limiting aws ec2 users

Question

Is it possible to create a sub-account or sub-user that is limited in what he can see and/or do in AWS based on tags for example?

I have tried using policies, but for instances this wouldn't work, because you can't limit it on a resource level.
This makes it that either they can controll and see everything, or nothing at all.

is there anything that I have missed?

Answer 1

The question scope just too wide. Please study the IAM Guides and play around with IAM policy generator condition. Even playing around with ARN that allow wildcard, you still need to define some explicit prefix/suffix for those wildcard values. For EC2, you need to understand EC2 resource ARN and possible need to mix with "Condition" to add restriction.

Here is an example of using policy generator for a policies that only allow run,start and stop instance, and it restrict to EC2 with resource tag serverX. When you attach this policy to the user, they can only do the following task. You may need to add further condition to make sure the user doesn't see instances belongs to others, by enforcing the tag name creation yourself.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1462794515000",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:RunInstances",
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Condition": {
                "StringLike": {
                    "ec2:ResourceTag/Name": "serverX"
                }
            },
            "Resource": [
                "arn:aws:ec2::1234567890:instance/*"
            ]
        }
    ]
}

You can play around with AWS policy Simulator . Another good reference is AWS inline policies and managed policies