在 AWS 上运行 python 脚本，该脚本只能由单个 IAM 用户执行

Question

I have a python script whose boto3 operations/function calls must be restricted to a single IAM user which has extremely limited access. My understanding is that the execution of the script depends on the configured profile for AWS CLI. Would that sort of restriction have to done inside the script?

Answer 1

The script could be created as a AWS Lambda function. Only the single IAM user should then be given access to execute that function.

Another script can be written to invoke that Lambda ( boto3.client("lambda").invoke() ). Anyone can execute that script, but anyone but the right user will get an AccessPermissions error.

Note:

• There are limitations on the execution time/memory allocation for AWS lambdas, which might make this a bad solution for your current script. That really depends on what your script exactly does.