I am deploying an EC2 instance using CloudFormation and I need to publish information about the created instance to an HTTP endpoint. I plan on doing this using SNS. However, I do not want the instance to have permanent access to publish to the endpoint or be able to use the AWS CLI.
Is there a way to deploy the instance with permission to publish to a specified SNS topic and then rescind permission immediately afterwards?
Use IAM (IAM and Amazon SNS Policies Together) to create a SNS Role which has just enough privileges to publish a specified SNS topic.
Launch the instance and specify the your role as instance's IAM profile
After publishing, remove the SNS privileges from the role using the IAM dashboard or from the instance (make sure the role has privileges to rescind the permission)
Related
I'm trying to create a botocore session (that does not use my local AWS credentials on ~/.aws/credentials). In other words, I want to create a "burner AWS account". With that burner credentials/session, I want to setup an STS client and with that client, assume a role in order to access a DynamoDB database. Can someone provide some example code which accomplishes exactly this?
Because if I want my system to go into production environment, I CANNOT store the AWS credentials on Github because AWS will scan for it. I'm trying to implement a workaround such that we don't have to store ~/.aws/credentials file on Github.
The running a task in Amazon ECS, simply assign an IAM Role to the task.
Amazon ECS will then generate temporary credentials for that IAM Role. Any code that uses an AWS SDK (such as boto3 for Python) knows how to access those credentials via the metadata service.
The result is that your code using boto3 will automatically receive credentials that have the permissions associated with the IAM Role assigned to the task.
See: IAM roles for tasks - Amazon Elastic Container Service
I want to create a S3 Bucket via CloudFormation template. I found there is a way to do it for EC2 instance on this link.
Do we have a way to create S3 bucket using existing IAM role via cloudformation?
It looks like what you're looking for is a service role. From AWS:
A service role is an AWS Identity and Access Management (IAM) role that allows AWS CloudFormation to make calls to resources in a stack on your behalf. You can specify an IAM role that allows AWS CloudFormation to create, update, or delete your stack resources. By default, AWS CloudFormation uses a temporary session that it generates from your user credentials for stack operations. If you specify a service role, AWS CloudFormation uses the role's credentials.
For more information, you might want to take a look at this, specifically the permission part to find out how to use an existing IAM role for creating a Cloudformation stack.
By the way: Unfortunately the link that you've provided doesn't seem to be accessible anymore.
When deploying infrastructure using creating Cloudformation template, you can have 2 ways to do it:
Cloudformation can deploy resources using the permissions of the current user who deploys the CF template. This is the default way
Secondly (Optional), you can choose an existing role that can be attached to the CF template. Cloudformation service will use the permissions of that attached role to deploy all the required services. Given that the attached role has permissions to S3, you can create an S3 bucket as can be seen in the attached screenshot
How we can restrict an IAM User to launch EC2 Instance and VPC via Cloudformation only. I don't want user to launch the EC2 instance and VPC directly by console.
Two options:
Use a role with AWS CloudFormation
When launching a CloudFormation stack, a role can be specified. This role can have the necessary permissions to launch the stack, even if the user doesn't have it.
See: AWS CloudFormation Service Role - AWS CloudFormation
Use AWS Service Catalog
AWS Service Catalog allows you to create a portfolio of offerings that users can launch. It uses a role to launch services even if the user themselves doesn't have permission to launch the services themselves.
See: AWS Service Catalog Documentation
Everywhere I can see IAM Role is created on EC2 instance and given Roles like S3FullAccess.
Is it possible to create IAM Role on S3 instead of EC2? And attach that Role to S3 bucket?
I created IAM Role on S3 with S3FULLACCESS. Not able to attach that to the existing bucket or create a new bucket with this Role. Please help
IAM (Identity and Access Management) Roles are a way of assigning permissions to applications, services, EC2 instances, etc.
Examples:
When a Role is assigned to an EC2 instance, credentials are passed to software running on the instance so that they can call AWS services.
When a Role is assigned to an Amazon Redshift cluster, it can use the permissions within the Role to access data stored in Amazon S3 buckets.
When a Role is assigned to an AWS Lambda function, it gives the function permission to call other AWS services such as S3, DynamoDB or Kinesis.
In all these cases, something is using the credentials to call AWS APIs.
Amazon S3 never requires credentials to call an AWS API. While it can call other services for Event Notifications, the permissions are actually put on the receiving service rather than S3 as the requesting service.
Thus, there is never any need to attach a Role to an Amazon S3 bucket.
Roles do not apply to S3 as it does with EC2.
Assuming #Sunil is asking if we can restrict access to data in S3.
In that case, we can either Set S3 ACL on the buckets or the object in it OR Set S3 bucket policies.
I am trying to configure jboss to use AWS IAM Roles for accessing S3 and SQS. All of the documentation I've seen uses static access and secret keys rather than the dynamic keys that roles allow for.
Is there any documentation on doing this?
Create an EC2 instance assigning that Role. Whatever you run any app in that instance will be able to access the AWS resources.
This way you don't need to write any code for security within the application.
Also in your code you don't need to supply any credentials when you assign the role to the EC2 instance.
In AWS there are two approaches to provide permission using AWS IAM to your code to access AWS resources such as S3 and SQS.
If your code runs in Amazon Compute Services such as EC2, Lambda it is recommended to create a IAM Role with required policies to access S3 & SQS also allowing the Compute Service (EC2, Lambda) to assume that role (Using Trust Relationships). After attaching this role, either to EC2 or Lambda, you can directly use AWS SDK to access S3 and SQS without needing any credentials or access tokens to configure for SDK.
For more information, see Using an IAM Role to Grant Permissions to
Applications Running on Amazon EC2 Instances.
If your code runs on premise or external to the Amazon infrastructure, you need to create a IAM user with required policies and also create access keys (Access Key ID & Secret Key) and initialize SDK to allow access to S3 or SQS as shown below.
var AWS = require('aws-sdk');
AWS.config.credentials = new AWS.Credentials({
accessKeyId: 'akid', secretAccessKey: 'secret'
});