aws iam restriction policy : how to restrict to only resources a user/group has created or will create?

user19413311 0
Viewed 20

I understand the resources and identity iam policies and im trying to restrict access to a group or user to only the resources this group or user will create.

Note the resources are not yet created, so i dont have a resource arn for the ec2/s3/ecs etc. i can use in the policy definition.

I have tried to create a policy with all actions on ec2 and restrict it to a resources set to a specific group but i have an error message stating the resources are not set properly

Thanks a lot for your time and consideration

identity-management amazon-web-services
1 Answers

This isn't really a question anyone can answer properly. So here are a few pointers to get you going in the right direction;

AWS Service Control Policies - https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples.html and https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

AWS Control Tower - https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html

AWS Policy Generator - https://awspolicygen.s3.amazonaws.com/policygen.html

All that being said, I'm not aware of a way to do what you are asking. Any AWS account is designed to be a platform for the organisation, not an individual use case. It's top down, not bottom up.

If User X wants their own separate playground, set them up with their own Account under the main Organisation, but you probably won't want to do this per user, more groups/teams of people in most organisations.

Michael Cropper0
Related