CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2aws-sdkamazon-iam
injoy
injoy

Reputation: 4373

How to manage multiple IAM users on a single EC2 instance?

For different AWS services, I need different IAM users to secure the access control. Sometimes, I even need to use different IAM user credentials within a single project in a EC2 instance. What's the proper way to manage this and how I can deploy/attach these IAM user credentials to a single EC2 instance?

Upvotes: 0

Views: 1177

Answers (2)

toske
toske

Reputation: 1754

While I fully agree with accepted answer that using static credentials is one way of solving this problem, I would like to suggest some improvements over it (and proposed Secrets Manager).

What I would advise as architectural step forward to achieve full isolation of credentials, having them dynamic, and not stored in central place (Secrets Manager proposed above) is dockerizing application and running on AWS Elastic Container Service (ECS). This way you can assign different IAM role to different ECS Tasks.

Benefits over Secrets Manager solution - use case of someone tampering with credentials in Secrets Manager is fully avoided, as credentials are of dynamic nature (temporary, and automatically assumed through SDKs)

  • Credentials are managed on AWS side for you
  • Only ECS Service can assume this IAM role, meaning you can't have actual person stealing the credentials, or developer connecting to production environment from his local machine with this credentials.

AWS Official Documentation for Task Roles

Upvotes: 2

John Rotenstein
John Rotenstein

Reputation: 269091

The normal way to provide credentials to applications running on an Amazon EC2 instance is to assign an IAM Role to the instance. Temporary credentials associated with the role when then be provided via Instance Metadata. The AWS SDKs will automatically use these credentials.

However, this only works for one set of credentials. If you wish to use more than one credential, you will need to provide the credentials in a credentials file.

The AWS credentials file can contain multiple profiles, eg:

[default]
aws_access_key_id = AKIAaaaaa
aws_secret_access_key = abcdefg

[user2]
aws_access_key_id = AKIAbbbb
aws_secret_access_key = xyzzzy

As a convenience, this can also be configured via the AWS CLI:

$ aws configure --profile user2
AWS Access Key ID [None]: AKIAbbbb
AWS Secret Access Key [None]: xyzzy
Default region name [None]: us-east-1
Default output format [None]: text

The profile to use can be set via an Environment Variable:

  • Linux: export AWS_PROFILE="user2"
  • Windows: set AWS_PROFILE="user2"

Alternatively, when calling AWS services via an SDK, simply specify the Profile to use. Here is an example with Python from Credentials — Boto 3 documentation:

session = boto3.Session(profile_name='user2')
# Any clients created from this session will use credentials
# from the [user2] section of ~/.aws/credentials.
dev_s3_client = session.client('s3')

There is an equivalent capability in the SDKs for other languages, too.

Upvotes: 1

Related Questions