Strange behavior with IAM Roles - amazon-web-services

I created an IAM Role for EC2 called Role4EC2-FA and assigned the AmazonS3FullAccess policy to it. I was able to attach the same to the EC2 instance and access the S3 services from the EC2.
In the Trust Relationship I did change the Principal Service from ec2.amazonaws.com to s3.amazonaws.com, but still I was able to attach the same IAM Role to an EC2 instance, which should not be the case. But the good thing is that S3 service was not accessible from the EC2 this time.
Is this the expected behavior?

It is not the trust policy which decide if a role can be attached to an instance or not. It is an instance profile.
Trust policy says which service can assume this role. When you changed it to S3, EC2 was not allowed anymore to assume it, that is why it couldn't access S3.
But as you still have an instance profile, you still can attach it to instance.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

Related

Can we assign more than one role to EC2 instance?

I see that there is only one role that can be assigned through aws console.
A role can have multiple policies.
Is there a possibility/necessity to assign more than one role to EC2?
No, it is not possible nor there is a necessity.
If your IAM Role needs to access multiple resources, you can do so by attaching multiples policies to a single IAM Role.
For more information, check Policies and Permissions
AWS does not support the ability to assign more than one instance role to an instance.
From the AWS user guide:
An instance profile can contain only one IAM role. This limit cannot be increased.
The instance can be assigned a role and that role can be assigned multiple policies. Or you can create a single policy that contains all permissions necessary for that instance.
See: Instance Roles for EC2

What is exactly "Assume" a role in AWS?

Question
What does exactly "Assume" a role mean in AWS and where is the definitive definition provided?
Background
Assuming a role is frequently used and trying to understand the definition and what it actually means.
I suppose when a principal (IAM user, application running in an EC2 instance, etc which invokes an action to access AWS resource(s)) needs to invoke an action to access an AWS resource:
AWS (API? or some Authorisation runtime in AWS?) identifies the roles which the principal can be granted. e.g. if an EC2 user is specified to execute the assume-role API call and run an application which accesses an AWS resources in an EC2 instance to which IAM profile is attached, then:
All the IAM roles from the EC2 IAM profile
IAM roles and policies requested in the assume-role call
IAM roles which the EC2 user is granted
AWS finds a role from the roles which has the policy (action, resource) that allows the principle to do the action on the resource.
AWS switches the role of the principle to the role identified.
When the step 3 has happened, it is said "the principal has assumed the role". Is this correct?
Research
Using IAM Roles
Before an IAM user, application, or service can use a role that you created, you must grant permissions to switch to the role. You can use any policy attached to one of an IAM user's groups or to the user itself to grant the necessary permissions.
Assuming a Role
AssumeRole
Using IAM Roles
Using an IAM Role to Grant Permissions to Applications Running on Amazon EC2 Instances
Assuming a role means asking Security Token Service (STS) to provide you with a set of temporary credentials -- role credentials -- that are specific to the role you want to assume. (Specifically, a new "session" with that role.)
You can optionally include a policy with this request, which will serve to limit the permissions of the temporary credentials to only a subset of what the role's policies would have allowed.
You then use these credentials to make further requests. These credentials look similar to IAM user credentials with an access-key-id and secret, but the access key begins with ASIA instead of AKIA and there's a third element, called the security token, which must be included in requests signed with the temporary credentials.
When you make requests with these temporary credentials, you have the permissions associated with the role, and not your own (if you have one) because you have taken on a new identity. CloudTrail can be used to trace the role credentials back to the user who assumed the role, but otherwise the service is unaware of who is using the credentials.
tl;dr: Assuming a role means obtaining a set of temporary credentials which are associated with the role and not with the entity that assumed the role.
AWS (API? or some Authorisation runtime in AWS?) identifies the roles which the principal can be granted.
No. You specify the role you want to assume.
When "you" are code running on an EC2 instance, and the instance has an instance role, the EC2 infrastructure actually calls assume-role on behalf of the instance, and you can fetch the temporary credentials from the instance metadata service. These credentials are accessible only from within the instance, but they are not stored on the instance.
When running a Lambda function, the Lambda infrastructure contacts STS and places your temporary credentials in environment variables. Again, these credentials are accessible to the function, without being stored inside the function.
In either case, you could call assume role with these credentials and assume a different role, but that should not be necessary in most environments.
e.g. if an EC2 user is specified to execute the assume-role API call and run an application which accesses an AWS resources in an EC2 instance to which IAM profile is attached, then:
AWS has no awareness of EC2 users. Instance roles are accessible to everything running on the instance.
All the IAM roles from the EC2 IAM profile
An instance profile can only include one role.
IAM roles and policies requested in the assume-role call
You request to assume exactly one role. You do not need to request a policy -- you only specify a policy if you want the temporary credentials to have fewer privileges than the role credentials would allow. This might be something you would do if you needed code running in an untrusted place -- such as code in a browser or an app -- to be able to sign requests with credentials.
AWS finds a role from the roles which has the policy (action, resource) that allows the principle to do the action on the resource.
No. As noted above, you ask for a specific role when you call assume-role.
AWS switches the role of the principle to the role identified.
No. You make the switch by using the temporary credentials provided.
I have created the following diagram for myself to understand what is exactly assume a role in AWS. Hopefully, you will also find it helpful.
In the diagram, I put it in 3 steps:
Prepare the roles (ExecutionRole and AssumedRole)
Create a Lambda Function on Account A (in your case it is EC2)
Execute the LambdaFunction.
The diagram uses cross-account as an example, if it is within the same account step 1.3 is not required.
Typically, you use AssumeRole within your account or for cross-account access.
...
Users in the same account as the role do not need explicit permission to assume the role. Source: https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
When step 3 has happened, it is said: "the principal has assumed the
role". Is this correct?
The steps you mentioned in assuming a role are correct.
Here the important point is the IAM role's Trust Relationship configuration where you grant each of the IAM user, application, or service to assume the role. That is where you grant the permission to assume the particular role.
This is important in many aspects, where it controls who can assume the role and it is important to provide not only least access to the role but also grant the least amount of entities who can assume the role.

How to Restrict AWS AMI access to certain user?

I just have created an AWS EC2 AMI for my EC2 instance.
I wanted to give restriction to that AMI(user level,not account level).
For example User1 have created AMI named ami-123.
User1,User2,User3 are present in that account.
I want only User1 should have permission to create EC2 instance using ami-123.
Please help me to sort it out?
By default, users in an AWS Account have no permissions to do anything.
You then grant them permissions for actions they are allowed to call, such as RunInstances.
As part of these permissions, you can restrict the permissions they are receiving, such as the AMI they can specify:
arn:aws:ec2:region::image/*
See: Resource-Level Permissions for RunInstances
Alternatively, you could ALLOW RunInstances but then create a policy to DENY use of a particular AMI.

Do I have to create IAM role to run "aws ec2 describe-security-groups"

I am owner of one EC2 instance. I can ssh to virtual server by key.pem. My question is to print security-group content (inbound and outbound in one page) of this EC2 instance, do I have to attach IAM role to this instance (so that I can use aws ec2 command) ?
I just wondering, if I am the owner of this instance, I shall be able to do anything without extra granting....
IAM permissions has nothing to do with EC2 instances and the owner of the instance is the AWS account. Just imagine what will happen if one of your IAM user can run any commands by just launching an instance.
You can run "aws ec2" command from your local machine/laptop after installing AWS CLI. If you choose to do so, you have to configure the CLI with the access keys of an IAM user with proper permission. Same applies to EC2 instances, but you can leverage IAM role so that you don't have to use access keys and instead use temporary credentials provided by the IAM role (recommended).
http://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html#cli-quick-configuration

AWS: How do I programmatically add a role to an instance?

I would like to add a role to an existing (running?) instance. Is this possible programmatically?
It is not possible (not even in AWS dashboard). You can add an IAM role only when launching an instance
https://aws.amazon.com/iam/faqs/
Q: Can I change the IAM role on a running EC2 instance? No, at this
time you cannot change the IAM role on a running EC2 instance. You can
change the permissions on the IAM role associated with a running
instance, and the updated permissions will take effect almost
immediately.
Now you can attach a role to Running instance from Console and from CLI as well
aws ec2 associate-iam-instance-profile --instance-id *InstanceId* --iam-instance-profile Name=*NewInstanceProfileName*
Official Announcment here
You can now attach or replace an AWS Identity and Access Management
(IAM) role to your existing Amazon EC2 instance. IAM roles enable your
applications running on EC2 to use temporary security credentials that
AWS creates, distributes, and rotates automatically. Using temporary
credentials reduces the risk of long-term key compromise.
For more information. Click here