Questions tagged [aws-iam]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
4 views

Allow AWS IAM users with a Path prefix to manage only their own MFA device

I have several AWS IAM users, and I want to enable them to manage their own virtual MFA devices. Most of our IAM users don't have a Path attribute, so this statement works well enough: { "Sid&...
1
vote
1answer
53 views

Force role session name in AWS IAM

I want to enforce users to use their IAM username as the role session name when assuming a role in AWS. I've tried the following condition in IAM policies: { "Effect": "Allow", ...
0
votes
0answers
20 views

S3 Bucket Policy: require KMS for all files except one

I have an S3 bucket that contains sensitive data, so I want to ensure that any objects put into the bucket are encrypted with a specific KMS key. I'm doing this already with a bucket policy statement ...
1
vote
1answer
97 views

How to programmatically enable and disable SQS triggering AWS Lambda?

I have a requirement where I want to stop my lambda from receiving messages from SQS. And I want to implement this like an API which can toggle between the disabling and enabling of the AWS Lambda ...
3
votes
2answers
75 views

AWS Temporary Permission Granting Tool for Account/Service “Firefights”

I'm looking for a service or third party solution that allows for granting temporary access to an IAM user (or group) to one or more services in an AWS account. The example I have is there is an ...
1
vote
1answer
44 views

Cannot configure node group in new EKS cluster due to no Node IAM role found

I've created a new EKS cluster, and am trying to add a new node group to it. I'm stuck on selecting a Node IAM Role from the dropdown. I followed the link, and created all options for roles I could ...
0
votes
2answers
24 views

How do you reference a code commit tag in IAM

If I add a tag to a codecommit repo with code commit => the repo => Settings => repository tags => add tags how do i reference this tag in IAM I have in the policy document a statment i am trying to ...
5
votes
1answer
55 views

Should AWS arn values be treated as secrets?

I have a configuration file that contains AWS resource arn's stored in a Github repo. This includes some arn's of AWS IAM role resources. Should these be treated as if they are a secret value, and not ...
0
votes
2answers
248 views

AWS permissions for Fargate and SSM

I'm trying to create some infrastructure for a service I am building on AWS using AWS Fargate. I'm using SSM as a value store for some of my application configuration, so I need both the regular ...
1
vote
1answer
12 views

AWS Cloudwatch for unused accounts

Is there any possibility for getting a report on unused user accounts using cloudwatch ? Requirement : Need to get a report on the accounts which is unused for more than 30 days.
1
vote
1answer
22 views

Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?

I've created a local development environment for new developers coming to work in the company I work for. One of the microservices running as part of this local development environment requires ...
1
vote
2answers
53 views

How to get the AWS Access key of an already created Access ID

Inside IAM management, I navigate to Users - User and got to the Security Credentials tab, It looks like this: I see no link to show the access key of the already generated access ID, how to get it?
1
vote
1answer
66 views

How can I 'aws s3 sync' two buckets, which are located in different accounts

I'm trying to use 'aws s3 sync' on the awscli between two accounts. Account A, I own. Account B, Owned by a third party. Account B has given a user:jon on account A permission to a bucket through ...
1
vote
1answer
91 views

How to override default aws region credentials for Terraform?

I am using Terraform to create aws resources. I practiced with a single region and with my aws cli credentials being used. worked great! however when I tried to override the region in the Terraform ....
2
votes
3answers
863 views

Find appropriate AWS policy

I have created a user group in AWS ("developers"). Now I want to attach a policy to the group which will grant the users permission to list, create and update Amplify apps. I am struggling to ...
2
votes
2answers
147 views

Cross account access from ec2 to other accounts

Is it possible to run aws cli from ec2 to create some resources in another account without using aws_secret_key and aws_access_key?
0
votes
1answer
32 views

What is a secure way for storing AWS IAM credentials?

When creating a new user in AWS IAM, it generates access keys for that user. Where is a secure and readily accessible location to store these credentials?
0
votes
1answer
292 views

Can Terraform S3 remote state be kept in a different AWS account?

I am currently using Terraform with S3 remote state. The IAM user that I'm using to run Terraform exists in the same AWS account as the S3 bucket holding the remote state files. This is all working ...
0
votes
1answer
28 views

Which S3 buckets is Lambda allowed to read code from?

There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from. With most services in AWS, the usual practice is to define an IAM role that can be ...
4
votes
2answers
465 views

Impact on policy after deleting IAM user

I have created one IAM User named "test" with S3 and Glacier Permission. Now with user "test" i created one life cycle policy to move data from S3 to Glacier at every 5 days. Now, i delete IAM user "...
18
votes
4answers
12k views

What is the purpose of AssumeRolePolicyDocument in IAM?

I'm confused as to what the purpose of AssumeRolePolicyDocument is. It seems like to create a role all you need is a parent name that you can attach policies to. It seems like AssumeRolePolicyDocument ...
4
votes
1answer
709 views

Preventing an IAM user from overriding launch template parameters on RunInstance

I'm trying to set up an IAM policy that allows a user to run an instance (ec2:RunInstances), but only from a specific launch template - and without making any changes to that launch template's ...
3
votes
3answers
3k views

What is the AWS user permission that allows attaching and detaching IAM Roles to instances?

My coworker is trying to attach IAM roles to EC2 instances and doesn’t have permissions. I’m trying to work out which permissions to give him. My question is: What is the AWS user permission that ...
8
votes
5answers
4k views

How to provide a user to access only a particular bucket in AWS S3?

I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a ...
8
votes
1answer
7k views

How to get the ARN for an arbitrary Amazon Resource?

I am creating an AWS IAM policy for a Serverless Framework project, I am applying the Principle of Least Privilege to ensure the policy is as tight as possible. To restrict the scope of the policy I ...