I am following this guide, but it is not working, my requirement is to assign a "Permission Set" for example "Support User" to one specific OU containing several accounts in AWS Organizations
but I don't see the example from AWS working, is there a way without using Tags ? And only allow specific stuff for my permission set to a specific OU?
for example?
My SSO instance:
arn:aws:sso:::instance/ssoins-722XXXXXXXX85
my specific ou in AWS Org:
arn:aws:organizations::662XXXXXX94:ou/o-akoxg86wr1/ou-xlq4-vhybzk32
source:
AWS-SSO-org
any pointers? Thanks a lot
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DelegatedOUAdmin",
"Effect": "Allow",
"Action": [
"sso:ProvisionPermissionSet",
"sso:CreateAccountAssignment",
"sso:DeleteInlinePolicyFromPermissionSet",
"sso:UpdateInstanceAccessControlAttributeConfiguration",
"sso:PutInlinePolicyToPermissionSet",
"sso:DeleteAccountAssignment",
"sso:DetachManagedPolicyFromPermissionSet",
"sso:DeletePermissionSet",
"sso:AttachManagedPolicyToPermissionSet",
"sso:CreatePermissionSet",
"sso:UpdatePermissionSet",
"sso:CreateInstanceAccessControlAttributeConfiguration",
"sso:DeleteInstanceAccessControlAttributeConfiguration",
"sso:ProvisionApplicationInstanceForAWSAccount"
],
"Resource": "arn:aws:sso:::permissionSet/*/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/Environment": "Development",
"aws:ResourceTag/OU": "Test"
}
}
},
{
"Sid": "Instance",
"Effect": "Allow",
"Action": [
"sso:ProvisionPermissionSet",
"sso:CreateAccountAssignment",
"sso:DeleteInlinePolicyFromPermissionSet",
"sso:UpdateInstanceAccessControlAttributeConfiguration",
"sso:PutInlinePolicyToPermissionSet",
"sso:DeleteAccountAssignment",
"sso:DetachManagedPolicyFromPermissionSet",
"sso:DeletePermissionSet",
"sso:AttachManagedPolicyToPermissionSet",
"sso:CreatePermissionSet",
"sso:UpdatePermissionSet",
"sso:CreateInstanceAccessControlAttributeConfiguration",
"sso:DeleteInstanceAccessControlAttributeConfiguration",
"sso:ProvisionApplicationInstanceForAWSAccount"
],
"Resource": [
"arn:aws:sso:::instance/ssoins-722XXXXXXXX85",
"arn:aws:organizations::662XXXXXX94:ou/o-akoxg86wr1/ou-xlq4-vhybzk32"
]
}
}
]
} enter code here
Related
I need to write policy to allow see all Secrets with some tag. But when I use condition, user with this policy loses all access. What am I doing wrong?
Here is my policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret",
"secretsmanager:ListSecrets"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/ProjectName": "Test"
}
}
}
]
}
Here is my Secret
But in result I have this message: You don't have permission to view or select from existing secrets in your account. Contact your administrator to obtain ListSecrets access.
As a plan to deprecate s3 objects, I am revoking all access apart from mine. I tried 2 ways but I see I am not able to see the bucket policy.
Error message from console:
You don’t have permission to get bucket policy
You or your AWS administrator must update your IAM permissions to allow s3:GetBucketPolicy. After you obtain the necessary permission, refresh the page. Learn more about Identity and access management in Amazon S3
First:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Principal": "*",
"Action": "s3:*",
"Resource": [
"arn:aws:s3:::ck",
"arn:aws:s3:::k/*"
],
"Condition": {
"StringNotLike": {
"aws:userId": [
"AIDA"
]
}
}
}
]
}
Second:
{
"Id": "bucketPolicy",
"Statement": [
{
"Action": "s3:*",
"Effect": "Deny",
"NotPrincipal": {
"AWS": [
"arn:aws:iam::0220:user/an"
]
},
"Resource": [
"arn:aws:s3:::tes",
"arn:aws:s3:::tes/*"
]
}
],
"Version": "2012-10-17"
}
I have setup separate IAM users from the root account with various privilege levels and I need provide all EC2 services access for 2 specific instances to a particular IAM user
I used AWS policy generator and got the below policy but it doesn't work
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "ec2:*",
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:us-east-1:ACCOUNT_ID:instance/INSTANCE_ID",
"arn:aws:ec2:us-east-1:ACCOUNT_ID:instance/INSTANCE_ID"
]
}
]
}
How can I grant permission to the specific instances so the IAM user can only manage those specific instances without accessing any other instances or services.
You can achieve this via Tags. As stated by the AWS Docs, you can try the below policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:RebootInstances"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/Owner": "Bob"
}
},
"Resource": [
"arn:aws:ec2:us-east-1:111122223333:instance/*"
],
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"
}
]
}
I'd like to send our new users their IAM username and temporary credentials and then require them to change their password AND require them to configure their own virtual MFA before they get access to anything else in the console.
1) When creating the user I can obviously generate a temporary password and require them to change it on first login. Security Credentials-->Manage Password-->'Require user to create a new password at next sign-in'.
2) The following policy will permit IAM users to change their own passwords:
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:ChangePassword",
"iam:GetAccountPasswordPolicy"
],
"Resource": "*"
}
}
3) The following policy allows users to manage only their own virtual mfa devices:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUsersToCreateEnableResyncDeleteTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ResyncMFADevice",
"iam:DeleteVirtualMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
]
},
{
"Sid": "AllowUsersToDeactivateTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:DeactivateMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
],
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": true
}
}
},
{
"Sid": "AllowUsersToListMFADevicesandUsersForConsole",
"Effect": "Allow",
"Action": [
"iam:ListMFADevices",
"iam:ListVirtualMFADevices",
"iam:ListUsers"
],
"Resource": "*"
}
]
}
Using the three methods above I can require them to change their password and allow them to configure their own virtual MFA devices, I just don't know if there is a way to require them to configure an MFA.
AWS has a documented answer for this: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html
It's a single policy with several statements that:
Allows listing all users and all MFA devices.
Allows listing only your own user and their own MFA devices.
Allows managing your own MFA device.
Allow deactivating MFA if you have logged in with MFA.
Block access to everything else unless MFA was used for sign in.
I'm posting the complete solution because it is not a duplicate of Can you require MFA for AWS IAM accounts?, which is extremely helpful, but is not the complete solution to also allowing new IAM users to login to the console, change their password AND add their own virtual MFA by themselves.
1) Create a managed policy to allow users to change their own passwords:
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": [
"iam:ChangePassword",
"iam:GetAccountPasswordPolicy"
],
"Resource": "*"
}
}
2) Create a managed policy to allow users to manage their own virtual mfa devices:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUsersToCreateEnableResyncDeleteTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:CreateVirtualMFADevice",
"iam:EnableMFADevice",
"iam:ResyncMFADevice",
"iam:DeleteVirtualMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
]
},
{
"Sid": "AllowUsersToDeactivateTheirOwnVirtualMFADevice",
"Effect": "Allow",
"Action": [
"iam:DeactivateMFADevice"
],
"Resource": [
"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}",
"arn:aws:iam::account-id-without-hyphens:user/${aws:username}"
],
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": true
}
}
},
{
"Sid": "AllowUsersToListMFADevicesandUsersForConsole",
"Effect": "Allow",
"Action": [
"iam:ListMFADevices",
"iam:ListVirtualMFADevices",
"iam:ListUsers"
],
"Resource": "*"
}
]
}
3) Add the following condition to all policies where you want to require MFA:
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "ReadOnlyEC2RequireMFA",
"Action": [
"ec2:Describe*"
],
"Effect": "Allow",
"Resource": "*",
"Condition": {
"Null": {
"aws:MultiFactorAuthAge": "false"
}
}
}]
}
4) When you create new IAM users, and assign them a password, check the box 'Require user to create a new password at next sign-in' and apply the three managed policies above (or assign the managed policies to a group and add the user to the group).
Now distribute the username and temporary password to the new IAM user. When they login it will prompt them to change their password, then they will only be able to go into IAM, select their own user account and add their own MFA device. They will need to log off and log back in using MFA to get the ec2:Describe* permissions.
I follow this link documentation
http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#ex5
I want to provide a user specific Image Launch permission which specified tag, "department=dev".
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region::image/ami-*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/department": "dev"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:region:account:instance/*",
"arn:aws:ec2:region:account:volume/*",
"arn:aws:ec2:region:account:key-pair/project_keypair",
"arn:aws:ec2:region:account:security-group/sg-1a2b3c4d"
]
}
]
}
I also added a separated Describe police because i am using interface not cli .
But when i launch instances its show initialization failed and stop . I decode the error message and it provide me
{
"DecodedMessage": "{\"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{\"items\":[]},\"failures\":{\"it
ems\":[]},\"context\":{\"principal\":{\"id\":\"AIDAJXOEQNA64A677DGQO\",\"name\":\"DevOps1\",\"arn\":\"arn:aws:iam::95524
6940111:user/DevOps1\"},\"action\":\"ec2:RunInstances\",\"resource\":\"arn:aws:ec2:us-east-1:955246940111:network-interf
ace/*\",\"conditions\":{\"items\":[{\"key\":\"ec2:Subnet\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-1:955
246940111:subnet/subnet-9d25b5b6\"}]}},{\"key\":\"ec2:Region\",\"values\":{\"items\":[{\"value\":\"us-east-1\"}]}},{\"ke
y\":\"ec2:AvailabilityZone\",\"values\":{\"items\":[{\"value\":\"us-east-1c\"}]}},{\"key\":\"ec2:Vpc\",\"values\":{\"ite
ms\":[{\"value\":\"arn:aws:ec2:us-east-1:955246940111:vpc/vpc-ebeed48e\"}]}}]}}}"
Please help
Try adding
"arn:aws:ec2:us-east-1:955246940111:network-interface/*"
to the resource list in the policy.
That's what the decoded auth message is reporting as missing/wrong.
Also make sure you replace any instances of region and account with the actual values in your policy, assuming you haven't already.