5,639 questions
0
votes
0
answers
60
views
React to specific IAM Events in AWS
What I am trying to achieve is to trigger specific actions within my AWS Account when specific IAM actions are performed. This appeared to be much more complicated than I expected, so I wanted to ...
-4
votes
1
answer
67
views
Can we achieve assigning roles and listing for multiple accounts using Native Terraform approach for AWS which is suitable for dyanmic too?
using Management account first i need to list all child accounts and i need to create an IAM role and IAM Trust policy with read only access to all child accounts through terraform and all the read ...
1
vote
0
answers
24
views
How to capture IAM user identity in Aurora MySQL audit logs when connecting through AWS TEAM elevated access?
I’m using TEAM elevated access for AWS in my organization to temporarily access an Aurora MySQL cluster.
TEAM provides database access through a tunneled MySQL session using a generic database ...
-1
votes
1
answer
72
views
I tried to make an aws IAM user to see S3 buckets with certain tags
Here is the IAM policy (Mostly by chatgpt) :
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowListAllBucketsForConsole&...
0
votes
1
answer
70
views
AWS S3 SCP Policy to Prevent Disabling Public Access Block but Allow Re-enabling
I need to create an AWS IAM policy that prevents users from disabling the "Block all public access" configuration on S3 buckets, but still allows them to re-enable it if it was already ...
0
votes
1
answer
38
views
AWS Lambda not triggering on S3 ObjectCreated:Put after code edit. What am I missing?
I have an S3 bucket that should invoke a Lambda function on ObjectCreated:Put. This used to work. After editing the Lambda code in the console, new uploads stopped triggering the function. I do not ...
0
votes
1
answer
62
views
What is the correct IAM resource for allowing querying on CloudWatch metrics?
I have a nodejs service that queries CloudWatch metrics. Specifically, the AWS/ES namespace. For development I use a poweruser, so the access is straightforward and it works. But in deployed envs I ...
0
votes
0
answers
83
views
EMR Spark Job Fails to Connect to MSK with IAM Auth - Timeout Waiting for Node Assignment Error
I am running an Apache Spark job on Amazon EMR that needs to connect to an Amazon MSK cluster configured with IAM authentication. The EMR cluster has an IAM role with full MSK permissions, and I can ...
-1
votes
1
answer
79
views
AWS IAM permission policy for EC2 instances access doesn't work [closed]
I'm new to AWS and I want to restrict access for a group of users to have full access to EC2 services only. Below are the steps I did:
Created a IAM group named "EC2 Admins"
Created an ...
0
votes
1
answer
61
views
IAM Policy for edit EC2 tags of instance
I want an IAM policy that allows an EC2 instance to modify it's own name tag. It should not have permission to modify the tags of any other instance.
It is my understanding that this should work. ...
0
votes
1
answer
46
views
DP for AWS multi account role provision from central org
I have multiple AWS accounts linked to a single org account.
I would like to provision:
'IAM Admin' roles in each, with a policy which allows IAM:* such that it can create and provision policy for ...
0
votes
0
answers
51
views
AWS Glue and IAM conditional access
How to write an AWS IAM Policy document such that it does the following:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "ec2:...
1
vote
0
answers
30
views
Trust policy issues with 'dms-access-for-endpoint' IAM role
I'm building DMS solution which pulls data from Azure SQL Server to Redshift. I'd like to limit the Trust Policy of the dms-access-for-endpoint role. All works fine with the basic setup, ie:
{
...
0
votes
0
answers
40
views
Use session tags to propagate tags for resources
I'm trying to use AWS IAM Session Tags for a specific purpose. We already created an ECS Cluster and usually ECS Tasks are created for an internal purpose in our company. ECS Tasks are created by an ...
0
votes
0
answers
59
views
AWS S3: (403) when calling the HeadBucket operation: Forbidden
I have been trying for some time now to execute the following command in my AWS CodeBuild project:
aws s3api head-bucket --bucket my-bucket-name --region ca-central-1
Yet I get the following error ...