How to create an IAM user with minimal permissions for an external panel (from CloudShell)

Sooner or later an external tool asks you for "an AWS key": a control panel, a backup system, a monitor. The temptation is to copy your administrator user's key. Never do that. Whoever has that key can do everything you can do, including wiping the whole account. The right thing is to create a separate IAM user with a policy that allows only the specific actions that tool needs, and give it its own key.

We will do it from AWS CloudShell, the terminal built into the web console, because it is four copy-and-paste commands and the result is exact. There is nothing to install on your computer.

Step by step

1. Decide which actions the tool needs

   Before writing anything, make the list. A panel that manages Lightsail machines will need, for example: to view the machines and their status, to start, stop and reboot them, and perhaps to create and view snapshots. It does not need to create or delete machines, see billing or touch users. Every action that is not on the list is an action you are not going to grant. If the tool is serious, it will tell you exactly which permissions it asks for; if it asks for "AdministratorAccess", be suspicious.

2. Open CloudShell

   In the AWS console, click the terminal icon in the top bar (CloudShell) or search for it by name. It takes a few seconds to start. You now have a Linux terminal with the aws tool configured with your current credentials, so everything you do there you do as the user you are signed in to the console with (who must have permission to manage IAM).

3. Write the policy

   Create a file with the policy in JSON format. This example allows viewing, starting, stopping and rebooting Lightsail machines and managing their snapshots, nothing else. Paste the whole block into CloudShell:

   cat > politica.json <<'FIN'
   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": [
         "lightsail:GetInstances", "lightsail:GetInstance", "lightsail:GetInstanceState",
         "lightsail:GetInstanceMetricData", "lightsail:GetRegions",
         "lightsail:StartInstance", "lightsail:StopInstance", "lightsail:RebootInstance",
         "lightsail:GetInstanceSnapshots", "lightsail:GetInstanceSnapshot",
         "lightsail:CreateInstanceSnapshot", "lightsail:DeleteInstanceSnapshot"
       ],
       "Resource": "*"
     }]
   }
   FIN

   Each action is called servicio:Operación. If you only want the tool to view, remove the Start, Stop, Reboot, Create and Delete lines. For EC2, S3 or RDS the actions have other names, but the mechanics are identical. In Lightsail most actions cannot be limited to one specific machine, which is why the Resource is *; in EC2 or S3 you can put the exact identifier of the resource.

4. Create the policy and the user, and attach them

   Three commands. Change the name if you like, but make it say what it is for:

   aws iam create-policy --policy-name PanelMaquinas --policy-document file://politica.json
   aws iam create-user --user-name panel-maquinas
   CUENTA=$(aws sts get-caller-identity --query Account --output text)
   aws iam attach-user-policy --user-name panel-maquinas \
     --policy-arn arn:aws:iam::$CUENTA:policy/PanelMaquinas

   The first command returns the policy's ARN; the third rebuilds it with your account number so you do not have to copy it. Note that we do not give the user a console password: it will exist only for the access key.

5. Generate the access key

   aws iam create-access-key --user-name panel-maquinas

   The response brings two values: AccessKeyId (starts with AKIA) and SecretAccessKey. The secret is shown only this once. Copy it straight into the tool that is going to use it. Do not paste it into an email, a chat or a shared document. If you lose it, no harm done: delete that key and create another.

6. Delete the file and check

   rm politica.json
   aws iam list-attached-user-policies --user-name panel-maquinas

   Only PanelMaquinas should appear. Configure the tool with the key and try one allowed action (view machines) and one that is not allowed (create one): the second must fail with "not authorized". That error is the proof that you did the job right.

What can go wrong