5

I want to restrict access for a specific user to see just few EC2 instances. I created a new user in IAM Roles and I attached a new Policy to it. The content of that Policy is attached below. I tried to look over documentation and to do it myself like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": [
                "arn:aws:ec2:eu-west-1:ACCOUNT_ID:instance/i-INSTANCE_ID1",
                "arn:aws:ec2:eu-west-1:ACCOUNT_ID:instance/i-INSTANCE_ID2"
            ]
        }
    ]
}

I placed my region,ACCOUNT_ID(the owner id, not of the new user created) and instance-id, but when I connect with that user and I go to list all Instances I got this An error occurred fetching instance data: You are not authorized to perform this operation..

After I placed the code in JSON editor, in Policy Review step I got this message:

This policy defines some actions, resources, or conditions that do not provide permissions. To grant access, policies must have an action that has an applicable resource or condition. For details, choose Show remaining Learn more

The AWS documentation mention exactly the same configuration or these examples.

3 Answers 3

2

I assume you connect as that user in the console (but it would be the same with CLI) Here is what I think is happening:

To list all the instances, the console most probably calls the DescribeInstances API. As per the list of action/resources/tags that can be used in IAM policy, this API does not support the resource filter in IAM.

This means your user has no authorization to list instances and they will not be shown in the console. You can validate this theory by using the CLI to request the details of a specific instance id, if my hypothesis is correct, it will be authorized.

As DescribeInstances can not be restricted by resource or tags, I don't think it is possible to filter the instance list for a user.

To have the console working, you'll need to add the following statement in your IAM policy

 "Statement": [
     { your existing statement }, 

     {
         "Effect": "Allow",
         "Action": "ec2:DescribeInstances",
         "Resource": "*"
     }
 ]

Please report if I was right :-) The example you mentioned in your question shows exactly that : Resources = * on DescribeInstances and Resources specific InstanceId on other operations.

4
  • Hi and thank you for your response. Your suggestion doesn't work properly right for me. By adding that statement I can see all the instances that I have in my account, not just 2, as in my example. Commented Feb 19, 2019 at 16:05
  • 1
    That's exactly what I said in my answer. There is no way to limit viewing instances, your user will see them all but will only be able to perform action on the ones you whitelisted by resource ID Commented Feb 19, 2019 at 16:25
  • This really works but is not exactly what I wanted. I understand the limitations. But, I need to do the same for all instances and security groups ... and so on. The problem is that I want to externalize a project to someone else, without showing everything that I have in my account. Do you know any workaround? At least to not display the name of instances? Commented Mar 5, 2019 at 10:54
  • Use multiple AWS accounts ? Or develop a simplified console, I.e. a simple web page where your customers can start/stop their instances only. No easy solution from just a IAM policy perspective, i am afraid Commented Mar 5, 2019 at 12:00
1

The previous answer is wrong, you can Conditionally allow access to ec2:DescribeInstances by tag names. It's an AWS best practice as well. Also explicitly deny access to the ec2:CreateTags and ec2:DeleteTags actions to prevent users from creating or deleting tags to take control of the instance.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:DescribeInstances",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/UserName": "${aws:username}"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": [
        "ec2:CreateTags",
        "ec2:DeleteTags"
      ],
      "Resource": "*"
    }
  ]
}
0

DescribeInstances action does not support condition.

https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.