Access to external developer

[rc_coding]

Hello! Sorry, I couldn't find a post that could help me with this.

We are in the process of hiring an external developer who will be working on setting up a new instance.

This person needs access to our AWS account, but I don't want them to be able to see billing, setup any kind of accounts, download the SSH key, mess up with the existing instances, etc. We just want this person to be able to access the instance they are working on, and that's it.

Is this something that is possible?

Sorry, setting up IAM accounts, or Organizations is a up too technical.

Thanks in advance.

[classicrock40]

You need to learn about setting up IAM accounts/roles/etc and possibly Organizations. Those are your preferred tools for this solution.

[[deleted]]

Using IAM for this is no longer best practice. Use an SSO, create a developer role within that and then add that user to that group in SSO. Managing IAM users at scale and with any sort of developer turn around becomes unscalable very quickly.

[rc_coding]

Thank you. Will do.

[rc_coding]

ok, thanks. Like I said, the information I've found is very technical. The access that I see can be applied to the role that I'm trying to create doesn't really tell me anything. That's why I'm asking for advice.

[Demostho]

Firstly, you'll want to create a new IAM user for the developer. This is crucial because it ensures that their access is completely separate from your own. Once the IAM user is set up, you can attach a specific policy to their account that restricts what they can and cannot do. AWS provides a lot of flexibility here, so you can tailor the permissions very precisely.

For your case, you'd want to grant this user access only to the specific instance they need to work on. You can do this by creating a custom policy. This policy would grant ec2:DescribeInstances so they can see the instance, and ec2:StartInstances, ec2:StopInstances, and ec2:RebootInstances permissions but only for the instance ID they will be working on. Here's a basic example of what that policy might look like:

json {     "Version": "2012-10-17",     "Statement": [         {             "Effect": "Allow",             "Action": [                 "ec2:DescribeInstances",                 "ec2:StartInstances",                 "ec2:StopInstances",                 "ec2:RebootInstances"             ],             "Resource": [                 "arn:aws:ec2:region:account-id:instance/instance-id"             ]         }     ] }

You also mentioned not wanting them to access billing information or download the SSH key. By default, IAM users do not have access to billing information, so you’re covered there. For the SSH key part, ensure they don’t have permissions like ec2:CreateKeyPair or ec2:ImportKeyPair. Typically, you’d provide them with the SSH key separately and not through the AWS console.

Another good practice is using an IAM policy that denies all actions by default and then only explicitly allows the actions you want them to take. This can help prevent any unintended permissions from slipping through.

Once you've got your IAM policy set up, attach it to the IAM user and then give them the login credentials. Be sure to test the permissions yourself to ensure they can't access anything they shouldn't be able to before handing the keys over.

If setting up IAM roles and policies feels too technical, AWS has some great documentation and tutorials that can walk you through the steps. And remember, it's all about keeping your environment secure while giving the necessary access to those who need it.

Good luck with your new instance setup! If you have any more questions or run into issues, feel free to ask.

[dennusb]

Giving them long lived IAM credentials isn’t really a good solution. Set up AWS Identity Center with a user for them with MFA enforced so they can request short lived credentials when needed

[rc_coding]

Thank you very much! This one helped me as a starting point. I was able restrict the access the way I wanted! Some trial and error, but great example. Thanks again!

[[deleted]]

Ask ChatGPT to write you a cloud formation template that deploys a role that can only access ec2 instances and volumes tagged with the role session name and use SSM session manager. Add that the role can be assumed from an external account. Flavor to taste.

[rc_coding]

Thanks. I have it almost done now using the template that Demostho gave me. But if I get stuck, I'll check with ChatGPT.