25
When crafting Amazon IAM policies for Amazon S3, you need to be aware of the difference between Operations on the Service (e.g. ListAllMyBuckets), Operations on Buckets (e.g. ListBucket) and Operations on Objects (e.g. GetObject).
In particular, the Resource specification of your policy needs to address the appropriate target entities according to the ...
25
Unfortunately you can't do this globally. However, for each AWS product that supports it, you typically can limit access to a certain region.
For instance, for EC2, you can do the following:
{
"Statement":[{
"Effect":"allow",
"Action":"RunInstances",
"Resource":"*",
"Condition":{
"StringEquals":{
"ec2:Region":"us-west-1"
...
25
The only necessary role is the Container Instance IAM role. This role allows the ECS agent (running on your EC2 instance) to communicate with Amazon ECS.
There are five other roles that you may also find useful, for different purposes:
ECS Service-Linked role (SLR) - This role enables Amazon ECS to manage a variety of AWS resources associated with your ...
24
Update
Mike Pope has published a nice article about Granting Permission to Launch EC2 Instances with IAM Roles (PassRole Permission) on the AWS Security Blog, which explains the subject matter from an AWS point of view.
Initial Answer
Skaperen's answer is partially correct (+1), but slightly imprecise/misleading as follows (the explanation seems a bit too ...
21
The Amazon CloudWatch Monitoring Scripts for Linux are comprised of two Perl scripts, both using one Perl module - a short peek into the source reveals the following AWS API actions being used:
CloudWatchClient.pm - DescribeTags
mon-get-instance-stats.pl - GetMetricStatistics, ListMetrics
mon-put-instance-data.pl - PutMetricData
With this information you ...
13
If you want to limit editing to a single security group, I think that you need 2 statements, the following worked for me:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1413232782000",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstanceAttribute",
"...
13
For this to work, you need to explicitly ALLOW the following:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1392679134000",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:DeleteSecurityGroup",
"...
13
One way you could do this is make a new zone that's a subdomain of the main domain, like stuff.example.com and delegate the subdomain's NS to that secondary zone. Give them IAM privileges to that subdomain's zone and they'd be able to create subdomains like my.stuff.example.com. For records that you want to be first-class citizens, you could CNAME my.example....
13
The answer is yes, there is. By using a condition. For instance, for admin accounts:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*",
"Condition":
{
"Null":{"aws:MultiFactorAuthAge":"false"}
}
}
]
}
It will enforce MFA for both password authentication ...
12
src: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
The AWS::IAM::Role types now have a ManagedPolicyArns field where you can set this. You just need to grab the ARN (easy to grab from IAM console) and place it in that field. In the example below I created a role that provides read-only ECR access so my image can ...
12
Amazon IAM users can't log in through the main Amazon AWS login page.
Instead, they need to use a custom login URL which is displayed at the top of your IAM Dashboard page. That link is labeled "IAM users sign-in link", and is of the form:
https://AWS-account-ID-or-alias.signin.aws.amazon.com/console
Using that account-specific IAM login form, the user ...
9
After a bit of looking around, it appears that the answer is "kind of".
In IAM, an administrator can configure a MFA for another IAM user. Although this may be a bit tricky if you are setting up a virtual MFA, it's possible. Then, if the user has not been granted permissions to update/remove their MFA, it is effectively required.
While I have not yet ...
9
Use something like this. This example restricts access to two AWS regions. Modify as needed.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": [
"eu-central-1",
"eu-west-1"
]
}
}
}]
}
8
Since April 25th 2018, AWS has a global resource aws:RequestedRegion you can use to limit the regions a user can send requests to. This is independent of the service being regional or not, so you can apply it to all services.
AWS Security Blog
Unfortunately you can't use this in an organization's Service Control Policy to apply it to an account globally, ...
7
As wisely posted at How can I limit EC2 describe images permissions, resource level permissions are not implemented at all on ec2:Describe* actions.
In Reality you need to limit access based on other things and not the resource ARN.
7
I was getting 'Forbidden' as the response to './ec2.py --list'. It looks like a bug when not using RDS and a query request to describe RDS resources is made (as is the default with this plugin).
Just disable the request in ec2.ini like this:
rds = False
6
Unfortunately AWS Identity and Access Management (IAM) doesn't fully cover this particular aspect as of today, because the recently introduced Resource-Level Permissions for EC2 and RDS Resources are not yet available for all API actions, see this note from Amazon Resource Names for Amazon EC2:
Important Currently, not all API actions support individual ...
6
From your EC2 insctance, you will also have to retrieve the temporary credentials in the instance metadata:
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<your-iam-role-name>
You shall then use the provided access and secret key to access your S3 bucket.
6
Basically, the IAM documentation is totally unreliable when it comes to doing anything other than set global admin or read-only policies.
This is the policy I eventually got to work (for the subnet bit at least):
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": [
"arn:...
6
If not using ElasticCache you have to set that to False as well. So uncomment
elasticache = False
6
In addition to Cloudtrail, you should enable logging for your S3 buckets. After doing that, AWS will start logging the canonical user ID used to make authenticated requests to S3.
Quote from AWS S3 Docs on logging fields:
The canonical user ID of the requester, or the string "Anonymous" for
unauthenticated requests. If the requester was an IAM user, ...
6
Yes, this is absolutely possible with IAM, using the Condition element. The Condition element lets you build expressions in which you can use Boolean operators to match against a condition, which in your case will be a resource with a specific tag.
For example, if you tag all the application B resources with "GroupB", the below IAM policy will restrict a ...
5
You can create AWS Lambda function that make this change (only for this single record) and make an invocation policy for this function.
5
I had the chance to ask this question to a couple of aws solutions architect at the last amazon aws conference and they confirmed me is not possible. IAM or better Route53 does not have that level of granularity.
5
There is this project: https://github.com/dump247/docker-ec2-metadata
It acts as a proxy to the instance meta-data endpoint, returning a role specific to the container. I have not used it before, but it seems to solve the use-case you are describing.
5
By default the AWS billing data is only accessible to the root account and not subject to IAM. In order to share access the root account has to go to the "Account Stettings" and enable "IAM User Access to Billing Information".
5
There currently is no method using SDKs for the AWS CLI to get the last accessed time of an IAM role. I confirmed this today with AWS support.
Currently, the only way is to use the AWS Management Console.
Select your IAM role
Click the "Access Advisor" tab.
The contents of this tab will display the last access time for each of the various services (S3, EC2,...
4
You most likely need to recompose your IAM Policy along the lines of Example 5. Launching instances into a specific VPC within Controlling Access to Amazon VPC Resources:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": "arn:aws:ec2:region:account:subnet/*",
"Condition": {...
4
Accepted answer on this thread gave Syntax Error on Policy. Below worked for me:
{
"Statement": [
{
"Sid": "Stmt1375943389569",
"Action": "ec2:*",
"Effect": "Allow",
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:Region": "eu-central-1"
}
}
}
]
}
4
Got back from Amazon Support:
Unfortunately, there is not a way to do this at this time. While we do
now offer resource level permissions for EC2 resources, (more info
here...
http://aws.typepad.com/aws/2013/07/resource-permissions-for-ec2-and-rds-resources.html)
conditionally controlling access based on a specif VPC is not
supported.
They ...
Only top voted, non community-wiki answers of a minimum length are eligible
