The goal is to find out if it's possible to create an EC2 role for letting users launch new EC2 and RDS instances with full admin access for resources tagged with sf_env:dev in the us-west-2 region. Is it possible to do all of this? If so, what am I missing in my policy? I do not want them to have any other access with accounts, other than this.
After reading the iam, ec2, and rds user guides, and one of the blog posts, I have some questions because I'm a bit fuzzy now after creating the policy, role, and testing it out with one of a test user account. The user actually had full admin access to all resources in the region, which isn't what I wanted.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:*"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/sf_env": "dev"
}
}
},
{
"Effect": "Allow",
"Action": [
"rds:*"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/sf_env": "dev"
}
}
}
]
}