限制用户启动 EC2 实例

Question

I want to set up cloud access where I will be creating EC2 instances and assigning to the users. I do not want the participants to launch new instances but be able to start, stop and login to their instances. Also I need a way to share the pem files securely to them. I have created IAM users and groups but struck with the IAM policies and sharing the keys.

Answer 1

Here is an interesting Serverfault response on how to let other users access the EC2. There is no need to share the pem file which has the Private Key. This can be done via sharing the Public Key of the users who need to access the EC2. And there is no need to secure the Public Key.

As far as giving the appropriate permissions to the users, the default AWS policies won't be sufficient and a customer managed policy has to be created as mentioned in the AWS documentation here .

Use the below JSON while creating the policy. Note that creating Policies in AWS is free.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:DescribeInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        }
    ]
}

Answer 2

you need to use role: for example simple-developer that can't create the ec2 instance and assign the role to the users