How to have an EC2 instance take different IAM role based on its caller?

Viewed 22

In my microservice architecture, I currently have a user API Gateway, a balance microservice and a balance DynamoDB.

I have configured DynamoDB with some fine-grained access and constraint so that my balance microservice can only modify the balance down and not up.

I wish to add an admin API Gateway that will call the same balance microservice, and in that case, the microservice must be able to modify the balance up.

My goal here is that if the microservice gets compromised through SQLi, RCE, dep vulnerability etc, it can't modify the balance up. But using the same microservice, an admin could. Is something like that possible ? For example, a way to sign a message from the admin API gateway and get DynamoDB to verify that signature and allow balance modification if it is valid but I didn't find any way to do that.

1 Answers

API gateway Lambda authorizer, earlier known as custom authorizer can help you here.

The authorizer lambda function gets invoked prior to the actual integration invocation by API gateway and you can allow or deny based on the custom logic that you define in the custom authorizer.

Ref: https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-use-lambda-authorizer.html

You can't assign dynamic permissions to EC2 , only other way is to use Cognito identity pool which will have roles assigned with it. This will allow you to use Role based access control (RBAC)

Ref: https://docs.aws.amazon.com/cognito/latest/developerguide/role-based-access-control.html

Related