How to isolate resources for users?

Question

So I am trying to prototype a service that will be backed by different aws services. What I want is, that each user in my service have a different resource group in AWS. For example, they can have different SNS pipelines, different SES configurations, etc. How can I achieve that?

Riku_Kobayashi · Answer

It is a good idea to use IAM to divide the resources that each user can access.  
With the Resource policy, it is also possible to create settings to allow by user for each ARN.  
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html

kentrad · Answer

If you want to keep all the resources in one account, consider isolating resources via tagging. You can use session tagging along with tagging of the resources to control access. Take a look at these:

* [IAM tutorial: Define permissions to access AWS resources based on tags](https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html)
* [IAM tutorial: Use SAML session tags for ABAC](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_attribute-based-access-control.html)

Check to see if the services and resources you plan to use support ABAC, [AWS services that work with IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html).

How to isolate resources for users?

Add your answer

Relevant content