AWS SDK
I want to know the best practice used by big company's for programmatic access for multiple AWS services as there are multiple programs needing access to different-2 services so how it is managed? Did ...
- 49
3
votes
1
answer
7k
views
Is it possible to grant a "read everything" role in AWS?
Is there a default policy that can provide read-only access to all services with AWS? Is there are naming convention for permissions that could be followed such as "Allow" : "Get*" ...
- 217
0
votes
1
answer
254
views
How to use aws-iam-authenticator with remote Terraform Cloud Runs?
I am already successfully using Terraform with the Kubernetes provider to manage various part of and services on an EKS cluster in AWS. I would like to use Terraform Cloud to manage it (and take ...
- 5,222
0
votes
0
answers
253
views
Increasing general AWS console timeout
The AWS console appears to kick you out after 24-hours, and I'd like to increase it slightly. This has nothing to do with SSO. Is this a fundamental requirement or can it be tweaked somewhere?
- 560
1
vote
1
answer
836
views
What is the new policy action needed to allow the new DescribeSecurityGroupRules
We have IAM policies in place that used to permit the roles to edit a security group rules
{
"Version": "2012-10-17",
"Statement": [
{
"...
- 113
1
vote
0
answers
2k
views
Converting specific folder of S3 into browsable directory list without making it public
I have a bucket that I'd like to access using a browser similar to http://data.openspending.org/
and I'd like only a subfolder to be visible.
So if Bucket1 has multiple folders, I only wanna show and ...
- 113
3
votes
0
answers
605
views
EKS - Use IAM roles for service accounts on multiple clusters
I am trying to use IAM roles for service accounts in EKS.
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
When it comes to create the IAM role to be assigned to a ...
- 31
2
votes
1
answer
5k
views
AWS IAM Roles: What is a trusted entity exactly?
I have a role attached to a LaunchConfiguration for an EC2 instance, that gives the EC2 instance privs to do certain things like do Cloudwatch logs (the context isn't important to the question). In ...
- 178
0
votes
0
answers
461
views
Can i access an EKS cluster , if i don't have access to iam user that created it?
An AWS admin , created an IAM user , and that user created an EKS cluster. Now , we don't have access to that IAM user.
If , we try to execute , kubectl , commands on that EKS cluster from a new IAM ...
1
vote
1
answer
889
views
AWS S3 Policy: One non-public bucket, separate sub-folders for each user, restricted access
at the moment I'm struggling how to create a secure policy for my Amazon S3 bucket.
My plan is to have one bucket with several sub-folders for separate (IAM) users.
Access should only be ...
2
votes
0
answers
210
views
Facilitating arbitrary code execution on AWS Lambda
I am developing a SaaS where a user will be able to upload a custom JavaScript function that runs when an event happens. In order to preserve the integrity of the system, I am using AWS Lambda to run ...
- 121
2
votes
2
answers
828
views
Permissions for choosing tags in Cloudwatch
When trying to create a Cloudwatch dashboard I get "You don't have permission to access tags and properties. Retry".
What permissions does my IAM account have to have in order to be able to ...
- 121
0
votes
1
answer
408
views
AWS-IAM - How to give a combining specific access to specific region with some resource tags
Hello I am trying to combine some rights access for a user using IAM policies:
Full access to one region ONLY (i.e: ap-east-1)
ReadOnlyAccess to another region (i.e: us-east-1)
Write access only to (...
- 13
1
vote
0
answers
67
views
Autoscaling - lifecylehook implementation
I'm trying to implement my first ASG with a lifecycle hook and I am having this issue:
LifecycleHandlerFunction: Encountered unsupported property Role
The following resource(s) failed to create:
[...
- 13
3
votes
1
answer
4k
views
Impossible to delete AWS backup vault, backup plans?
I swear, I've read all the docs I can find, and have tried everything including the AWS policy generator UI and manually editing policy JSON, but no matter what I try, when I try to delete any of ...
- 131
1
vote
1
answer
1k
views
How do I enforce a policy to block access to specific regions without updating all of my policies?
I want to block all user access to almost all aws regions. You cant "disable" a region that is enabled by default. Also I am aware of permissions that are account level and cant be ...
- 4,153
1
vote
1
answer
88
views
ec2 permissions to manage only firewall access
I'd like to allow some developers to manage firewall rules, specifically rules in ec2 security groups, (or some of them ideally) so that they can, eg, update their changing IP addresses to access ...
- 111
2
votes
1
answer
1k
views
AWS: How do I restrict deployment to ECS clusters using IAM
I have multiple Fargate clusters in a single AWS account. I wish to ensure that a given service account (used by the build pipeline) can only update Services within a given Fargate clusters.
The IAM ...
- 1,172