如何创建可以为我创建ec2实例的AWS用户？

Question

I have outsourced the development of some services to another company, and now I need the other company to be able to create an ec2 instance on my behalf.

I have other instances which I don't want the company to view and be able to change.

I know how to create an IAM-user but I don't know how to create the right policy to give that user access to ec2 and to create and manage instances, he/she has created, without having access to other instances.

Is it possible and if yes, how does that policy look like ?

thanks

Thomas

Answer 1

This is not a simple answer. Creating an instance requires permission to call the RunInstances command, but would also need permission to use the associated Security Group and AMI. The other company would also likely want the ability to view details of the instance(s) they have launched, and the ability to Start/Stop it.

In fact, the EC2 Management Console doesn't work well if you deny permission to view existing EC2 instances.

Resource-specific permissions can be granted, which allow only calls that affect a particular instance (or VPC, AMI, etc). So, a RunInstances command could be limited to a specific AMI, keypair, snapshot, subnet, etc. The StopInstances command could then be limited to the instance they created (but you'd need the ID, so you can only grant that once the instance is launched).

Also, please note that launching an instance requires permissions in Identity and Access Management (IAM), which is separate to permissions to login to an instance.

Recommendation: It might be safest if you were to launch the instance for them, then provide them with access to login to the instance to perform their work. If they require more access to your AWS Account, it could become quite involved determining to which resources they should/shouldn't have access.

See:

• Resource-level Permissions for EC2 – Controlling Management Access on Specific Instances
• Supported Resource-Level Permissions for Amazon EC2 API Actions