amazon-iam

Elastic Beanstalk could not find any platforms

≯℡__Kan透↙ 提交于 2019-12-03 04:27:28
I'm trying to deploy my django app via amazon Elastic BeanStalk(using this tutorial ), but getting the following error. ERROR: Elastic Beanstalk could not find any platforms. Ensure you have the necessary permissions to access Elastic Beanstalk. How can i fix this issue? Thanks! Problem is, as @helloV said, your user does not have access. Now this was a complete surprise to me because I was using the root (which I really shouldn't) and I ASSUMED it would just have access. So solution is that you HAVE TO ATTACH a policy as shown in the screenshot below since even the root IAM account does not

Can't access S3 bucket from within Fargate container (Bad Request and unable to locate credentials)

…衆ロ難τιáo~ 提交于 2019-12-03 03:50:01
I created a private s3 bucket and a fargate cluster with a simple task that attempts to read from that bucket using python 3 and boto3 . I've tried this on 2 different docker images and on one I get a ClientError from boto saying HeadObject Bad request (400) and the other I get NoCredentialsError: Unable to locate credentials . The only real different in the images is that the one saying bad request is being run normally and the other is being run manually by me via ssh to the task container. So I'm not sure why one image is saying "bad request" and the other "unable to locate credentials". I

User is not authorized to perform: cloudformation:CreateStack

拥有回忆 提交于 2019-12-03 02:57:33
问题 I'm trying out Serverless to create AWS Lambdas and while creating a project using the command serverless project create I'm getting the following error. AccessDenied: User: arn:aws:iam::XXXXXXXXX:user/XXXXXXXXX is not authorized to perform: cloudformation:CreateStack on resource: arn:aws:cloudformation:us-east-1:XXXXXXXXX:stack/XXXXXXXXX-development-r/* I have created a user and granted the following permissions to the user. AWSLambdaFullAccess AmazonS3FullAccess CloudFrontFullAccess

Pass AWS credentials (IAM role credentials) to code running in docker container

寵の児 提交于 2019-12-03 02:55:49
When running code on an EC2 instance, the SDK you use to access AWS resources, automagically talks to a locally linked web server on 169.254.169.254 and gets that instances AWS credentials(access_key, secret) that are needed to talk to other AWS services. Also there are other options, like setting the credentials in ENV variables or passing them as command line args ... What is the best practice here? I really prefer to let the container access the 169.254.169.254 (by routing the requests) or even better run a proxy container that mimics the behavior of the real server at 169.254.169.254. Is

AWS API Gateway: How to pass IAM identity to Lambda function?

那年仲夏 提交于 2019-12-02 23:12:35
I've successfully configured IAM-authenticated access to my Lambda function with AWS API Gateway front-end, but unable to find how to pass IAM user identity to my Lambda function. I need exactly IAM user identity and can not run Lambda function under calling IAM-user credentials. All I need - is to get calling IAM-user identity in my Lambda function. Is there option for that? Support for accessing identity and other information from the Amazon API Gateway request context hadn't been available when you posted the question, but recently been added, see Announcement: Context Variables : You can

Inbuilt authentication mechanism - API gateway

跟風遠走 提交于 2019-12-02 18:28:12
问题 API gateway has in-built functionality to perform authorization. But the examples provided by awslabs have lambda hooked to API gateway, where lambda is authorizing as per this code for a below API gateway: MyApi: Type: AWS::Serverless::Api Properties: StageName: Prod Auth: DefaultAuthorizer: MyLambdaRequestAuthorizer Authorizers: MyLambdaRequestAuthorizer: FunctionPayloadType: REQUEST FunctionArn: !GetAtt MyAuthFunction.Arn So, auth token provided by client is received by lambda and then

How to assume an AWS role from another AWS role?

前提是你 提交于 2019-12-02 18:02:45
I have two AWS account - lets say A and B. In account B, I have a role defined that allow access to another role from account A. Lets call it Role-B { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::********:role/RoleA" }, "Action": "sts:AssumeRole" }] } In account A, I have defined a role that allows the root user to assume role. Lets call it Role-A { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::********:root" }, "Action": "sts:AssumeRole" }] } Role A has the following policy attached to it {

How to limit EC2 EBS volume size for ec2:RunInstances in IAM policy?

让人想犯罪 __ 提交于 2019-12-02 17:41:37
问题 The IAM policy I have now is able to limit the instance type, but I want to also be able to limit the EBS volume size to below a certain value. How would I modify the following JSON IAM policy? Preferably I'd want something along the lines of a "Condition": "IntegerLessThanOrEquals", but manually specifying each number is acceptable, as I need to limit it to 10 GiB. { "Version": "2012-10-17", "Statement": [ { "Sid": "AdminPermissions", "Effect": "Allow", "Action": [ "ssm:SendCommand", "ssm

Amazon Cognito Assigning IAM Roles to Groups in user pool and integration with Identity Pool

戏子无情 提交于 2019-12-02 14:11:56
问题 I am trying to use newly added User Groups in User Pool and integrate the same with Federated Identities. I followed these steps: Create Groups in user pool with roles created in IAM having separate policies Create User and add them to user groups Create an Identity Pool and add that Cognito provider under Authentication providers using app id and client id. Here I don't get Authenticated role selection under which I have to select Choose role from token I Save Changes and generate the

ExpiredTokenException when I SAML SSO login AWS from my local IdP

家住魔仙堡 提交于 2019-12-02 09:08:22
I'm building a IdP in my local and I configured the IdP in AWS IAM settings, now I'd like to start an IdP initial SSO from my local and login AWS, however the error always shows in AWS page: Response has expired (Service: AWSSecurityTokenService; Status Code: 400; Error Code: ExpiredTokenException; Request ID: 18fc7e20-97eb-11e9-97e4-0f55a663916e). Please try again. error page screenshot What should I do for this situation? Any help would be appreciated. Here is the SAML Response <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema"