amazon-iam | 易学教程

Is there anyway to determine what IAM permissions I actually need for a CloudFormation template?

阅读更多关于 Is there anyway to determine what IAM permissions I actually need for a CloudFormation template?

问题 Just wondering whats the best practice for determining what permissions I should give for my CloudFormation template? After some time of trying to give the minimal permissions it require, I find that thats really time consuming and error prone. I note that depending on the state of my stack, really new vs some updates vs delete, I will need different permissions. I guess, it should be possible for there to be some parser that given a CloudFormation template can determine the minimum set of

Cross account role for an AWS Lambda function

阅读更多关于 Cross account role for an AWS Lambda function

I have two AWS account (A and B). On my account A, I have a lambda function which need to access to resources of account B. Precisely, my lambda on my account A, need to update a record in a Route53 zone hosted on my account B. Contrary to S3, I don't see any resource access policy in Route53. So I'm a bit lost. I tried to play with IAM cross account roles, but that does not seems to work with lambda. How can I allow a lambda function on an account A to access resources of my account B? You can create a Role in account B and permit your User (in account A) to assume it. Create a Role in

SAML IdP - AWS Cognito/IAM as an Identity Provider

阅读更多关于 SAML IdP - AWS Cognito/IAM as an Identity Provider

问题 I know services such as Auth0 can act as both SAML IdPs and integrate with third party IdPs. It would seem that Cognito can only integrate with other third party IdPs as a service provider, it can actually perform the role of an IdP. The use case is we have our apps creating users in Cognito. We'd like to use a third party application which can integrate with a SAML IdP to support SSO. Is this possible with Cognito or would we need to use something like Auth0? 回答1: Currenlty, Cognito is an

SAML IdP - AWS Cognito/IAM as an Identity Provider

阅读更多关于 SAML IdP - AWS Cognito/IAM as an Identity Provider

I know services such as Auth0 can act as both SAML IdPs and integrate with third party IdPs. It would seem that Cognito can only integrate with other third party IdPs as a service provider, it can actually perform the role of an IdP. The use case is we have our apps creating users in Cognito. We'd like to use a third party application which can integrate with a SAML IdP to support SSO. Is this possible with Cognito or would we need to use something like Auth0? Currenlty, Cognito is an OIDC IdP and not a SAML IdP. If an application supports OIDC, you can use Cognito to connect to that. We have

Within IAM, can I restrict a group of users to access/launch/terminate only certain EC2 AMIs or instances?

阅读更多关于 Within IAM, can I restrict a group of users to access/launch/terminate only certain EC2 AMIs or instances?

问题 What the title says. Within the master AWS account, I have several personal accounts, i.e. AWS Identity and Access Management (IAM) users. I would like to assign certain IAM users to groups and prevent them from terminating certain Amazon EC2 instances, de-registering certain Amazon Machine Images (AMIs), etc. I don't mind if they're playing with their own stuff, but I don't want them to touch my stuff. Is that possible? 回答1: Update AWS has just announced Resource-Level Permissions for Amazon

Within IAM, can I restrict a group of users to access/launch/terminate only certain EC2 AMIs or instances?

阅读更多关于 Within IAM, can I restrict a group of users to access/launch/terminate only certain EC2 AMIs or instances?

What the title says. Within the master AWS account, I have several personal accounts, i.e. AWS Identity and Access Management (IAM) users. I would like to assign certain IAM users to groups and prevent them from terminating certain Amazon EC2 instances , de-registering certain Amazon Machine Images (AMIs) , etc. I don't mind if they're playing with their own stuff, but I don't want them to touch my stuff. Is that possible? Update AWS has just announced Resource-Level Permissions for Amazon EC2 and Amazon RDS to address this long standing shortcoming of IAM support within EC2 and RDS (in

Logs for actions on amazon s3 / other AWS services

阅读更多关于 Logs for actions on amazon s3 / other AWS services

问题 I am trying to see which user was responsible for changes in S3 (at buckets level). I could not find a audit trail for actions done at S3 bucket level or EC2 who created instances. Beanstalk has a log of the actions the machine performed, but not which user. Is there a way around AWS that we can see this information in IAM or any other location ? P.S: I am not interested to know about S3 log buckets which provide access logs 回答1: Update AWS has just announced AWS CloudTrail, finally making

AWS create role - Has prohibited field

阅读更多关于 AWS create role - Has prohibited field

I am trying out a simple example suggested by AWS documentation to create a role using a policy json file http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-service.html And I get the error A client error (MalformedPolicyDocument) occurred when calling the CreateRole operation: Has prohibited field Resource Here's the command, >> aws iam create-role --role-name test-service-role --assume-role-policy-document file:///home/ec2-user/policy.json A client error (MalformedPolicyDocument) occurred when calling the CreateRole operation: Has prohibited field Resource The policy is the

aws lambda function getting access denied when getObject from s3

阅读更多关于 aws lambda function getting access denied when getObject from s3

问题 I am getting an acccess denied error from S3 AWS service on my Lambda function. This is the code: // dependencies var async = require('async'); var AWS = require('aws-sdk'); var gm = require('gm').subClass({ imageMagick: true }); // Enable ImageMagick integration. exports.handler = function(event, context) { var srcBucket = event.Records[0].s3.bucket.name; // Object key may have spaces or unicode non-ASCII characters. var key = decodeURIComponent(event.Records[0].s3.object.key.replace(/\+/g,

How to grant permissions to AWS user for Hartl's rails tutorial

阅读更多关于 How to grant permissions to AWS user for Hartl's rails tutorial

I don't know how (or where also) to grant read and write permission to the user from AWS so users can post pictures on sample_app in production enviroment. This is final task in 11th chapter, it isn't covered by tutorial and I can't find solution anywhere. This is carrier_wave.rb file: if Rails.env.production? CarrierWave.configure do |config| config.fog_credentials = { # Configuration for Amazon S3 :provider => 'AWS', :aws_access_key_id => ENV['lalala'], :aws_secret_access_key => ENV['oloalle'] } config.fog_directory = ENV['name of bucket'] end end This is procedure from tutorial: 1) create