AWS IAM: Restrict Console Access to only One Instance Announcing the arrival of Valued...

Unexpected result with right shift after bitwise negation

Mortgage adviser recommends a longer term than necessary combined with overpayments

Why don't the Weasley twins use magic outside of school if the Trace can only find the location of spells cast?

Direct Experience of Meditation

Using "nakedly" instead of "with nothing on"

Cold is to Refrigerator as warm is to?

Stopping real property loss from eroding embankment

Why does tar appear to skip file contents when output file is /dev/null?

Unable to start mainnet node docker container

Why is there no army of Iron-Mans in the MCU?

Why does this iterative way of solving of equation work?

What LEGO pieces have "real-world" functionality?

How can I make names more distinctive without making them longer?

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

Is dark matter really a meaningful hypothesis?

3 doors, three guards, one stone

90's book, teen horror

Area of a 2D convex hull

Was credit for the black hole image misattributed?

Is it possible to ask for a hotel room without minibar/extra services?

Writing Thesis: Copying from published papers

Who can trigger ship-wide alerts in Star Trek?

Stop battery usage [Ubuntu 18]

Is 1 ppb equal to 1 μg/kg?



AWS IAM: Restrict Console Access to only One Instance



Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
Come Celebrate our 10 Year Anniversary!Amazon AWS IAM Policy for single VPC SubnetAmazon AWS IAM Policy based in time of dayHow can I chain AWS IAM AssumeRole API calls?How to restrict IAM policy to not allow stop/terminate an EC2 instance but can create new instances?AWS IAM role for use within a classroomHow to grant access to an SQS to a specific IAM userHow to grant IAM access to an already running EC2 intanceAmazon web service visibility restriction to instances under same accountAWS Force MFA Policy IssueAllow other AWS services to invoke Lambda using IAM





.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}







1















I am trying to create an IAM user for the AWS Console with permission to list and perform action on only 1 instance.



So I have a total of 6 Instances and I tried hiding 5 of them via IAM Policies by adding the below policy:

Breakdown

1. First took all the permissions away

2. Added permission to only one instance



    {
"Statement": [
{
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"condition": {}
}
},
{
"Effect": "Allow",
"Action": "*",
"Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef",
"Condition": {
"condition": {}
}
}
]
}


This works for the 1st part only ie Denying to all Instances.
The 2nd part doesn't seem to work.

AWS Console with no permission to any instance data



Don't the permissions work like that? Any help would be appreciated.










share|improve this question





























    1















    I am trying to create an IAM user for the AWS Console with permission to list and perform action on only 1 instance.



    So I have a total of 6 Instances and I tried hiding 5 of them via IAM Policies by adding the below policy:

    Breakdown

    1. First took all the permissions away

    2. Added permission to only one instance



        {
    "Statement": [
    {
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*",
    "Condition": {
    "condition": {}
    }
    },
    {
    "Effect": "Allow",
    "Action": "*",
    "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef",
    "Condition": {
    "condition": {}
    }
    }
    ]
    }


    This works for the 1st part only ie Denying to all Instances.
    The 2nd part doesn't seem to work.

    AWS Console with no permission to any instance data



    Don't the permissions work like that? Any help would be appreciated.










    share|improve this question

























      1












      1








      1








      I am trying to create an IAM user for the AWS Console with permission to list and perform action on only 1 instance.



      So I have a total of 6 Instances and I tried hiding 5 of them via IAM Policies by adding the below policy:

      Breakdown

      1. First took all the permissions away

      2. Added permission to only one instance



          {
      "Statement": [
      {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
      "condition": {}
      }
      },
      {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef",
      "Condition": {
      "condition": {}
      }
      }
      ]
      }


      This works for the 1st part only ie Denying to all Instances.
      The 2nd part doesn't seem to work.

      AWS Console with no permission to any instance data



      Don't the permissions work like that? Any help would be appreciated.










      share|improve this question














      I am trying to create an IAM user for the AWS Console with permission to list and perform action on only 1 instance.



      So I have a total of 6 Instances and I tried hiding 5 of them via IAM Policies by adding the below policy:

      Breakdown

      1. First took all the permissions away

      2. Added permission to only one instance



          {
      "Statement": [
      {
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
      "condition": {}
      }
      },
      {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef",
      "Condition": {
      "condition": {}
      }
      }
      ]
      }


      This works for the 1st part only ie Denying to all Instances.
      The 2nd part doesn't seem to work.

      AWS Console with no permission to any instance data



      Don't the permissions work like that? Any help would be appreciated.







      amazon-web-services amazon-ec2 amazon-iam






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 1 hour ago









      ServerInsightsServerInsights

      1615




      1615






















          2 Answers
          2






          active

          oldest

          votes


















          2














          Your current policy would work in the AWS-CLI, e.g. aws ec2 stop-instance should work.



          However to actually use the web console you need a few more read-only permissions because the console tries to list and describe all the instances to build the list.



          You may need at least ec2:DescribeInstances to get a basic half-broken list.



          If you only care about preventing that IAM user from modifying other instances you can give him a read-only access with ec2:Describe* - that should make the console usable while preventing him from modifying any non-permitted instances.



          I'm not aware of a way to restrict the listing of instances only to the one he can work with, he will probably see them all but can only manage that single one.



          Hope that helps :)






          share|improve this answer































            0














            You have to deny all, but in your condition, use ArnNotEquals "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef"



            This will basically deny all other instance that does not have the same ARN as the instance that you want to be allowed.



            See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN for more information






            share|improve this answer
























              Your Answer








              StackExchange.ready(function() {
              var channelOptions = {
              tags: "".split(" "),
              id: "2"
              };
              initTagRenderer("".split(" "), "".split(" "), channelOptions);

              StackExchange.using("externalEditor", function() {
              // Have to fire editor after snippets, if snippets enabled
              if (StackExchange.settings.snippets.snippetsEnabled) {
              StackExchange.using("snippets", function() {
              createEditor();
              });
              }
              else {
              createEditor();
              }
              });

              function createEditor() {
              StackExchange.prepareEditor({
              heartbeatType: 'answer',
              autoActivateHeartbeat: false,
              convertImagesToLinks: true,
              noModals: true,
              showLowRepImageUploadWarning: true,
              reputationToPostImages: 10,
              bindNavPrevention: true,
              postfix: "",
              imageUploader: {
              brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
              contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
              allowUrls: true
              },
              onDemand: true,
              discardSelector: ".discard-answer"
              ,immediatelyShowMarkdownHelp:true
              });


              }
              });














              draft saved

              draft discarded


















              StackExchange.ready(
              function () {
              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f963055%2faws-iam-restrict-console-access-to-only-one-instance%23new-answer', 'question_page');
              }
              );

              Post as a guest















              Required, but never shown

























              2 Answers
              2






              active

              oldest

              votes








              2 Answers
              2






              active

              oldest

              votes









              active

              oldest

              votes






              active

              oldest

              votes









              2














              Your current policy would work in the AWS-CLI, e.g. aws ec2 stop-instance should work.



              However to actually use the web console you need a few more read-only permissions because the console tries to list and describe all the instances to build the list.



              You may need at least ec2:DescribeInstances to get a basic half-broken list.



              If you only care about preventing that IAM user from modifying other instances you can give him a read-only access with ec2:Describe* - that should make the console usable while preventing him from modifying any non-permitted instances.



              I'm not aware of a way to restrict the listing of instances only to the one he can work with, he will probably see them all but can only manage that single one.



              Hope that helps :)






              share|improve this answer




























                2














                Your current policy would work in the AWS-CLI, e.g. aws ec2 stop-instance should work.



                However to actually use the web console you need a few more read-only permissions because the console tries to list and describe all the instances to build the list.



                You may need at least ec2:DescribeInstances to get a basic half-broken list.



                If you only care about preventing that IAM user from modifying other instances you can give him a read-only access with ec2:Describe* - that should make the console usable while preventing him from modifying any non-permitted instances.



                I'm not aware of a way to restrict the listing of instances only to the one he can work with, he will probably see them all but can only manage that single one.



                Hope that helps :)






                share|improve this answer


























                  2












                  2








                  2







                  Your current policy would work in the AWS-CLI, e.g. aws ec2 stop-instance should work.



                  However to actually use the web console you need a few more read-only permissions because the console tries to list and describe all the instances to build the list.



                  You may need at least ec2:DescribeInstances to get a basic half-broken list.



                  If you only care about preventing that IAM user from modifying other instances you can give him a read-only access with ec2:Describe* - that should make the console usable while preventing him from modifying any non-permitted instances.



                  I'm not aware of a way to restrict the listing of instances only to the one he can work with, he will probably see them all but can only manage that single one.



                  Hope that helps :)






                  share|improve this answer













                  Your current policy would work in the AWS-CLI, e.g. aws ec2 stop-instance should work.



                  However to actually use the web console you need a few more read-only permissions because the console tries to list and describe all the instances to build the list.



                  You may need at least ec2:DescribeInstances to get a basic half-broken list.



                  If you only care about preventing that IAM user from modifying other instances you can give him a read-only access with ec2:Describe* - that should make the console usable while preventing him from modifying any non-permitted instances.



                  I'm not aware of a way to restrict the listing of instances only to the one he can work with, he will probably see them all but can only manage that single one.



                  Hope that helps :)







                  share|improve this answer












                  share|improve this answer



                  share|improve this answer










                  answered 1 hour ago









                  MLuMLu

                  9,78722445




                  9,78722445

























                      0














                      You have to deny all, but in your condition, use ArnNotEquals "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef"



                      This will basically deny all other instance that does not have the same ARN as the instance that you want to be allowed.



                      See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN for more information






                      share|improve this answer




























                        0














                        You have to deny all, but in your condition, use ArnNotEquals "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef"



                        This will basically deny all other instance that does not have the same ARN as the instance that you want to be allowed.



                        See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN for more information






                        share|improve this answer


























                          0












                          0








                          0







                          You have to deny all, but in your condition, use ArnNotEquals "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef"



                          This will basically deny all other instance that does not have the same ARN as the instance that you want to be allowed.



                          See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN for more information






                          share|improve this answer













                          You have to deny all, but in your condition, use ArnNotEquals "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef"



                          This will basically deny all other instance that does not have the same ARN as the instance that you want to be allowed.



                          See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_ARN for more information







                          share|improve this answer












                          share|improve this answer



                          share|improve this answer










                          answered 1 hour ago









                          Sharuzzaman Ahmat RaslanSharuzzaman Ahmat Raslan

                          2631213




                          2631213






























                              draft saved

                              draft discarded




















































                              Thanks for contributing an answer to Server Fault!


                              • Please be sure to answer the question. Provide details and share your research!

                              But avoid



                              • Asking for help, clarification, or responding to other answers.

                              • Making statements based on opinion; back them up with references or personal experience.


                              To learn more, see our tips on writing great answers.




                              draft saved


                              draft discarded














                              StackExchange.ready(
                              function () {
                              StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f963055%2faws-iam-restrict-console-access-to-only-one-instance%23new-answer', 'question_page');
                              }
                              );

                              Post as a guest















                              Required, but never shown





















































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown

































                              Required, but never shown














                              Required, but never shown












                              Required, but never shown







                              Required, but never shown







                              Popular posts from this blog

                              ORA-01691 (unable to extend lob segment) even though my tablespace has AUTOEXTEND onORA-01692: unable to...

                              Always On Availability groups resolving state after failover - Remote harden of transaction...

                              Circunscripción electoral de Guipúzcoa Referencias Menú de navegaciónLas claves del sistema electoral en...