alexpulver

#!/usr/bin/env bash

_MKDIR=/bin/mkdir
_MV=/bin/mv

if [ ! -e "tests-run" ]; then
    echo "Please run bootstrap.sh from Git clone root directory"
    exit
fi

alexpulver

#!/bin/bash

export _subcommands="
acm
alexaforbusiness
apigateway
application-autoscaling
appstream
appsync
athena

alexpulver

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {

alexpulver

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "VisualEditor0",
    "Effect": "Allow",
    "Action": [
      "ds:DescribeTrusts",
      "ds:DescribeDirectories",
      "kms:ListKeys",
      "kms:ListAliases",

alexpulver

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "VpcId": {
      "Description": "VPC ID",
      "Type": "AWS::EC2::VPC::Id"
    }
  },
  "Resources": {
    "SSMEndpoint": {

alexpulver

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Mappings": {
    "RegionMap": {
      "eu-west-1": {
        "AMI": "ami-9cbe9be5"
      }
    }
  },
  "Parameters": {

alexpulver

Use case

Below is an example for IAM policy and commands to allow IAM users (could be federated users as well) create EC2 instances in self-service manner, while enforcing the following:

• The IAM user must provide "owner" tag with their currently logged-in IAM username as value. Otherwise they won't be able to create the instance.
• Each IAM user can start, stop and terminate their own instances only. The enforcement is based on currently logged-in IAM username.
• The IAM user can only apply "owner" tag when creating the instance and cannot modify any tag later.

Documentation

Supported Resource-Level Permissions for Amazon EC2 API Actions

alexpulver

Deploying the demo

Global configuration

export AWS_PROFILE=NAME
export AWS_DEFAULT_REGION=REGION
git config --global credential.helper '!aws --profile '$AWS_PROFILE' codecommit credential-helper $@'
git config --global credential.UseHttpPath true

alexpulver

import boto3

client = boto3.client('s3')

response = client.select_object_content(
    Bucket='string',
    Key='string',
    SSECustomerAlgorithm='string',
    SSECustomerKey='string',
    Expression='string',

alexpulver

aws ec2 create-fleet --cli-input-json file://config.json
aws ec2 describe-fleets
aws ec2 describe-fleet-instances --fleet-id fleet-3110fe2c-6589-4a42-8f75-12c1746e50a9
aws ec2 delete-fleets --fleet-ids fleet-3110fe2c-6589-4a42-8f75-12c1746e50a9 --terminate-instances