How are we doing? Please help us improve AWS. Take our short survey

Questions tagged [amazon-iam]

AWS Identity and Access Management (IAM) is an access control service for the broader AWS platform. Use this tag for questions about using its CLI, writing JSON for it, or using its SDKs ONLY. General-use AWS AIM questions are off-topic and should be asked on Server Fault instead (note: *any* AWS question can be asked on Server Fault instead).

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

User is not authorized to encrypt records in stream

I have an AWS Lambda which writes data to aws kinesis. I have attached the following IAM policy to the role: { "Version": "2012-10-17", "Statement": [ { ...
  • 1,201
0 votes
0 answers
6 views

How do I convert AWS IAM policy into casbin policy?

I want to use the AWS IAM type policy and use casbin for authentication. How to convert the AWS IAM policy into a casbin policy ? Is there a sdk that can be used for conversion? The iam policy like ...
-1 votes
0 answers
18 views

How to create IAM policy with a condition that restricts a user to a certain Elastic Beanstalk application?

I am trying to create an IAM policy that allows some actions on a resource, but only if the access key is used from a specific Elastic Beanstalk application or container. Does anyone know how to do ...
  • 1,026
0 votes
1 answer
14 views

Encountered unsupported property VpcId

I am writing a cloud formation template that install SSM agent in EC2. but when i upload the template in Cfn. I got the error called Encountered unsupported property VpcId. AWSTemplateFormatVersion: ...
  • 19
0 votes
3 answers
30 views

IAM role that only allows objects to be written to / read from a specific sub-folder in an S3 bucket

Summary As mentioned above, I want to create an IAM role that can ONLY read / write objects to a SPECIFIC sub-folder in the S3 bucket. However, I'm unable to despite following the examples here and ...
0 votes
1 answer
15 views

GitHub action failing on Error: Not authorized to perform sts:AssumeRoleWithWebIdentity

I have two GitHub Actions, both are identical except that one is triggered manually, and the other when a pull request is completed on the main branch. The manual-deploy workflow works just fine, ...
  • 5
0 votes
1 answer
14 views

1. Resource Definition is Malformed

0 I am writing a cloud formation template that install SSM in EC2. but when i upload the template in Cfn. I got the error called Resource Definition is Malformed. Description: This Template Create an ...
  • 19
0 votes
1 answer
38 views

How to find IAM user who registered a new domain on AWS

I'd like to find which IAM user registered a new domain in route53 from our AWS account. How can I do this? The domain is registered a week ago and I tried to check CreateDomain, CreateDomainEntry, ...
0 votes
0 answers
26 views

Allow ec2:CreateSecurityGroup only if request contain specific tag

I'm trying to write a IAM policy to ensure that a resource (a security group in the example) can't be created unless it is tagged with a specific tag with a specific value. Here is my policy: { &...
0 votes
0 answers
17 views

AWS region considerations for creating ECS ecsTaskExecutionRole via CloudFormation

If I manually run an ECS Fargate task via the AWS console, AWS is nice and automatically creates an ECS task execution IAM role for me, which I can then even reference in CloudFormation templates, e.g....
1 vote
1 answer
47 views

AWS OpenSearch Service. Request failed: [security_exception] authentication/authorization failure

I'm trying to use OpenSearch to connect to my OpenSearch domain on AWS. I set env for AWS. However, I'm encountering an authentication/authorization failure. Here's my code: public class Example { ...
0 votes
0 answers
15 views

AWS codebuild issue with assuming role

Newbie here, when trying to deploy I get the following error in codebuild: An error occurred (AccessDeniedException) when calling the DescribeRepositories operation: User: arn:aws:sts::XXXXXXXXXXX:...
0 votes
1 answer
26 views

MongoDB Atlas failing, could not find user

I’m trying to connect to the atlas cluster from mongoDb compose I keep getting the following error. What might be the reason for this? and what will help to resolve this problem? Error: Could not find ...
0 votes
1 answer
15 views

S3 Presigned Urls with IAM Role on EC2 not working - GET

I have an ec2 instance with nodejs and aws sdk. I have an IAM role assigned to the EC2 instance which includes: EC2 Full Access, S3 Full Access and a few other things. Here's how I instantiate the S3 ...
  • 589
0 votes
0 answers
26 views

How to create AWS Console Deeplinks behind IAM Identity Center login?

When managing access to multiple accounts via IAM Identity Center, the AWS Access Portal provides clickable links for each of the available Roles/PermissionSets in those accounts. However, the console ...
  • 4,717
0 votes
1 answer
14 views

How to grant IAM User access to a DynamoDB CfnGlobalTable in CDK?

Previously, the dynamodb Table class had a method called "grantFullAccess(IamUser)". I'm trying to create a CfnGlobalTable now instead, but I don't seem to see any way to grant full access ...
  • 89
0 votes
1 answer
42 views
+50

How to access CodeArtifact cross-account when CDK is bundling Java lambda function?

I currently have 2 AWS accounts and Account A holds a CodeArtifact repository that contains a commons package that has shared code between my functions. Account B has my functions. I am using the CDK ...
0 votes
1 answer
23 views

How to restrict access to a single glue catalog database with IAM Role Policy?

In my glue data catalog, there are many glue data catalog databases. I'm trying to write an IAM Role policy that would deny access to every GDC database, except for one whitelisted database. How can ...
  • 585
0 votes
1 answer
24 views

How do I share access with my entire organization to a SNS Topic?

I'm trying to set up a single SNS Topic that can be used by all AWS accounts within our organization. I have created these accounts through the organization and can see they are tied to the ...
  • 36
1 vote
1 answer
20 views

Aurora Events Not Appearing In SNS Topic?

I have an Aurora PostgreSQL database which I am trying to set up to send all events for the cluster or instances to an email address. All resources are being defined in Terraform. I've created the ...
0 votes
0 answers
26 views

aws:MultiFactorAuthPresent attribute on aws cli for AWS Identity Center users

It seems that when using AWS Identity Center, mfa, and creating a aws cli session with aws sso login doesn't result in the cli session being mfa authenticated out of the box. I have created an user, ...
0 votes
1 answer
19 views

AWS EC2 Instance permissions for S3 buckets

I have multiple EC2 instances which need access to specific different buckets. For example: Instance-1 only needs access to bucket-1 Instance-2 only needs access to bucket-2 Therefore I would ...
0 votes
0 answers
28 views

AWS IAM authentication for MSK not working for Kafka Streams application

I followed following documentation to use IAM authentication for MSK. https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html It works well for general kafka consumers and ...
0 votes
0 answers
18 views

AWS resource policy setup to allow access from only one account for a dynamic user ARN

I am trying to create a KMS key policy to allow access to a key from an administrative IAM user that is dynamically created. Generally the user will look like arn:aws:iam::<ACCOUNT>:user/<...
  • 511
2 votes
1 answer
36 views

correct policy to get secrets on local go app

playing with a small project on AWS: golang app RDS/MySQL database secret manager API gateway and lambda I'm running the go app locally to verify the interaction with the database, but I can't get ...
  • 5,024
0 votes
0 answers
30 views

Mendix Private cloud key rotation

I am trying to rotate AWS access and secret keys which used during namespace configuration in Mendix Privaye cloud. I am running into below error new keys are supplied. Reason: Error Message: Failed ...
1 vote
1 answer
28 views

AWS lambda what policy to add so I can call an API

I have a lambda that calls an API, but need to configure it so it can resolve DNS, how do I enable port 53 and UDP? var https = require('https'); exports.handler = (event, context, callback) => { ...
1 vote
2 answers
38 views

Access Denied error when attempting Kinesis stream access across AWS accounts

I am attempting to access a Kinesis stream on one AWS account from a lambda function on another AWS account. The lambda function attempts to pull data from the AWS account using the Amazon.Kinesis....
  • 35
1 vote
1 answer
27 views

AWS IAM rule to allow user to list and edit one S3 bucket

I created the following AWS policy in order to give a user access to my-backup bucket. The user can see all objects in the bucket and edit them, but he cannot go to the overview page. I thought that ...
  • 7,754
1 vote
1 answer
36 views

Getting User not authorized to perform: execute-api:Invoke on resource: arn:aws:execute-api:eu-west-1:********0900:

I am trying to access AWS lending API using postman, but I am getting following error: My postman setup is below: And my IAM user setup is below:
-1 votes
0 answers
21 views

Creating IAM Roles and policies from Terraform in an EC2 instance in a private subnet without NAT GW [duplicate]

We have an EC2 instance in a private subnet which has no NAT GW, so no access to the internet. We saw that we can use VPC Endpoints so that terraform can access the AWS API for creating several ...
0 votes
0 answers
41 views

CDK - AWS CodeDeploy does not have the permissions required to assume the role

I have a weird behavior with CDK that I don't understand. I am trying to create a CodeDeploy deployment group with an IAM role. So far, I coded something like that: const codedeployApplication = new ...
  • 1
0 votes
0 answers
33 views

Unable to make DynamoDB API call from AWS SDK with assumed Cognito IAM role

I have a simple Angular application which I need to access fine-grained user data from a DynamoDB table. I authenticate the user via Cognito and use the AWS SDK DocumentClient to get user-specific ...
0 votes
1 answer
37 views

Setup AWS OIDC across accounts

I have 2 AWS accounts: Account A: It contains an Identity Provider (IdP). Account B: It has an IAM role (ROLE B). This role is also configured to allow assuming the role using the WebIdentityAssume ...
  • 97
0 votes
1 answer
30 views

Cloudformation cannot set resource for IAM role

I want to create an S3 bucket and a role that allows another service to access it using Cloudformation in YAML. Resources: S3SFTPBucket: Type: AWS::S3::Bucket DeletionPolicy: Retain ...
  • 1,453
0 votes
1 answer
61 views

AWS eventbridge scheduler in cloudformation: Target needs RoleArn although permissions were attached to lambda function

I'm new to cloudformation and want to trigger a lambda function with the new event scheduler (AWS::Scheduler::Schedule). But although I added the permissions (lambda:InvokeFunction with eventbridge ...
  • 267
4 votes
1 answer
81 views

unable to read s3 files from within aws emr studio notebooks or consoles

We have an EMR Studio that has an S3 default bucket set, i.e. s3://OurBucketName/Subdirectory/work, and within which we've created a Workspace that is attached to an EC2 cluster running emr-6.10.0 ...
0 votes
1 answer
38 views

IAM Identity Center: Cannot see S3 bucket

I have just created an S3 bucket ato host some PDFs that will be publicly accessible. That is all working fine. The PDFs need to be updated regularly so I want to create a separate account so other ...
0 votes
0 answers
50 views

Possible to give Fluentd access to secured OpenSearch domain using IAM?

Describe the issue I'm using the fluent-operator to deploy fluentdbit to collect logs and fluentd to process and send to an OpenSearch domain with advanced security configuration. It works with open ...
0 votes
0 answers
27 views

AWS associate IP with instance in other account

I have a problem that I'm trying to fix for my school project. Let's say I have account A and my friend accounts B. Each one of us as 1 instance ubuntu, and I want to transfer/allocate my elastic ip (...
  • 7
0 votes
0 answers
29 views

How to check what policy gives access to specific resource (kinesis data stream)?

I wanted to check which resources are putting records into kinesis data stream but I didn't find any information about it, so is there any possibility to check who has access to write to kinesis data ...
0 votes
2 answers
25 views

AWS Glue upload JSON : putObject: AccessDenied: Access Denied

I have downloaded the AWS glue script from my Dev environment by clicking "Download" as a JSON file which include Job parameter and other info as well other than the code. When i upload to ...
1 vote
2 answers
63 views

What happens to existing AWS IAM users when enable IAM Identity Center?

I want to enable IAM Identity Center and configure an external IdP for an existing AWS account. This AWS account already has users, created with IAM. What happens to these users? I'm especially ...
  • 561
0 votes
1 answer
60 views

AWS Backup IAM permission

I am trying to create a backup of an important S3 bucket. I am planning on using AWS backup. I created a backup plan, a resource assignment, used the default policy. When I look at the job section, I ...
-3 votes
1 answer
44 views

How to create IAM policy to restrict user to access AWS bills from March 2023 onward?

How to create IAM policy to restrict user to access AWS bills from March 2023 onward? IAM User not allowed to see previous bills just allowed to see the AWS bills from march onward. I have tried but ...
  • 1
0 votes
0 answers
17 views

How to check if a request has been http proxied by another api gateway?

I am using an http-proxy api gateway integration for the endpoint. So the first api gateway proxies the request to my second api gateway. I am trying to figure out if I can use the resource policy in ...
  • 201
0 votes
1 answer
47 views

Only list S3 Objects that match wildcard

I want to create an IAM policy that allows a user limited access to my bucket. I only want them to see specific objects that match a wildcard. Assuming structure of bucket |_ users |_ userA |_ ...
0 votes
0 answers
29 views

AWS QuickSight: Access denied when accessing image from S3 in custom content

I would like to store an image in an S3 bucket and show it in Custom Content in QuickSight. I followed the video How do I allow Amazon QuickSight access to my S3 bucket when I have a deny policy? - ...
0 votes
0 answers
12 views

IAM policy that would allow only another proxying api gateway to call api gateway

I have two api gateways. The first one is proxying the requests to another api gateway, so the integration is http proxy. I want to write an IAM role that would only allow this gateway that is ...
  • 201
0 votes
1 answer
44 views

AWS CDK - IAM : how to get the list of users IDs

I'm developing a typescript app with cdk and I need to fetch the list of the existing users from my organisation. Till now I can't find a way to do with cdk or cfn, did anyone run into a similar ...
  • 445

1
2 3 4 5
105