34
votes
Accepted
Confused by the role requirement of ECS
The only necessary role is the Container Instance IAM role. This role allows the ECS agent (running on your EC2 instance) to communicate with Amazon ECS.
There are five other roles that you may also ...
- 766
17
votes
Is it possible to restrict AWS users/accounts to a specific region?
Use something like this. This example restricts access to two AWS regions. Modify as needed.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*"...
- 498
15
votes
AWS IAM won't let my users change their passwords
I was having the same problem. New users were getting the following error message:
Either user is not authorized to perform iam:ChangePassword or entered
password does not comply with account ...
- 250
14
votes
Cloudformation can I create a new role referencing an existing policy?
src: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
The AWS::IAM::Role types now have a ManagedPolicyArns field where you can set this. You just need to ...
- 344
12
votes
Why does my created Amazon IAM user get "We can not find an account with that email address" when trying to log in?
Amazon IAM users can't log in through the main Amazon AWS login page.
Instead, they need to use a custom login URL which is displayed at the top of your IAM Dashboard page. That link is labeled "IAM ...
- 303
10
votes
Can you require MFA for AWS IAM accounts?
The accepted answer is no longer valid AFAICT. AWS has documented how you can do this through their tutorial article here:
https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-...
- 201
10
votes
Accepted
How to know if an AWS IAM role is actually being used
There currently is no method using SDKs for the AWS CLI to get the last accessed time of an IAM role. I confirmed this today with AWS support.
Currently, the only way is to use the AWS Management ...
- 9,864
9
votes
Is it possible to restrict AWS users/accounts to a specific region?
Since April 25th 2018, AWS has a global resource aws:RequestedRegion you can use to limit the regions a user can send requests to. This is independent of the service being regional or not, so you can ...
- 91
7
votes
Amazon Route 53, restrict IAM user access to single record set
You can create AWS Lambda function that make this change (only for this single record) and make an invocation policy for this function.
- 79
7
votes
Ansible AWS dynamic inventory: `./ec2.py --list` unauthorized
I was getting 'Forbidden' as the response to './ec2.py --list'. It looks like a bug when not using RDS and a query request to describe RDS resources is made (as is the default with this plugin).
Just ...
7
votes
Create an AWS IAM policy that only allows resources to be created within a certain resource group?
Yes, this is absolutely possible with IAM, using the Condition element. The Condition element lets you build expressions in which you can use Boolean operators to match against a condition, which in ...
- 477
6
votes
Ansible AWS dynamic inventory: `./ec2.py --list` unauthorized
If not using ElasticCache you have to set that to False as well. So uncomment
elasticache = False
- 181
6
votes
Accepted
AWSLambdaExecute policy definition
If your function has nothing to do with S3 then don't use this managed policy. As far as I can see this policy is used in the documentation in combination with a tutorial on how to use Lambda with ...
- 268
6
votes
Accepted
Can't access AWS billing data although I have full permissions
By default the AWS billing data is only accessible to the root account and not subject to IAM. In order to share access the root account has to go to the "Account Stettings" and enable "IAM User ...
- 3,106
5
votes
Managing IAM security credentials for multiple docker containers
There is this project: https://github.com/dump247/docker-ec2-metadata
It acts as a proxy to the instance meta-data endpoint, returning a role specific to the container. I have not used it before, ...
- 51
5
votes
Accepted
AWS RDS CLI: AccessDenied on CreateDBSnapshot
It is indeed strange, but it appears that the CreateDBSnapshot permission also has to be assigned to the destination snapshot.
This policy works:
{
"Version": "2012-10-17",
"Statement": [
...
- 841
5
votes
How can I tell where an Amazon AWS key is being used?
In addition to Cloudtrail, you should enable logging for your S3 buckets. After doing that, AWS will start logging the canonical user ID used to make authenticated requests to S3.
Quote from AWS S3 ...
- 109k
5
votes
Accepted
AWS add option group
I signed up for paid support and here's the answer, in case it helps anyone else. I had to edit the trust policy on the IAM role like so:
{
"Version": "2012-10-17",
"Statement":
[{
...
- 141
5
votes
What is the permission for a IAM user to create a ECR repository?
I got this error some time back, notice that you have given "containerservicefullaccess" and not "ContainerRegistryFullAccess"
- 51
5
votes
What is the permission for a IAM user to create a ECR repository?
The required permission is AmazonEC2ContainerRegistryFullAccess
- 289
5
votes
How to find owner of a aws account with account number
There is no public api for that. You can probably contact your AWS support representative to assist with that.
- 4,955
5
votes
Restrict access to S3 bucket folders to specific website users? (not using IAM Users)
You certainly will not need a an IAM User for each website user, that's not manageable.
The recommended way is to use AWS Cognito for user authentication against your User Pool (i.e. your list of ...
- 24.2k
5
votes
Accepted
What permissions do I need to access a SQS queue?
First, I would double check my application configuration if it use the proper sqs name/region/account settings.
Here is an example what permissions you might need to give to your application to work ...
- 1,038
5
votes
AWS: How to figure out where an explicit deny is coming from?
Your best bet, if you think it's IAM denying you access, is to use the AWS Policy Simulator to figure it out.
https://policysim.aws.amazon.com/
Login to the account that has the role you're assuming,...
- 246
5
votes
Accepted
Is it possible to grant a "read everything" role in AWS?
AWS defines some policies that are available in every account. As new services are added these policies are updated so the policy always has read only access. Some of them are job function policies, ...
- 31.1k
4
votes
Is it possible to restrict AWS users/accounts to a specific region?
Accepted answer on this thread gave Syntax Error on Policy. Below worked for me:
{
"Statement": [
{
"Sid": "Stmt1375943389569",
"Action": "ec2:*",
"Effect": "Allow",
...
- 139
4
votes
Cloudformation can I create a new role referencing an existing policy?
You can achieve this by using managed policies. Put the defined policy that you want to share in a customer managed policy, then attach that defined policy to each role where you want to use it. Any ...
- 485
4
votes
Accepted
Getting files from an s3 bucket using IAM role credentials
After taking a look at this answer to Using environment properties with files in elastic beanstalk config files I added the following section to the .ebextensions/01_files.config
Resources:
...
- 141
4
votes
Required IAM permissions for ec2.requestSpotInstances?
There is usually a one-to-one correspondence between ec2 API functions and the permissions. So most of what you have in your policy is fine.
You need to add the iam:PassRole permission. This is ...
- 9,864
4
votes
Accepted
Assigning name to IAM Role with cloudformation
Simply provide the RoleName (AWS docs) attribute on your role declaration.
yaml:
RoleLogicalId:
Type: "AWS::IAM::Role"
Properties:
RoleName: String
[...]
Note that the documentation ...
- 156
Only top scored, non community-wiki answers of a minimum length are eligible