Questions tagged [aws-iam]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2 votes
1 answer
46 views

Does an AWS service automatically assume a needed IAM role?

Suppose I create a role with AssumeRolePolicyDocument allowing an AWS service (e.g. s3.amazonaws.com) to assume the role - do I need to in some way tell the service to assume the role, or will it ...
user avatar
2 votes
1 answer
37 views

Does the AWS Admin user have the eks:AccessKubernetesApi permission?

I am logged in to AWS as the AWS Admin, with Administrator access. How do I find out if this user has the eks:AccessKubernetesApi IAM permission?
user avatar
  • 163
0 votes
0 answers
94 views

Why do I get permission denied uploading to an AWS Transfer Family SFTP server?

I have an AWS Elastic File System that I'm attempting to get access to via AWS Transfer Family. I have created a transfer family with sFTP protocol enabled and one user. I am able to connect to the ...
user avatar
  • 101
0 votes
1 answer
73 views

How to avoid disclosing account ID in AWS ARN

I'm new to the AWS ecosystem and have what might be a naive question. While trying to create a GlueRunner Lambda stack with CloudFormation (using pynt), from the Cloud9 shell of an account with all ...
user avatar
1 vote
1 answer
42 views

What is the proper AWS IAM policy for access to a single bucket that allows stacking?

I am working on a buildout where I am doing the following. Eventually I will need to make this scalable so I am not doing this manually each time. I have several clients dumping data into S3 buckets. ...
user avatar
  • 131
1 vote
0 answers
26 views

AWS SSO using Azure Active Directory and AWS IAM

I'm trying to create a flow where users can be authenticated to AWS Console using Aure Active Directory Credentials, and the access of their accounts can be managed using IAM. I have connected AWS SSO ...
user avatar
  • 23
0 votes
1 answer
664 views

Terraform: add to existing AWS policy, or create policy if needed

Several of our terraform root modules need add to an existing policy that provides read-only permissions for S3 buckets -- each module has its own bucket. I cannot figure out how to add to the ...
user avatar
2 votes
1 answer
47 views

What are minimum permissions required for an IAM user to provision EC2 instances?

I want to provision an EC2 instance with Ansible. So for that purpose I want to create a separate IAM user to keep things clear. I can assign the full EC2 access to the user. But I don't want any ...
user avatar
0 votes
0 answers
16 views

Restricting one module for one tf file

So I have file called main.tf in which I am calling the existing module for iam_role, but in same main.tf I have called one more module for service_role but I want to restrict that service_role module ...
user avatar
  • 1
0 votes
0 answers
19 views

How to limit access to internal AWS instances by other services and developers?

I have a dozen instances and lambdas, most of which are not publicly accessible. There are several dozen developers. Everything is currently managed by terraform. I would like to restrict access to ...
user avatar
  • 101
1 vote
2 answers
494 views

ansible & jinja2: How to reference JSON structure items whose keys are variables?

I am using ansible's community.aws.iam_server_certificate_info module to get information about a server certificate on aws ec2, and registering it as a variable "server_cert_info_result" ...
user avatar
1 vote
1 answer
489 views

What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?

AWS supports IAM Roles for Service Accounts (IRSA) that allows cluster operators to map AWS IAM Roles to Kubernetes Service Accounts. To do so, one has to create an iamserviceaccount in an EKS cluster:...
user avatar
  • 155
1 vote
1 answer
412 views

Force role session name in AWS IAM

I want to enforce users to use their IAM username as the role session name when assuming a role in AWS. I've tried the following condition in IAM policies: { "Effect": "Allow", ...
user avatar
  • 111
1 vote
1 answer
2k views

How to programmatically enable and disable SQS triggering AWS Lambda?

I have a requirement where I want to stop my lambda from receiving messages from SQS. And I want to implement this like an API which can toggle between the disabling and enabling of the AWS Lambda ...
user avatar
3 votes
2 answers
153 views

AWS Temporary Permission Granting Tool for Account/Service "Firefights"

I'm looking for a service or third party solution that allows for granting temporary access to an IAM user (or group) to one or more services in an AWS account. The example I have is there is an ...
user avatar
  • 2,993
3 votes
1 answer
1k views

Cannot configure node group in new EKS cluster due to no Node IAM role found

I've created a new EKS cluster, and am trying to add a new node group to it. I'm stuck on selecting a Node IAM Role from the dropdown. I followed the link, and created all options for roles I could ...
user avatar
  • 133
0 votes
2 answers
120 views

How do you reference a code commit tag in IAM

If I add a tag to a codecommit repo with code commit => the repo => Settings => repository tags => add tags how do i reference this tag in IAM I have in the policy document a statment i am trying to ...
user avatar
  • 463
9 votes
1 answer
1k views

Should AWS arn values be treated as secrets?

I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not ...
user avatar
  • 2,993
0 votes
2 answers
658 views

AWS permissions for Fargate and SSM

I'm trying to create some infrastructure for a service I am building on AWS using AWS Fargate. I'm using SSM as a value store for some of my application configuration, so I need both the regular ...
user avatar
  • 141
1 vote
1 answer
18 views

AWS Cloudwatch for unused accounts

Is there any possibility for getting a report on unused user accounts using cloudwatch ? Requirement : Need to get a report on the accounts which is unused for more than 30 days.
user avatar
1 vote
1 answer
55 views

Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?

I've created a local development environment for new developers coming to work in the company I work for. One of the microservices running as part of this local development environment requires ...
user avatar
1 vote
2 answers
90 views

How to get the AWS Access key of an already created Access ID

Inside IAM management, I navigate to Users - User and got to the Security Credentials tab, It looks like this: I see no link to show the access key of the already generated access ID, how to get it?
user avatar
  • 187
1 vote
1 answer
364 views

How can I 'aws s3 sync' two buckets, which are located in different accounts

I'm trying to use 'aws s3 sync' on the awscli between two accounts. Account A, I own. Account B, Owned by a third party. Account B has given a user:jon on account A permission to a bucket through ...
user avatar
1 vote
1 answer
240 views

How to override default aws region credentials for Terraform?

I am using Terraform to create aws resources. I practiced with a single region and with my aws cli credentials being used. worked great! however when I tried to override the region in the Terraform ....
user avatar
2 votes
3 answers
1k views

Find appropriate AWS policy

I have created a user group in AWS ("developers"). Now I want to attach a policy to the group which will grant the users permission to list, create and update Amplify apps. I am struggling to ...
user avatar
2 votes
2 answers
594 views

Cross account access from ec2 to other accounts

Is it possible to run aws cli from ec2 to create some resources in another account without using aws_secret_key and aws_access_key?
user avatar
  • 23
0 votes
3 answers
63 views

What is a secure way for storing AWS IAM credentials?

When creating a new user in AWS IAM, it generates access keys for that user. Where is a secure and readily accessible location to store these credentials?
user avatar
  • 419
0 votes
1 answer
948 views

Can Terraform S3 remote state be kept in a different AWS account?

I am currently using Terraform with S3 remote state. The IAM user that I'm using to run Terraform exists in the same AWS account as the S3 bucket holding the remote state files. This is all working ...
user avatar
  • 301
0 votes
1 answer
32 views

Which S3 buckets is Lambda allowed to read code from?

There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from. With most services in AWS, the usual practice is to define an IAM role that can be ...
user avatar
  • 301
4 votes
2 answers
623 views

Impact on policy after deleting IAM user

I have created one IAM User named "test" with S3 and Glacier Permission. Now with user "test" i created one life cycle policy to move data from S3 to Glacier at every 5 days. Now, i delete IAM user "...
user avatar
  • 854
29 votes
4 answers
24k views

What is the purpose of AssumeRolePolicyDocument in IAM?

I'm confused as to what the purpose of AssumeRolePolicyDocument is. It seems like to create a role all you need is a parent name that you can attach policies to. It seems like AssumeRolePolicyDocument ...
user avatar
4 votes
1 answer
1k views

Preventing an IAM user from overriding launch template parameters on RunInstance

I'm trying to set up an IAM policy that allows a user to run an instance (ec2:RunInstances), but only from a specific launch template - and without making any changes to that launch template's ...
user avatar
  • 1,055
3 votes
3 answers
4k views

What is the AWS user permission that allows attaching and detaching IAM Roles to instances?

My coworker is trying to attach IAM roles to EC2 instances and doesn’t have permissions. I’m trying to work out which permissions to give him. My question is: What is the AWS user permission that ...
user avatar
  • 1,083
8 votes
5 answers
7k views

How to provide a user to access only a particular bucket in AWS S3?

I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a ...
user avatar
8 votes
1 answer
8k views

How to get the ARN for an arbitrary Amazon Resource?

I am creating an AWS IAM policy for a Serverless Framework project, I am applying the Principle of Least Privilege to ensure the policy is as tight as possible. To restrict the scope of the policy I ...
user avatar