34 votes
Accepted

Confused by the role requirement of ECS

The only necessary role is the Container Instance IAM role. This role allows the ECS agent (running on your EC2 instance) to communicate with Amazon ECS. There are five other roles that you may also ...
17 votes

Is it possible to restrict AWS users/accounts to a specific region?

Use something like this. This example restricts access to two AWS regions. Modify as needed. { "Version": "2012-10-17", "Statement": [{ "Effect": "Deny", "Action": "*", "Resource": "*"...
  • 498
15 votes

AWS IAM won't let my users change their passwords

I was having the same problem. New users were getting the following error message: Either user is not authorized to perform iam:ChangePassword or entered password does not comply with account ...
14 votes

Cloudformation can I create a new role referencing an existing policy?

src: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html The AWS::IAM::Role types now have a ManagedPolicyArns field where you can set this. You just need to ...
12 votes

Why does my created Amazon IAM user get "We can not find an account with that email address" when trying to log in?

Amazon IAM users can't log in through the main Amazon AWS login page. Instead, they need to use a custom login URL which is displayed at the top of your IAM Dashboard page. That link is labeled "IAM ...
10 votes

Can you require MFA for AWS IAM accounts?

The accepted answer is no longer valid AFAICT. AWS has documented how you can do this through their tutorial article here: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-...
  • 201
10 votes
Accepted

How to know if an AWS IAM role is actually being used

There currently is no method using SDKs for the AWS CLI to get the last accessed time of an IAM role. I confirmed this today with AWS support. Currently, the only way is to use the AWS Management ...
  • 9,864
9 votes

Is it possible to restrict AWS users/accounts to a specific region?

Since April 25th 2018, AWS has a global resource aws:RequestedRegion you can use to limit the regions a user can send requests to. This is independent of the service being regional or not, so you can ...
7 votes

Amazon Route 53, restrict IAM user access to single record set

You can create AWS Lambda function that make this change (only for this single record) and make an invocation policy for this function.
  • 79
7 votes

Ansible AWS dynamic inventory: `./ec2.py --list` unauthorized

I was getting 'Forbidden' as the response to './ec2.py --list'. It looks like a bug when not using RDS and a query request to describe RDS resources is made (as is the default with this plugin). Just ...
7 votes

Create an AWS IAM policy that only allows resources to be created within a certain resource group?

Yes, this is absolutely possible with IAM, using the Condition element. The Condition element lets you build expressions in which you can use Boolean operators to match against a condition, which in ...
6 votes

Ansible AWS dynamic inventory: `./ec2.py --list` unauthorized

If not using ElasticCache you have to set that to False as well. So uncomment elasticache = False
6 votes
Accepted

AWSLambdaExecute policy definition

If your function has nothing to do with S3 then don't use this managed policy. As far as I can see this policy is used in the documentation in combination with a tutorial on how to use Lambda with ...
  • 268
6 votes
Accepted

Can't access AWS billing data although I have full permissions

By default the AWS billing data is only accessible to the root account and not subject to IAM. In order to share access the root account has to go to the "Account Stettings" and enable "IAM User ...
  • 3,106
5 votes

Managing IAM security credentials for multiple docker containers

There is this project: https://github.com/dump247/docker-ec2-metadata It acts as a proxy to the instance meta-data endpoint, returning a role specific to the container. I have not used it before, ...
  • 51
5 votes
Accepted

AWS RDS CLI: AccessDenied on CreateDBSnapshot

It is indeed strange, but it appears that the CreateDBSnapshot permission also has to be assigned to the destination snapshot. This policy works: { "Version": "2012-10-17", "Statement": [ ...
5 votes

How can I tell where an Amazon AWS key is being used?

In addition to Cloudtrail, you should enable logging for your S3 buckets. After doing that, AWS will start logging the canonical user ID used to make authenticated requests to S3. Quote from AWS S3 ...
  • 109k
5 votes
Accepted

AWS add option group

I signed up for paid support and here's the answer, in case it helps anyone else. I had to edit the trust policy on the IAM role like so: { "Version": "2012-10-17", "Statement": [{ ...
  • 141
5 votes

What is the permission for a IAM user to create a ECR repository?

I got this error some time back, notice that you have given "containerservicefullaccess" and not "ContainerRegistryFullAccess"
  • 51
5 votes

What is the permission for a IAM user to create a ECR repository?

The required permission is AmazonEC2ContainerRegistryFullAccess
  • 289
5 votes

How to find owner of a aws account with account number

There is no public api for that. You can probably contact your AWS support representative to assist with that.
  • 4,955
5 votes

Restrict access to S3 bucket folders to specific website users? (not using IAM Users)

You certainly will not need a an IAM User for each website user, that's not manageable. The recommended way is to use AWS Cognito for user authentication against your User Pool (i.e. your list of ...
  • 24.2k
5 votes
Accepted

What permissions do I need to access a SQS queue?

First, I would double check my application configuration if it use the proper sqs name/region/account settings. Here is an example what permissions you might need to give to your application to work ...
5 votes

AWS: How to figure out where an explicit deny is coming from?

Your best bet, if you think it's IAM denying you access, is to use the AWS Policy Simulator to figure it out. https://policysim.aws.amazon.com/ Login to the account that has the role you're assuming,...
  • 246
5 votes
Accepted

Is it possible to grant a "read everything" role in AWS?

AWS defines some policies that are available in every account. As new services are added these policies are updated so the policy always has read only access. Some of them are job function policies, ...
  • 31.1k
4 votes

Is it possible to restrict AWS users/accounts to a specific region?

Accepted answer on this thread gave Syntax Error on Policy. Below worked for me: { "Statement": [ { "Sid": "Stmt1375943389569", "Action": "ec2:*", "Effect": "Allow", ...
  • 139
4 votes

Cloudformation can I create a new role referencing an existing policy?

You can achieve this by using managed policies. Put the defined policy that you want to share in a customer managed policy, then attach that defined policy to each role where you want to use it. Any ...
  • 485
4 votes
Accepted

Getting files from an s3 bucket using IAM role credentials

After taking a look at this answer to Using environment properties with files in elastic beanstalk config files I added the following section to the .ebextensions/01_files.config Resources: ...
  • 141
4 votes

Required IAM permissions for ec2.requestSpotInstances?

There is usually a one-to-one correspondence between ec2 API functions and the permissions. So most of what you have in your policy is fine. You need to add the iam:PassRole permission. This is ...
  • 9,864
4 votes
Accepted

Assigning name to IAM Role with cloudformation

Simply provide the RoleName (AWS docs) attribute on your role declaration. yaml: RoleLogicalId: Type: "AWS::IAM::Role" Properties: RoleName: String [...] Note that the documentation ...

Only top scored, non community-wiki answers of a minimum length are eligible