CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2boto3amazon-iam
Underoos
Underoos

Reputation: 5200

How to create an IAM role of specific type using boto3?

I'm trying to lock down a user to a specific VPC in AWS and following How to Help Lock Down a User’s Amazon EC2 Capabilities to a Single VPC | AWS Security Blog.

It is mentioned that we need to create an IAM role with name VPCLockDown of type AWS Service

IAM role type

and add the services for which the role needs access to. like ec2, lambda etc.

I was trying to create this role programatically using boto3.

I checked the create_role documentation for creating a role using boto3.

However, they haven't mentioned anything to specify the type of role and the services that I can specify that the role should have access to.

Is there any way to specify these items while creation of the IAM role using boto3

Edit1:

I tried creating a service_linked_role as per Sudarshan Rampuria's answer like 

response = iam.create_service_linked_role(
            AWSServiceName='ec2.amazonaws.com',
        )

But getting the following error:

An error occurred (AccessDenied) when calling the CreateServiceLinkedRole operation: Cannot find Service Linked Role template for ec2.amazonaws.com

Upvotes: 0

Views: 511

Answers (3)

vangap
vangap

Reputation: 252

For anyone trying to do this for Lambda, we get the similar error mentioned by the question author under "Edit". Lambda doesn't have a service linked role. You can see from the AWS Lambda documentation that "create-role" is used for creating lambda execution role. You can also see here that only Lambda@Edge has service linked role.

One just needs to use use boto3 create-role with a policy document

        response = iam_client.create_role(
        RoleName="some-role-name",
        AssumeRolePolicyDocument='{"Version": "2012-10-17","Statement": [{ "Effect": "Allow", "Principal": {"Service": "lambda.amazonaws.com"}, "Action": "sts:AssumeRole"}]}',
        Description='Lambda role'
    )

Upvotes: 0

John Rotenstein
John Rotenstein

Reputation: 270184

Here is a policy that allows a specific IAM User to launch an instance (RunInstances), but only in a given VPC:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2RunInstancesVPC",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:ap-southeast-2:111111111111:subnet/*",
            "Condition": {
                "StringEquals": {
                    "ec2:vpc": "arn:aws:ec2:ap-southeast-2:111111111111:vpc/vpc-abcd1234"  <--- Change this
                }
            }
        },
        {
            "Sid": "RemainingRunInstancePermissions",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:ap-southeast-2:111111111111:instance/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:volume/*",
                "arn:aws:ec2:ap-southeast-2::image/*",
                "arn:aws:ec2:ap-southeast-2::snapshot/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:network-interface/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:key-pair/*",
                "arn:aws:ec2:ap-southeast-2:111111111111:security-group/*"
            ]
        }
    ]
}

You might need to change the Region. (I tested it in the Sydney region.)

Upvotes: 0

Sudarshan Rampuria
Sudarshan Rampuria

Reputation: 287

You can use create_service_linked_role() function boto3 to link a role to a service. https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/iam.html#IAM.Client.create_service_linked_role

Upvotes: 1

Related Questions