I need to give read only access for AWS services. There is a read only built in policy in IAM. This overall work fine. But user can see EC2 launch logs (EC2 > Instance settings > Get System Logs). Here user can see ssh keys. So is there any way we can restrict this as well? any EC2 get system logs deny policy?
1 Answers
Yes, Remove the GetConsoleOutput permission from the user permission or deny this specific permission for the users.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Deny",
"Action": "ec2:GetConsoleOutput",
"Resource": "*"
}
]
}
Related