I am trying to validate action ec2:AttachVolume using policy simulator sdk java API.
my policy looks as follows
{
"Action": [
"ec2:AttachVolume"
]
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Action": [
"ec2:AttachVolume"
]
},
"Effect": "Allow",
"Resource": [
"arn:aws:ec2:*:*:volume/*"
]
}
How can i validate it using policy simulator API as I need to provide both the resource i.e. instance and volume?
With this policy the simulator works fine for me:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": [
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"ArnEquals": {
"ec2:SourceInstanceARN": "arn:aws:ec2:*:*:instance/i-1234567890"
}
}
}
]
}
Related
I tried to implement the AWS Permission Boundary to user1 who has full permission on IAM actions. Then user1 created a another user (user2). The user2 is apple to do any actions without any restriction. As I understood, the user2 should not have more permission than user1. Anyone had same issue? anyone got any sample Permission Boundary policy?
Had a kind of same issue with AWS Permission Boundary and issue was with the the policy didn't deny some permission. Eg: DeleteUserPermissionsBoundary, DeleteRolePermissionsBoundary
You can find the full video explanation here: https://youtu.be/ExjW3HCFG1U?t=3402
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "IAMAccess",
"Effect": "Allow",
"Action": "iam:*",
"Resource": "*"
},
{
"Sid": "DenyCreatingUserWithoutPermisionBoundary",
"Effect": "Deny",
"Action": [
"iam:CreateUser",
"iam:CreateRole"
],
"Resource": [
"arn:aws:iam::YOUR_ACCOUNT_ID:user/*",
"arn:aws:iam::YOUR_ACCOUNT_ID:role/*"
],
"Condition": {
"StringNotEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::YOUR_ACCOUNT_ID:policy/permission-boundary"
}
}
},
{
"Sid": "DenyDeletingPolicy",
"Effect": "Deny",
"Action": [
"iam:DeletePolicy",
"iam:DeletePolicyVersion",
"iam:CreatePolicyVersion",
"iam:SetDefaultPolicyVersion"
],
"Resource": [
"arn:aws:iam::YOUR_ACCOUNT_ID:policy/permission-boundary"
]
},
{
"Sid": "DenyDeletingPermBoundaryFromAnyUserOrRole",
"Effect": "Deny",
"Action": [
"iam:DeleteUserPermissionsBoundary",
"iam:DeleteRolePermissionsBoundary"
],
"Resource": [
"arn:aws:iam::YOUR_ACCOUNT_ID:user/*",
"arn:aws:iam::YOUR_ACCOUNT_ID:role/*"
],
"Condition": {
"StringEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::YOUR_ACCOUNT_ID:policy/permission-boundary"
}
}
},
{
"Sid": "DenyUpdatingPermissionBoundary",
"Effect": "Deny",
"Action": [
"iam:PutUserPermissionsBoundary",
"iam:PutRolePermissionsBoundary"
],
"Resource": [
"arn:aws:iam::YOUR_ACCOUNT_ID:user/*",
"arn:aws:iam::YOUR_ACCOUNT_ID:role/*"
],
"Condition": {
"StringNotEquals": {
"iam:PermissionsBoundary": "arn:aws:iam::YOUR_ACCOUNT_ID:policy/permission-boundary"
}
}
}
]
}
I am trying to implement an AWS tagging policy at the AWS Organization level.
This will cover many AWS services but the immediate issue is related to EC2.
This policy results in an error when I try to use the AWS CLI command : ec2 run-instance.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyResourceCreationSCP",
"Effect": "Deny",
"Action": [
"ec2:Create*",
"ec2:Run*",
"elasticfilesystem:Create*",
],
"Resource": [
"*"
],
"Condition": {
"Null": {
"aws:RequestTag/project": "true"
}
}
}
]
}
However this policy succeeds.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyResourceCreationSCP",
"Effect": "Deny",
"Action": [
"ec2:Create*",
"elasticfilesystem:Create*",
],
"Resource": [
"*"
],
"Condition": {
"Null": {
"aws:RequestTag/project": "true"
}
}
},
{
"Sid": "DenyResourceCreationSCPEC2",
"Effect": "Deny",
"Action": [
"ec2:RunInstance"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"Null": {
"aws:RequestTag/project": "true"
}
}
}
]
}
Can someone explain please why the resource condition for "*" full wildcard does not work for ECS2 RunInstance?
Why does the volume,instance,security-group-network-interface resource type need to be explicit?
Thanks
I can easily deny the deployment of an AWS Image via arn-ami "arn:aws:ec2:*::image/ami-xxx" within an IAM policy but I'm trying to deny all RedHat Images (Marketplace / Community AMIs) deployments
Is this possible via Resource tag and AMI-Name "RHEL-8.2.0_HVM-20200423-x86_64-0-Hourly2-GP2"
Exmaple
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyAMIAccess",
"Effect": "Deny",
"Action": [
"ec2:RunScheduledInstances",
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*::image/ami-0810abbfb78d37cdf",
"arn:aws:ec2:*::image/ami-0e2cfc23d72b5cb98",
"arn:aws:ec2:*::image/name/RHEL*",
"arn:aws:ec2:*::image/RHEL*"
]
}
]
}```
Try the below along with "Allow" for Resources "*"
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyAMIAccess",
"Effect": "Deny",
"Action": [
"ec2:RunScheduledInstances",
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*::image*"
],
"Condition": {
"StringNotLike": {
"aws:RequestTag/Name": "RHEL"
}
}
},
{
"Sid": "DenyAMIAccess",
"Effect": "Deny",
"Action": [
"ec2:RunScheduledInstances",
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*::image*"
],
"Condition": {
"Null": {
"aws:RequestTag/Name": "true"
}
}
}
]
}
I'm trying to create a policy that allows users to have all IAM actions except any action contains the word "User" or "Group" in the string, so they can still do other actions like: "CreateRole", "ChangePassword", etc.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:*"
],
"Resource": "*",
"Condition": {
"StringNotLike": {
"iam": [
"*User*",
"*Group*"
]
}
}
}
]
}
But I got this notification: "This policy does not grant any permissions.". I've tried with "StringLike".
According to AWS Docs:
StringNotLike
Negated case-sensitive matching. The values can include a
multi-character match wildcard (*) or a single-character match
wildcard (?) anywhere in the string.
If I do this:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:*"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": [
"iam:*User*",
"iam:*Group*"
],
"Resource": "*",
"Condition": {
"StringLike": {
"iam:": ["Create*", "Delete*"]
}
}
}
]
}
The the policy allows full access.
You can add a deny * action to your policy. It would deny everything that was not explicitly allowed.
Take a look at the bellow for an example.
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"iam:AddRoleToInstanceProfile",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:GetRole",
"iam:GetRolePolicy",
"iam:ListInstanceProfiles",
"iam:ListInstanceProfilesForRole",
"iam:ListRoles",
"iam:ListPolicies",
"iam:ListRolePolicies",
"iam:ListAttachedRolePolicies",
"iam:RemoveRoleFromInstanceProfile"
],
"Resource": [
"*"
],
"Effect": "Allow"
},
"Resource": [
"*"
],
"Effect": "Deny"
}
]
}
I had to do explicit deny like this. It works but I'm open to better solution.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:*"
],
"Resource": "*"
},
{
"Effect": "Deny",
"Action": [
"iam:CreateGroup",
"iam:DeleteGroup",
"iam:UpdateUser",
"iam:PutUserPermissionsBoundary",
"iam:AttachUserPolicy",
"iam:DeleteUserPolicy",
"iam:UpdateGroup",
"iam:DeleteUser",
"iam:DeleteUserPermissionsBoundary",
"iam:CreateUser",
"iam:RemoveUserFromGroup",
"iam:AddUserToGroup",
"iam:AttachGroupPolicy",
"iam:PutUserPolicy",
"iam:DetachGroupPolicy",
"iam:DetachUserPolicy",
"iam:DeleteGroupPolicy",
"iam:PutGroupPolicy"
],
"Resource": "*"
}
]
}
How to create an IAM role inside a SAM template likewise I did in SAM package.
I tried this as following:
"lambdaFunctionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"lambda.amazonaws.com",
"apigateway.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
},
"ManagedPolicyArns": [
{
"Ref": "lambdaBasePolicy"
}
],
"Policies": [
{
"PolicyName": "root",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"s3:*",
"dynamodb:*",
"iam:ListRoles",
"ses:*",
"events:*"
],
"Resource": "*"
}
]
}
}
]
}
}
It throws me an error : com.amazonaws.serverlessappsrepo.template.InvalidTemplateException: Resource with name [lambdaFunctionRole] is invalid. AWS::Serverless::Role is not a supported Serverless Apps Repository Type.
When publishing to the Serverless app repo, you need to take care to use only the supported resources in you SAM template.
In your case, you can skip creating the lambdaFunctionRole as a standalone resource and just create it inline in your function resource definition.
"lambdaFunction": {
"Type": "AWS::Serverless::Function",
"Policies": [
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"s3:*",
"dynamodb:*",
"iam:ListRoles",
"ses:*",
"events:*"
],
"Resource": "*"
}
]
}
]
}
Notice that I've only copied the PolicyDocument part of the Policies in the Role. See the Policies section in the SAM spec.