Questions tagged [aws-iam]
The aws-iam tag has no usage guidance.
37 questions
0
votes
0
answers
16
views
Building Infra on AWS using terraform for a multiaccount project
Building Infra on AWS using Terraform for a multiaccount project, where I need to build some eks, vpcs, rds, elastic cache and cross functional roles , I am roles and all other required components. ...
- 11
0
votes
0
answers
22
views
IAM to limit RDS sharing to certain accounts
I have a multi-account AWS setup. I'm running an automatic weekly process that takes a database snapshot and shares it from Account A to Account B. For this, I'd like to ensure that the IAM role (that ...
- 1
0
votes
1
answer
24
views
Why does AWS wrap roles with instance profiles?
In AWS EC2, a machine is assigned privileges using instance profiles. Specifically:
the desired permissions are articulated as an IAM policy,
that policy is attached to an IAM role,
that role is ...
- 309
0
votes
1
answer
696
views
"An unknown error occurred" when authenticating between GitHub Actions and AWS using OIDC
I was unable to successfully authenticate when attempting to create a GitHub Actions workflow that would authenticate with an AWS IAM Identity Provider (IdP) using Open ID Connect (OIDC), based on ...
- 111
0
votes
1
answer
2k
views
IAM Permissions issue in API Gateway Deployment
AWS threw a below error saying the user doesn't have access to apigateway:TagResource permission, but when I checklist of available permissions in the IAM console, I'm not able to find any such ...
- 103
3
votes
2
answers
1k
views
Does an AWS service automatically assume a needed IAM role?
Suppose I create a role with AssumeRolePolicyDocument allowing an AWS service (e.g. s3.amazonaws.com) to assume the role - do I need to in some way tell the service to assume the role, or will it ...
- 131
2
votes
1
answer
194
views
Does the AWS Admin user have the eks:AccessKubernetesApi permission?
I am logged in to AWS as the AWS Admin, with Administrator access.
How do I find out if this user has the eks:AccessKubernetesApi IAM permission?
- 195
1
vote
1
answer
356
views
How to avoid disclosing account ID in AWS ARN
I'm new to the AWS ecosystem and have what might be a naive question. While trying to create a GlueRunner Lambda stack with CloudFormation (using pynt), from the Cloud9 shell of an account with all ...
- 111
1
vote
1
answer
549
views
What is the proper AWS IAM policy for access to a single bucket that allows stacking?
I am working on a buildout where I am doing the following. Eventually I will need to make this scalable so I am not doing this manually each time.
I have several clients dumping data into S3 buckets. ...
- 131
2
votes
0
answers
201
views
AWS SSO using Azure Active Directory and AWS IAM
I'm trying to create a flow where users can be authenticated to AWS Console using Aure Active Directory Credentials, and the access of their accounts can be managed using IAM.
I have connected AWS SSO ...
- 33
1
vote
1
answer
7k
views
Terraform: add to existing AWS policy, or create policy if needed
Several of our terraform root modules need add to an existing policy that provides read-only permissions for S3 buckets -- each module has its own bucket. I cannot figure out how to add to the ...
- 113
2
votes
1
answer
884
views
What are minimum permissions required for an IAM user to provision EC2 instances?
I want to provision an EC2 instance with Ansible. So for that purpose I want to create a separate IAM user to keep things clear.
I can assign the full EC2 access to the user. But I don't want any ...
- 151
1
vote
2
answers
2k
views
ansible & jinja2: How to reference JSON structure items whose keys are variables?
I am using ansible's community.aws.iam_server_certificate_info module to get information about a server certificate on aws ec2, and registering it as a variable "server_cert_info_result"
...
- 170
1
vote
1
answer
819
views
What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?
AWS supports IAM Roles for Service Accounts (IRSA) that allows cluster operators to map AWS IAM Roles to Kubernetes Service Accounts.
To do so, one has to create an iamserviceaccount in an EKS cluster:...
- 155
2
votes
1
answer
916
views
Force role session name in AWS IAM
I want to enforce users to use their IAM username as the role session name when assuming a role in AWS. I've tried the following condition in IAM policies:
{
"Effect": "Allow",
...
- 121
1
vote
1
answer
6k
views
How to programmatically enable and disable SQS triggering AWS Lambda?
I have a requirement where I want to stop my lambda from receiving messages from SQS. And I want to implement this like an API which can toggle between the disabling and enabling of the AWS Lambda ...
- 144
3
votes
2
answers
247
views
AWS Temporary Permission Granting Tool for Account/Service "Firefights"
I'm looking for a service or third party solution that allows for granting temporary access to an IAM user (or group) to one or more services in an AWS account.
The example I have is there is an ...
- 3,278
5
votes
1
answer
4k
views
Cannot configure node group in new EKS cluster due to no Node IAM role found
I've created a new EKS cluster, and am trying to add a new node group to it.
I'm stuck on selecting a Node IAM Role from the dropdown.
I followed the link, and created all options for roles I could ...
- 153
0
votes
2
answers
186
views
How do you reference a code commit tag in IAM
If I add a tag to a codecommit repo with
code commit => the repo => Settings => repository tags => add tags
how do i reference this tag in IAM
I have in the policy document a statment i am trying to ...
- 523
13
votes
1
answer
7k
views
Should AWS arn values be treated as secrets?
I have a configuration file that contains AWS resource ARNs stored in a git repo. This includes some ARNs of AWS IAM role resources. Should these be treated as if they are a secret value, and not ...
- 3,278
0
votes
2
answers
890
views
AWS permissions for Fargate and SSM
I'm trying to create some infrastructure for a service I am building on AWS using AWS Fargate. I'm using SSM as a value store for some of my application configuration, so I need both the regular ...
- 141
1
vote
1
answer
36
views
AWS Cloudwatch for unused accounts
Is there any possibility for getting a report on unused user accounts using cloudwatch ?
Requirement : Need to get a report on the accounts which is unused for more than 30 days.
1
vote
1
answer
127
views
Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?
I've created a local development environment for new developers coming to work in the company I work for.
One of the microservices running as part of this local development environment requires ...
- 390
1
vote
2
answers
621
views
How to get the AWS Access key of an already created Access ID
Inside IAM management, I navigate to Users - User and got to the Security Credentials tab, It looks like this:
I see no link to show the access key of the already generated access ID, how to get it?
- 187
1
vote
1
answer
856
views
How can I 'aws s3 sync' two buckets, which are located in different accounts
I'm trying to use 'aws s3 sync' on the awscli between two accounts.
Account A, I own.
Account B, Owned by a third party.
Account B has given a user:jon on account A permission to a bucket through ...
- 11
1
vote
1
answer
561
views
How to override default aws region credentials for Terraform?
I am using Terraform to create aws resources. I practiced with a single region and with my aws cli credentials being used. worked great!
however when I tried to override the region in the Terraform ....
- 56
2
votes
3
answers
2k
views
Find appropriate AWS policy
I have created a user group in AWS ("developers"). Now I want to attach a policy to the group which will grant the users permission to list, create and update Amplify apps. I am struggling to ...
2
votes
2
answers
2k
views
Cross account access from ec2 to other accounts
Is it possible to run aws cli from ec2 to create some resources in another account without using aws_secret_key and aws_access_key?
- 23
0
votes
3
answers
158
views
What is a secure way for storing AWS IAM credentials?
When creating a new user in AWS IAM, it generates access keys for that user. Where is a secure and readily accessible location to store these credentials?
- 559
0
votes
1
answer
2k
views
Can Terraform S3 remote state be kept in a different AWS account?
I am currently using Terraform with S3 remote state. The IAM user that I'm using to run Terraform exists in the same AWS account as the S3 bucket holding the remote state files. This is all working ...
- 351
0
votes
1
answer
86
views
Which S3 buckets is Lambda allowed to read code from?
There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from.
With most services in AWS, the usual practice is to define an IAM role that can be ...
- 351
4
votes
2
answers
981
views
Impact on policy after deleting IAM user
I have created one IAM User named "test" with S3 and Glacier Permission.
Now with user "test" i created one life cycle policy to move data from S3 to Glacier at every 5 days.
Now, i delete IAM user "...
- 1,014
37
votes
4
answers
36k
views
What is the purpose of AssumeRolePolicyDocument in IAM?
I'm confused as to what the purpose of AssumeRolePolicyDocument is.
It seems like to create a role all you need is a parent name that you can attach policies to.
It seems like AssumeRolePolicyDocument ...
- 605
4
votes
1
answer
2k
views
Preventing an IAM user from overriding launch template parameters on RunInstance
I'm trying to set up an IAM policy that allows a user to run an instance (ec2:RunInstances), but only from a specific launch template - and without making any changes to that launch template's ...
- 1,245
3
votes
3
answers
4k
views
What is the AWS user permission that allows attaching and detaching IAM Roles to instances?
My coworker is trying to attach IAM roles to EC2 instances and doesn’t have permissions. I’m trying to work out which permissions to give him.
My question is: What is the AWS user permission that ...
- 1,153
8
votes
5
answers
8k
views
How to provide a user to access only a particular bucket in AWS S3?
I have a list of buckets in AWS S3. I have created an IAM user. I have an option to provide S3 full or read only access for a user using groups. Is there any options to provide access only to a ...
8
votes
1
answer
9k
views
How to get the ARN for an arbitrary Amazon Resource?
I am creating an AWS IAM policy for a Serverless Framework project, I am applying the Principle of Least Privilege to ensure the policy is as tight as possible. To restrict the scope of the policy I ...
- 11.7k