32
The only necessary role is the Container Instance IAM role. This role allows the ECS agent (running on your EC2 instance) to communicate with Amazon ECS.
There are five other roles that you may also find useful, for different purposes:
ECS Service-Linked role (SLR) - This role enables Amazon ECS to manage a variety of AWS resources associated with your ...
25
When crafting Amazon IAM policies for Amazon S3, you need to be aware of the difference between Operations on the Service (e.g. ListAllMyBuckets), Operations on Buckets (e.g. ListBucket) and Operations on Objects (e.g. GetObject).
In particular, the Resource specification of your policy needs to address the appropriate target entities according to the ...
25
Unfortunately you can't do this globally. However, for each AWS product that supports it, you typically can limit access to a certain region.
For instance, for EC2, you can do the following:
{
"Statement":[{
"Effect":"allow",
"Action":"RunInstances",
"Resource":"*",
"Condition":{
"StringEquals":{
"ec2:Region":"us-west-1"
...
24
Update
Mike Pope has published a nice article about Granting Permission to Launch EC2 Instances with IAM Roles (PassRole Permission) on the AWS Security Blog, which explains the subject matter from an AWS point of view.
Initial Answer
Skaperen's answer is partially correct (+1), but slightly imprecise/misleading as follows (the explanation seems a bit too ...
22
The Amazon CloudWatch Monitoring Scripts for Linux are comprised of two Perl scripts, both using one Perl module - a short peek into the source reveals the following AWS API actions being used:
CloudWatchClient.pm - DescribeTags
mon-get-instance-stats.pl - GetMetricStatistics, ListMetrics
mon-put-instance-data.pl - PutMetricData
With this information you ...
15
For this to work, you need to explicitly ALLOW the following:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1392679134000",
"Effect": "Allow",
"Action": [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateSecurityGroup",
"ec2:DeleteSecurityGroup",
"...
14
If you want to limit editing to a single security group, I think that you need 2 statements, the following worked for me:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1413232782000",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstanceAttribute",
"...
14
src: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html
The AWS::IAM::Role types now have a ManagedPolicyArns field where you can set this. You just need to grab the ARN (easy to grab from IAM console) and place it in that field. In the example below I created a role that provides read-only ECR access so my image can ...
13
The answer is yes, there is. By using a condition. For instance, for admin accounts:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*",
"Condition":
{
"Null":{"aws:MultiFactorAuthAge":"false"}
}
}
]
}
It will enforce MFA for both password authentication ...
13
One way you could do this is make a new zone that's a subdomain of the main domain, like stuff.example.com and delegate the subdomain's NS to that secondary zone. Give them IAM privileges to that subdomain's zone and they'd be able to create subdomains like my.stuff.example.com. For records that you want to be first-class citizens, you could CNAME my.example....
13
Use something like this. This example restricts access to two AWS regions. Modify as needed.
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": [
"eu-central-1",
"eu-west-1"
]
}
}
}]
}
12
Amazon IAM users can't log in through the main Amazon AWS login page.
Instead, they need to use a custom login URL which is displayed at the top of your IAM Dashboard page. That link is labeled "IAM users sign-in link", and is of the form:
https://AWS-account-ID-or-alias.signin.aws.amazon.com/console
Using that account-specific IAM login form, the user ...
10
There currently is no method using SDKs for the AWS CLI to get the last accessed time of an IAM role. I confirmed this today with AWS support.
Currently, the only way is to use the AWS Management Console.
Select your IAM role
Click the "Access Advisor" tab.
The contents of this tab will display the last access time for each of the various services (S3, EC2,...
9
Since April 25th 2018, AWS has a global resource aws:RequestedRegion you can use to limit the regions a user can send requests to. This is independent of the service being regional or not, so you can apply it to all services.
AWS Security Blog
Unfortunately you can't use this in an organization's Service Control Policy to apply it to an account globally, ...
9
I was having the same problem. New users were getting the following error message:
Either user is not authorized to perform iam:ChangePassword or entered
password does not comply with account password policy set by
administrator
This despite the "Allow users to change their own password" option being set. Explicitly adding the iam:ChangePassword ...
7
The accepted answer is no longer valid AFAICT. AWS has documented how you can do this through their tutorial article here:
https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html
I followed that for my new AWS Account and Team and it worked great.
7
I had the chance to ask this question to a couple of aws solutions architect at the last amazon aws conference and they confirmed me is not possible. IAM or better Route53 does not have that level of granularity.
7
As wisely posted at How can I limit EC2 describe images permissions, resource level permissions are not implemented at all on ec2:Describe* actions.
In Reality you need to limit access based on other things and not the resource ARN.
7
I was getting 'Forbidden' as the response to './ec2.py --list'. It looks like a bug when not using RDS and a query request to describe RDS resources is made (as is the default with this plugin).
Just disable the request in ec2.ini like this:
rds = False
6
You can create AWS Lambda function that make this change (only for this single record) and make an invocation policy for this function.
6
Unfortunately AWS Identity and Access Management (IAM) doesn't fully cover this particular aspect as of today, because the recently introduced Resource-Level Permissions for EC2 and RDS Resources are not yet available for all API actions, see this note from Amazon Resource Names for Amazon EC2:
Important Currently, not all API actions support individual ...
6
Basically, the IAM documentation is totally unreliable when it comes to doing anything other than set global admin or read-only policies.
This is the policy I eventually got to work (for the subnet bit at least):
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Deny",
"Action": "ec2:RunInstances",
"Resource": [
"arn:...
6
If not using ElasticCache you have to set that to False as well. So uncomment
elasticache = False
6
If your function has nothing to do with S3 then don't use this managed policy. As far as I can see this policy is used in the documentation in combination with a tutorial on how to use Lambda with Amazon S3.
Source: https://docs.aws.amazon.com/lambda/latest/dg/with-s3-example-create-iam-role.html
If you want to use a managed policy I recommend using ...
6
Yes, this is absolutely possible with IAM, using the Condition element. The Condition element lets you build expressions in which you can use Boolean operators to match against a condition, which in your case will be a resource with a specific tag.
For example, if you tag all the application B resources with "GroupB", the below IAM policy will restrict a ...
6
By default the AWS billing data is only accessible to the root account and not subject to IAM. In order to share access the root account has to go to the "Account Stettings" and enable "IAM User Access to Billing Information".
5
There is this project: https://github.com/dump247/docker-ec2-metadata
It acts as a proxy to the instance meta-data endpoint, returning a role specific to the container. I have not used it before, but it seems to solve the use-case you are describing.
5
In addition to Cloudtrail, you should enable logging for your S3 buckets. After doing that, AWS will start logging the canonical user ID used to make authenticated requests to S3.
Quote from AWS S3 Docs on logging fields:
The canonical user ID of the requester, or the string "Anonymous" for
unauthenticated requests. If the requester was an IAM user, ...
5
There is no public api for that. You can probably contact your AWS support representative to assist with that.
5
You certainly will not need a an IAM User for each website user, that's not manageable.
The recommended way is to use AWS Cognito for user authentication against your User Pool (i.e. your list of users in your database). Cognito will handle the login, logout, password reset, etc on your behalf and once the user is authenticated it will be issued a set of ...
Only top voted, non community-wiki answers of a minimum length are eligible