I have a dozen instances and lambdas, most of which are not publicly accessible. There are several dozen developers. Everything is currently managed by terraform.

I would like to restrict access to private aws instances (like ec2) so that only other instances or certain developers can access them (or invoke in the case of lambda). In other words, I do not want all developers or all instances to have access to all other running instances.

I would like to implement some kind of access control with an audit trail.

As far as developers, it seems the most common solution is simply to use different AWS accounts. Every developer has access to testing, but only a few have access to "production".

That said, there is no record of which developer might access any service this way. Any of the team of the "production" developers might manually hit some endpoints of our private services and we wouldn't know who it was for audit purposes. It's one thing to delete an AWS resource (AWS will record that) - it's another to submit a HTTP DELETE to some internal service.

It seems the solution to limit access between services can be security groups or a NACL for all instances even those that are added dynamically by auto-scaling.

  • Have devs using different IAM users.
    – gshpychka
    Aug 30 '21 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.