CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2amazon-iam
Pratik C
Pratik C

Reputation: 53

Restrict EC2 permissions for an IAM user to use an AMI

I am the root owner of an AWS account with a couple of private AMIs and volumes. I would like IAM users that are a part of my account to not have access to these, but still be able to create their own AMIs, snapshots and volumes. I could not figure out how to do this via the web interface. I would love some help to do so!

Upvotes: 0

Views: 671

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269091

There are two basic approaches to doing this.

Restrict the Allow

To start with, users have no permissions to do anything. You then grant permissions for what they can do.

When you grant them permission to RunInstances, you can specify that they cannot use the AMI (via NotResource):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Deny running an instance",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "NotResource": [
                "arn:aws:ec2:us-east-1::image/ami-abcd1234"
            ]
        }
    ]
}

Add a Deny

Alternatively, you could grant them permissions as you currently do but then Deny them access to the AMI. A Deny always overrides an Allow:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Deny running an instance",
            "Effect": "Deny",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1::image/ami-abcd1234"
            ]
        }
    ]
}

Upvotes: 3

Related Questions