112 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
-1
votes
1
answer
50
views
AWS Root Account MFA Call Not Working – Unable to Sign In [closed]
I cannot sign in to my AWS root account because I am blocked at the MFA step. Email verification works, but the phone call verification fails and AWS does not call my registered number, even though it ...
0
votes
1
answer
63
views
IAM Policy for edit EC2 tags of instance
I want an IAM policy that allows an EC2 instance to modify it's own name tag. It should not have permission to modify the tags of any other instance.
It is my understanding that this should work. ...
0
votes
0
answers
60
views
AWS policy: conditionally show resources (RDS, CodePipeline, CloudWatch) using tags
I'm writing a group policy for AWS console access. I want the user to see an RDS (or CodePipeline or CloudWatch) resource only if it has a specific tag. I read the action type for RDS and doesn't seem ...
0
votes
1
answer
51
views
Restrict S3 bucket Access to all the Roles except specific Role
I have around 150 roles in my AWS Account. I have created a new S3 bucket under existing bucket
Primary-Bucket/New-Bucket
I wanted to restrict access to New-Bucket for all other roles except couple of ...
0
votes
0
answers
52
views
Serverless Offline with EventBridge Scheduler Error: The execution role you provide must allow AWS EventBridge Scheduler to assume the role
As the title says, I'm encountering this error when running in SLS Offline. I just want to confirm if EventBridge Scheduler really isn't supported by SLS Offline?
resources.ts
export const resources = ...
0
votes
1
answer
54
views
How to provide limited view to AWS IAM resources
Hello: I'm managing an AWS account for students to practice AWS's resources management. Each student has it's own IAM user with PowerUserAccess permissions (TL;DR: Allows anything except users and ...
0
votes
0
answers
132
views
Is CDK's auto-generated AssumeRolePolicy sufficient, or should I specify a condition for specific ARN(s)?
I've been working with CDK for a bit, and haven't had any reason to modify any of the default roles/policies that are auto-generated when I create resources like lambdas or step functions. However, I ...
1
vote
1
answer
380
views
Issue while adding VPC to AWS Lambda function: The provided execution role does not have permissions to call CreateNetworkInterface on EC2
So, something weird is happening which I can't seem to wrap my head around.
I have a lambda function, whose execution role has the AWS Managed AWSLambdaVPCAccessExecutionRole in it.
This role has ec2:...
-1
votes
1
answer
106
views
AWS Glue Crawler: Unable to Add Tags During Creation Without Explicit glue:TagResource Permission
Recently, I noticed a change in behavior while creating AWS Glue Crawlers. A few days ago, I was able to add tags while creating a crawler, even though my IAM policy did not explicitly grant glue:...
0
votes
2
answers
120
views
Why is this IAM policy denying access with an MFA session?
We've been modifying our IAM policies for the rest of the team. They should only be allowed to do most things if MFA is active for their session. Even when they have an MFA session, they cannot access ...
1
vote
1
answer
111
views
Creating presigned S3 urls is allowed despite IP restriction in IAM policy
I have a AWS IAM user, with the following policy attached:
{
"Version": "2012年10月17日",
"Statement": [
{
"Sid": "...
0
votes
1
answer
263
views
How can see what request context looks like for an AWS request?
I was reading some documentations, but could not find a way to see them. I was trying to use Cloudtrail, but it seems like it only shows an event record for the api call performed.
{
"...
-1
votes
1
answer
175
views
Why does CodePipeline service role need iam:PassRole?
I was reading the AWS documentation explaining how to create the CodePipeline service role. However, I don't understand why it needs the following statement:
{
"Effect": "Allow",
...
0
votes
1
answer
83
views
AWS IAM-Policy to restrict only remote repository/branch deletion
Iam trying to write an IAM policy to restrict user on deleting branch/repo using below.But could see delete operation of branch is executed using command git push origin --delete test-delete-branch .
...
1
vote
1
answer
178
views
Not able to authenticate the AWS ECR repo on the EC2 instance
I have created an IAM role for the EC2 instance that has all the required permission to authenticate and pull the AWS ECR image, but every time I try to authenticate, it shows the following error:
&...