Skip to main content
38 votes
Accepted

Confused by the role requirement of ECS

The only necessary role is the Container Instance IAM role. This role allows the ECS agent (running on your EC2 instance) to communicate with Amazon ECS. There are five other roles that you may also ...
Samuel Karp's user avatar
18 votes

AWS IAM won't let my users change their passwords

I was having the same problem. New users were getting the following error message: Either user is not authorized to perform iam:ChangePassword or entered password does not comply with account ...
Pedro Rodrigues's user avatar
17 votes

Is it possible to restrict AWS users/accounts to a specific region?

Use something like this. This example restricts access to two AWS regions. Modify as needed. { "Version": "2012-10-17", "Statement": [{ "Effect": "Deny", "Action": "*", "Resource": "*"...
sandstrom's user avatar
  • 498
15 votes

Cloudformation can I create a new role referencing an existing policy?

src: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html The AWS::IAM::Role types now have a ManagedPolicyArns field where you can set this. You just need to ...
John Eikenberry's user avatar
14 votes
Accepted

How to know if an AWS IAM role is actually being used

There currently is no method using SDKs for the AWS CLI to get the last accessed time of an IAM role. I confirmed this today with AWS support. Currently, the only way is to use the AWS Management ...
Matt Houser's user avatar
  • 10.3k
11 votes

Why does my created Amazon IAM user get "We can not find an account with that email address" when trying to log in?

Amazon IAM users can't log in through the main Amazon AWS login page. Instead, they need to use a custom login URL which is displayed at the top of your IAM Dashboard page. That link is labeled "IAM ...
Jon Schneider's user avatar
10 votes

Can you require MFA for AWS IAM accounts?

The accepted answer is no longer valid AFAICT. AWS has documented how you can do this through their tutorial article here: https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-...
Gowie47's user avatar
  • 201
9 votes

Is it possible to restrict AWS users/accounts to a specific region?

Since April 25th 2018, AWS has a global resource aws:RequestedRegion you can use to limit the regions a user can send requests to. This is independent of the service being regional or not, so you can ...
jaferrando's user avatar
7 votes
Accepted

AWS add option group

I signed up for paid support and here's the answer, in case it helps anyone else. I had to edit the trust policy on the IAM role like so: { "Version": "2012-10-17", "Statement": [{ ...
nasch's user avatar
  • 171
7 votes

What is the permission for a IAM user to create a ECR repository?

The required permission is AmazonEC2ContainerRegistryFullAccess
Caner's user avatar
  • 309
7 votes

AWS: How to figure out where an explicit deny is coming from?

Your best bet, if you think it's IAM denying you access, is to use the AWS Policy Simulator to figure it out. https://policysim.aws.amazon.com/ Login to the account that has the role you're assuming,...
Shogan's user avatar
  • 266
7 votes

AWS IAM won't let my users change their passwords

I had the same issue, I found out you can exempt actions from having to have mfa: { "Sid": "DenyAllExceptListedIfNoMFA", "Effect": "Deny", "NotAction&...
Philip Rodrigues's user avatar
6 votes
Accepted

Can't access AWS billing data although I have full permissions

By default the AWS billing data is only accessible to the root account and not subject to IAM. In order to share access the root account has to go to the "Account Stettings" and enable "IAM User ...
mschuett's user avatar
  • 3,186
6 votes
Accepted

AWSLambdaExecute policy definition

If your function has nothing to do with S3 then don't use this managed policy. As far as I can see this policy is used in the documentation in combination with a tutorial on how to use Lambda with ...
null's user avatar
  • 268
6 votes

How to find owner of a aws account with account number

There is no public api for that. You can probably contact your AWS support representative to assist with that.
Jason Martin's user avatar
  • 5,113
6 votes
Accepted

how to show an IAM user's roles with 'aws iam'?

IAM User doesn't have IAM Roles, hence you can't list them. IAM User can have IAM Policies (either attached directly or through IAM Group membership) that allow it to assume other roles. You can ...
MLu's user avatar
  • 25.6k
6 votes
Accepted

What permissions do I need to access a SQS queue?

First, I would double check my application configuration if it use the proper sqs name/region/account settings. Here is an example what permissions you might need to give to your application to work ...
Peycho Dimitrov's user avatar
5 votes

What is the permission for a IAM user to create a ECR repository?

I got this error some time back, notice that you have given "containerservicefullaccess" and not "ContainerRegistryFullAccess"
Ranjith's user avatar
  • 51
5 votes

Restrict access to S3 bucket folders to specific website users? (not using IAM Users)

You certainly will not need a an IAM User for each website user, that's not manageable. The recommended way is to use AWS Cognito for user authentication against your User Pool (i.e. your list of ...
MLu's user avatar
  • 25.6k
5 votes
Accepted

AWS IAM Roles: What is a trusted entity exactly?

A trusted entity is which service can assume any given role. If you make EC2 the trusted entity you can't assume the role to use the permissions, lambda can't assume the role, only an EC2 instance. ...
Tim's user avatar
  • 33.1k
5 votes
Accepted

Is it possible to grant a "read everything" role in AWS?

AWS defines some policies that are available in every account. As new services are added these policies are updated so the policy always has read only access. Some of them are job function policies, ...
Tim's user avatar
  • 33.1k
5 votes

Getting "Fargate requires task definition to have execution role ARN to support ECR images." when creating Fargate task but the role is defined

I just encountered this issue and was able to resolve it with AWS. Apparently there is a bug when adding the permissions associated with the IAM Role when using the GUI for task definitions. To ...
Anthony Schanen's user avatar
4 votes
Accepted

Assigning name to IAM Role with cloudformation

Simply provide the RoleName (AWS docs) attribute on your role declaration. yaml: RoleLogicalId: Type: "AWS::IAM::Role" Properties: RoleName: String [...] Note that the documentation ...
Erik Erikson's user avatar
4 votes

Is it possible to restrict AWS users/accounts to a specific region?

Accepted answer on this thread gave Syntax Error on Policy. Below worked for me: { "Statement": [ { "Sid": "Stmt1375943389569", "Action": "ec2:*", "Effect": "Allow", ...
PUG's user avatar
  • 139
4 votes
Accepted

IAM user is not authorized to perform: application-autoscaling:DescribeScalableTargets

I need to add the following custom policy to one of my permission groups { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "application-...
Anthony Kong's user avatar
  • 3,508
4 votes

ElasticBeanstalk permissions needed to deploy new version via AWS CLI

From this guide it looks like you might need S3 access for the elastic beanstalk bucket as well, IE: { "Action": [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:GetObjectAcl", "s3:...
Fletcher Stump Smith's user avatar
4 votes

AWS IAM: Restrict Console Access to only One Instance

Your current policy would work in the AWS-CLI, e.g. aws ec2 stop-instance should work. However to actually use the web console you need a few more read-only permissions because the console tries to ...
MLu's user avatar
  • 25.6k
4 votes

Securely storing AWS access credentials in an on-premise server

One way or another you'll have to have some credentials on the server that will be used to retrieve the AWS keys. At least try to restrict it by IP. Here is one way to do it: Create a dedicated IAM ...
MLu's user avatar
  • 25.6k
4 votes
Accepted

Non-null password_last_used for (supposedly passwordless) AWS root_account?

I think what you are seeing is normal. Root accounts are NOT passwordless. You definitely need a password to log in as root. The root account is the email address you used when you created the ...
kenlukas's user avatar
  • 3,226
3 votes

Is it possible to send email via the amazon ses smtp service with a iam role account?

You can use this project to send SMTP without credentials using IAM role instead https://github.com/loopingz/aws-smtp-relay
Morgan Christiansson's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible