Home / server / Questions / 368519
Accepted
timday
Asked: 2012-03-12 03:35:42 +0800 CST

Possible to limit an EC2 key to just ec2-associate-address?

  • 772

I have a regular EC2 instance with an elastic IP. The few times the instance has been stopped, I've just manually re-associated the IP with it via the AWS Management console. I'm now thinking about migrating it to a spot instance, which means I want a way of automatically re-associating it the IP on startup if/when the machine is shutdown due to being priced out of the market. How to achieve this is well described in numerous places (e.g here).

My question is:

Like many people with this problem, I'm wary of putting my AWS credentials file on the instance itself. I have a vague memory of seeing something about it being possible to create additional keys with more limited permissions, but am having trouble finding any concrete details. So: is it possible to create a key which I can happily put on the machine knowing it can be used for little more than an ec2-associate-instance (but not login to other instances, or generally running riot with my AWS account), and how would I actually achieve this ?

security amazon-ec2 amazon-elastic-ip

2 Answers

  1. Best Answer

    This is indeed possible by means of AWS Identity and Access Management (IAM), which enables you to securely control access to AWS services and resources for your users (facilitating IAM instead of the main account credentials for everyday AWS usage is nowadays highly recommended accordingly).

    Amongst several others, IAM enables the following use case:

    Fine-grained access control to your AWS resources: IAM enables you to control access to AWS service APIs and to specific resources. IAM also enables you to add specific conditions to control how a user can use AWS, such as time of day, their originating IP address, or whether they are using SSL.

    The respective granularity varies between the available AWS services (it tends to get increased over time), but fortunately granularity for the EC2 API is high and what you are looking for is readily available - for example, you might want to check out the recommended AWS Policy Generator, select type IAM Policy and service Amazon EC2, which will allow you to select action AssociateAddress in turn.

    Consequently you should be able to achieve your goal by creating a dedicated IAM user for the task at hand, crafting an IAM policy essentially limited to AssociateAddress (maybe DisassociateAddress as well) and assigning this policy to the IAM user - e.g. the policy might look like this:

    {
  "Statement": [
    {
      "Action": [
        "ec2:AssociateAddress",
        "ec2:DisassociateAddress"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
    • 9

  2. This is supported based on the document here. Make sure that you have the TAGs on the instance and the interface if you have 2 interfaces.

    • 0