We have one AWS account in which an Ec2 instance is running where Jenkins is installed, and we have attached an IAM role to it, with s3 access permission.
We have Jenkins jobs which needed aws permissions, specific to generic ones like either Lambda or CodeCommit and some jobs needed sensitive ones like getParameters and ssh.
By searching through many forums and articles everone has suggested to attach these permissions to the IAM role which is attached to that EC2 instance.
So my concerns are..
- Any user who access the server will also have access to getParameters and they can retrieve information through CLI command.
- If one Job needs getParameters access, but other job doesn't, can we restrict these permission to individual jobs?
- Till now I thought of creating new roles in AWS, specific to jobs grouping specific permission and using them through Assume role to use in a Jenkin job. But I was not able to find any topic regarding that since Assume role will switch the current role in Ec2, which I assume but not sure, since I tested once and failed to execute the job.
And also I read a lot of articles about cross account role access, which I can't do since I have only one account.
So, Is there any way that I can use a role(created in the same aws account as the EC2 attached role) temporarily in each a job?
- What is the best practice If I want to implement the same. As I also thought of grouping the permissions based on severity basis(from generic to sensitive), and give permission to particular job using a role?
Please let me know If anyone has applied above process and kindly suggest if any other way is possible, if above process cannot be applied. Thanks.