Amazon AWS IAM User - amazon-web-services

Question

I want to give access to my developer to set up EC2 and MongoDB for my app. Basically, moving everything from his server to my on AWS.
I created a Group called "Developer" and set the Policy to "PowerUserAccess".
I have added a User to this group, meaning he now has "PowerUserAccess" access.
My question:
Should I specify more permission now for that specific user as it seems to me that he now has more access than he actually needs? If yes, how to do so?

Answer 1

Poweruseraccess Group basically have full access to all aws services except management of IAM settings.
This subject very well documented with user case scenarios and best practices on AWS

Answer 2

Provide access only to EC2 Instances using "AmazonEC2FullAccess".
Launch an EC2 instance and provide the Public IP and the key(or create a user) to Developer, So that he can configure the instance.
If the server is an EC2 Instance, you can ask him to create an AMI and share the AMI with your account.
Basically, moving everything from his server to my on AWS.

Answer 3

Try to limit the permissions to only what is necessary for the developer to perform thier function and meet your business requirements. You can do that by creating a Developer group with a customer managed policy that meets these conditions:
Restrict the group permissions to a region or regions you'd like your app to run in.
Create a VPC and restrict the group to only create EC2 instances in this VPC to limit a breach to not affect or communicate with other instances.
For cost considerations, decide what time of instances are necessary for your business requirements and restrict the permissions to that.
Here's how you can apply this policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": [
"arn:aws:ec2:[region]:[account id]:instance/*"
],
"Condition": {
"StringEquals": {
"ec2:InstanceType": "m1.small"
},
"ArnEquals": {
"ec2:Vpc": "arn:aws:ec2:[region]:[account id]:vpc/[vpv id]"
}
}
}
]
}
It is possible that you don't need to specify both the VPC and EC2 instance resource to restrict this to a specific region. Specifying the VPC condition might be enough. You could simply replace the resource value with a * e.g "Resource": "*".

Answer 4

I suggest you create different groups with different granular permissions.
For instance,
You would want to give some developers read access only, some developer read and write and some read, write & delete access.
Thus, you can create three groups-
DeveloperWithReadAccess,
DeveloperWithReadAndWriteAccess
DeveloperWithReadWriteDeleteAccess
So that generic access can be given using aws managed policies and customer managed policies. If you have any specific case, then you can use inline policy for any specific user.
Official white also suggests the same.
IAM groups are a powerful tool for managing access to AWS resources. Even if you only have one user who requires access to a specific resource, as a best practice, you should identify or create a new AWS group for that access, and provision user access via group membership, as well as permissions and policies assigned at the group level.
You can read the same at
https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Best_Practices.pdf