re 8: in favor of ec2 role credentials via the metadata service?
Re:AWS IAM Policies in a Nutshell
by colemorrison on Friday March 24, 2017 @01:33AM
(#13946883)
Without even having to dive into userdata or metadata, just (a) create the role for the ec2; (b) attach the trust and permission policies; (c) create an "instance profile"; (d) attach the instance profile to your target instances.
If via console, that gets done behind the scenes when attaching the role. But ya roles use the security token service behind the scenes which allow for temp creds vs. storing sensitive stuffs on the instances.
1. All IAM policies/roles and InstanceProfile's should be managed in CloudFormation, no exception.
2. Policies should not be inlined into the IAM role policy document, rather they should be attached (excepting item 3 and 4).
3. IAM roles which are used for signing S3/CloudFront/... requests which are subsequently made public should should have all policies inlined AND the explicit resource should be defined.
4. IAM roles granting access to an external (non-AWS service) principal should generally inline all statements unless the relationship to the principal can be considered secure.
5. Policies should have multiple statements, one statement per AWS service.
6. Most non-administrative policies dealing with persistent storage (DynamoDB/S3) should be constrained to a limited number of resources.
7. Glob-Star is not permitted for any `Action` statement (ie: no `s3:*`).
8. Absolutely no AWS_ACCESS_KEY's are permitted on EC2 instances.