2022 Developer Survey is open! Take survey.

Hot answers tagged

13 votes
Accepted

What is the purpose of AssumeRolePolicyDocument in IAM?

The purpose of the AssumeRolePolicyDocument is to contain the trust relationship policy that grants an entity permission to assume the role. In your example it's granting the Lambda service the ...
user avatar
  • 580
10 votes
Accepted

Should AWS arn values be treated as secrets?

Well, from a security point of view, it's never bad to give people less information. But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered ...
user avatar
10 votes
Accepted

How to provide a user to access only a particular bucket in AWS S3?

Amazon's IAM roles generally grant a role access to a particular ARN (Amazon Resource Name). Amazon notes on their pages that for S3 a resource ...can be a bucket-name or a bucket-name/object-key. ...
user avatar
  • 3,655
10 votes

What is the purpose of AssumeRolePolicyDocument in IAM?

For anyone who is scratching their head at the naming convention: AssumeRolePolicyDocument (in CloudFormation yaml) = Trust Relationships (in AWS Console web GUI) Policies (in CloudFormation yaml) = ...
user avatar
8 votes

What is the purpose of AssumeRolePolicyDocument in IAM?

The purpose of assume role policy document is to grants an IAM entity permission to assume a role. It is also known as a "role trust policy". In other words, for given permissions you set, it allow ...
user avatar
  • 7,011
5 votes
Accepted

How to get the ARN for an arbitrary Amazon Resource?

https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html lists the schema for (I believe) all of the ARNs that Amazon supports. Text in italic red indicates where you should ...
user avatar
5 votes
Accepted

What is the AWS user permission that allows attaching and detaching IAM Roles to instances?

From Granting a User Permissions to Pass a Role to an AWS Service: To pass a role (and its permissions) to an AWS service, a user must have permissions to pass the role to the service. This helps ...
user avatar
5 votes
Accepted

Cannot configure node group in new EKS cluster due to no Node IAM role found

This is actually pretty well described in the docs. Before you create worker nodes, you must create an IAM role with the following IAM policies: AmazonEKSWorkerNodePolicy AmazonEKS_CNI_Policy ...
user avatar
  • 604
4 votes
Accepted

Impact on policy after deleting IAM user

S3 Life cycle policy will remain and working as it is. When you use the AWS Management Console to delete an IAM user, IAM automatically deletes the following information for user: The user Any ...
user avatar
  • 1,341
4 votes

Impact on policy after deleting IAM user

The policy will still exist. The documentation lists what is deleted when a user is deleted, any resources that the user has created will persist.
user avatar
  • 1,082
4 votes
Accepted

How to get the AWS Access key of an already created Access ID

Access Key is that AKIA... one. What you need is a Secret Key - that can't be recovered after the initial setup. Since you have never used this particular access key (it says "Last used: N/A") it's ...
user avatar
  • 971
3 votes
Accepted

Cross account access from ec2 to other accounts

Supposing the scenario with two accounts A & B the explanatory steps should be: In account A, I created a role (e.g RoleForB) to trust account B, and attach to the before created role a IAM ...
user avatar
3 votes
Accepted

Terraform: add to existing AWS policy, or create policy if needed

This is not a good way to go about this, terraform is a declarative language and you should always follow this principle. Either terraform is managing a resource or terraform is querying an existing ...
user avatar
  • 345
2 votes

How to provide a user to access only a particular bucket in AWS S3?

Attach below policy to that user: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetBucketLocation", ...
user avatar
  • 1,341
2 votes

Cross account access from ec2 to other accounts

Sure, if the EC2 role allows STS::AssumeRole you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account. See for example here: Cross ...
user avatar
  • 971
2 votes

How can I 'aws s3 sync' two buckets, which are located in different accounts

Attach a policy to the source bucket Get the AWS account ID number of the destination account. From the source account, attach a policy to the source bucket that allows the destination account to get ...
user avatar
  • 1,341
2 votes

What is the purpose of AssumeRolePolicyDocument in IAM?

I think it's much clearer when considering the user that creates a role isn't necessarily the one attaching it for use somewhere: AssumeRolePolicyDocument is a restriction placed by the user that ...
user avatar
  • 121
2 votes

How to programmatically enable and disable SQS triggering AWS Lambda?

Call Lambda's UpdateEventSourceMapping API with the {"Enabled":true/false} request body. If, for some reason, you want your own API for this, you can create one in API Gateway as described ...
user avatar
  • 296
2 votes
Accepted

What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?

Yes It does more than just creating a service account. It does three things: It Creates an IAM role. It attaches the desired iam-policy (--attach-policy-arn <POLICY_ARN>) to the created IAM ...
user avatar
  • 155
2 votes
Accepted

ansible & jinja2: How to reference JSON structure items whose keys are variables?

Don't nest moustaches. Once you're in a Jinja context, you should reference variables by name without any further delimiters. Using standard attribute access syntax can be a lot easier to read than ...
user avatar
1 vote

Force role session name in AWS IAM

I have not tried it but I think if you change your deny to a list of elements it will work. { "Effect": "Deny", "Principal": { "AWS": "arn:aws:iam::...
user avatar
  • 585
1 vote

AWS Temporary Permission Granting Tool for Account/Service "Firefights"

Create an IAM role in prod with all the permissions you'd like the devs to have. When you want devs to have prod access, add the sts:AssumeRole permission to their IAM group. When it's time to revoke ...
user avatar
  • 296
1 vote
Accepted

How do you reference a code commit tag in IAM

I found what i needed to allow or the eqivalent StringNotEquals to deny useing the tag aws:ResourceTag "Condition": { "StringEquals": { "aws:ResourceTag/Key_-1": "...
user avatar
  • 463
1 vote

AWS permissions for Fargate and SSM

IAM Role for Fargate has two policies: The first one describes which service can assume the role and its permissions. In this case it will be the ecs-tasks.amazonaws.com service (= Fargate) that can ...
user avatar
  • 971
1 vote

AWS Cloudwatch for unused accounts

You can get all used User accounts with Cloudtrail, it would then be a text processing exercise to find the unused ones.
user avatar
  • 650
1 vote
Accepted

Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?

create a service which authorizes against SSO and the provides temporary credentials via AWS STS Service. That way you don't have to store anything anywhere and once the user loses access to SSO they ...
user avatar
1 vote

How to get the AWS Access key of an already created Access ID

You can download or read the Secret Key only when you set it up for the first time. If you lost the Secret Key / didn't manage to save it and is not being used anywhere, it is better to Delete and ...
user avatar
  • 111
1 vote

How to override default aws region credentials for Terraform?

I believe you would be using multiple modules to create various resources(EC2,ELB, Etc) in AWS using Terraform. You can create a custom module having output value of each variable you want to ...
user avatar
  • 21
1 vote

Find appropriate AWS policy

If you want to create your own IAM policy, you can use the visual editor present in IAM. Using visual editor, you can construct a new policy from scratch using the very intuitive GUI. Goto IAM, then ...
user avatar
  • 31
1 vote
Accepted

What is a secure way for storing AWS IAM credentials?

Well there are a lot of places to keep them secure you can use something like hashicorp vault to keep those kind of secrets you can use something like lastpass and my personal favorite is enpass ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible