16
votes
Accepted
What is the purpose of AssumeRolePolicyDocument in IAM?
The purpose of the AssumeRolePolicyDocument is to contain the trust relationship policy that grants an entity permission to assume the role.
In your example it's granting the Lambda service the ...
- 670
15
votes
Accepted
Should AWS arn values be treated as secrets?
Well, from a security point of view, it's never bad to give people less information.
But, as long as you have sensible security policies in AWS, there is no reason that an arn has to be considered ...
- 1,550
13
votes
What is the purpose of AssumeRolePolicyDocument in IAM?
For anyone who is scratching their head at the naming convention:
AssumeRolePolicyDocument (in CloudFormation yaml) = Trust Relationships (in AWS Console web GUI)
Policies (in CloudFormation yaml) = ...
- 231
10
votes
What is the purpose of AssumeRolePolicyDocument in IAM?
The purpose of assume role policy document is to grants an IAM entity permission to assume a role. It is also known as a "role trust policy".
In other words, for given permissions you set, it allow ...
- 7,981
10
votes
Accepted
How to provide a user to access only a particular bucket in AWS S3?
Amazon's IAM roles generally grant a role access to a particular ARN (Amazon Resource Name). Amazon notes on their pages that for S3 a resource
...can be a bucket-name or a bucket-name/object-key.
...
- 3,742
8
votes
What is the purpose of AssumeRolePolicyDocument in IAM?
I think it's much clearer when considering the user that creates a role isn't necessarily the one attaching it for use somewhere:
AssumeRolePolicyDocument is a restriction placed by the user that ...
- 181
6
votes
Accepted
Cannot configure node group in new EKS cluster due to no Node IAM role found
This is actually pretty well described in the docs.
Before you create worker nodes, you must create an IAM role with the
following IAM policies:
AmazonEKSWorkerNodePolicy
AmazonEKS_CNI_Policy
...
- 662
5
votes
Accepted
How to get the ARN for an arbitrary Amazon Resource?
https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html lists the schema for (I believe) all of the ARNs that Amazon supports. Text in italic red indicates where you should ...
- 2,841
5
votes
Accepted
What is the AWS user permission that allows attaching and detaching IAM Roles to instances?
From Granting a User Permissions to Pass a Role to an AWS Service:
To pass a role (and its permissions) to an AWS service, a user must
have permissions to pass the role to the service. This helps
...
- 6,750
4
votes
Accepted
Impact on policy after deleting IAM user
S3 Life cycle policy will remain and working as it is.
When you use the AWS Management Console to delete an IAM user, IAM automatically deletes the following information for user:
The user Any ...
- 1,566
4
votes
Impact on policy after deleting IAM user
The policy will still exist.
The documentation lists what is deleted when a user is deleted, any resources that the user has created will persist.
- 1,112
4
votes
Accepted
How to get the AWS Access key of an already created Access ID
Access Key is that AKIA... one. What you need is a Secret Key - that can't be recovered after the initial setup.
Since you have never used this particular access key (it says "Last used: N/A") it's ...
- 1,011
3
votes
Accepted
Cross account access from ec2 to other accounts
Supposing the scenario with two accounts A & B the explanatory steps should be:
In account A, I created a role (e.g RoleForB) to trust account B, and attach to the before created role a IAM ...
3
votes
Accepted
Terraform: add to existing AWS policy, or create policy if needed
This is not a good way to go about this, terraform is a declarative language and you should always follow this principle.
Either terraform is managing a resource or terraform is querying an existing ...
- 425
2
votes
How to provide a user to access only a particular bucket in AWS S3?
Attach below policy to that user:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
...
- 1,566
2
votes
Cross account access from ec2 to other accounts
Sure, if the EC2 role allows STS::AssumeRole you can assume a role in the other account and get temporary credentials to do whatever you need to do in the other account.
See for example here: Cross ...
- 1,011
2
votes
How can I 'aws s3 sync' two buckets, which are located in different accounts
Attach a policy to the source bucket
Get the AWS account ID number of the destination account.
From the source account, attach a policy to the source bucket that allows the destination account to get ...
- 1,566
2
votes
Force role session name in AWS IAM
I have not tried it but I think if you change your deny to a list of elements it will work.
{
"Effect": "Deny",
"Principal": {
"AWS": "arn:aws:iam::...
- 1,064
2
votes
Accepted
How to programmatically enable and disable SQS triggering AWS Lambda?
Call Lambda's UpdateEventSourceMapping API with the {"Enabled":true/false} request body.
If, for some reason, you want your own API for this, you can create one in API Gateway as described ...
- 311
2
votes
Accepted
What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?
Yes It does more than just creating a service account. It does three things:
It Creates an IAM role.
It attaches the desired iam-policy (--attach-policy-arn
<POLICY_ARN>) to the created IAM ...
- 155
2
votes
Accepted
ansible & jinja2: How to reference JSON structure items whose keys are variables?
Don't nest moustaches. Once you're in a Jinja context, you should reference variables by name without any further delimiters.
Using standard attribute access syntax can be a lot easier to read than ...
- 161
1
vote
AWS Temporary Permission Granting Tool for Account/Service "Firefights"
Create an IAM role in prod with all the permissions you'd like the devs to have.
When you want devs to have prod access, add the sts:AssumeRole permission to their IAM group.
When it's time to revoke ...
- 311
1
vote
Accepted
How do you reference a code commit tag in IAM
I found what i needed to allow or the eqivalent StringNotEquals to deny useing the tag
aws:ResourceTag
"Condition": {
"StringEquals": {
"aws:ResourceTag/Key_-1": "...
- 523
1
vote
AWS permissions for Fargate and SSM
IAM Role for Fargate has two policies:
The first one describes which service can assume the role and its permissions. In this case it will be the ecs-tasks.amazonaws.com service (= Fargate) that can ...
- 1,011
1
vote
AWS Cloudwatch for unused accounts
You can get all used User accounts with Cloudtrail, it would then be a text processing exercise to find the unused ones.
- 650
1
vote
Accepted
Is it possible to read secured keys from aws-secrets-manager without using aws access and secret key?
create a service which authorizes against SSO and the provides temporary credentials via AWS STS Service. That way you don't have to store anything anywhere and once the user loses access to SSO they ...
- 381
1
vote
How to get the AWS Access key of an already created Access ID
You can download or read the Secret Key only when you set it up for the first time.
If you lost the Secret Key / didn't manage to save it and is not being used anywhere, it is better to Delete and ...
- 111
1
vote
How to override default aws region credentials for Terraform?
I believe you would be using multiple modules to create various resources(EC2,ELB, Etc) in AWS using Terraform. You can create a custom module having output value of each variable you want to ...
- 21
1
vote
Find appropriate AWS policy
If you want to create your own IAM policy, you can use the visual editor present in IAM. Using visual editor, you can construct a new policy from scratch using the very intuitive GUI.
Goto IAM, then ...
- 31
1
vote
Accepted
What is a secure way for storing AWS IAM credentials?
Well there are a lot of places to keep them secure
you can use something like hashicorp vault to keep those kind of secrets
you can use something like lastpass and my personal favorite is enpass
...
- 191
Only top scored, non community-wiki answers of a minimum length are eligible