Limit Eventbridge Scheduler permissions
Is there a way to provide a EventBridge Scheduler schedule the same IAM role used for my compute resources, which includes the permissions to invoke the target, but use conditions so that Scheduler is not allowed other actions? I've tried several types conditions, but either they have no effect or they block my resources from performing the actions.
I know best practice is to have separate IAM roles and provide least-privilege, but with the scale of our system, and the hard limit on IAM roles, this isn't always possible.
- Language
- English
asked 2 years ago322 views
- Newest
- Most votes
- Most comments
That isn't the way AWS IAM is meant to be used, as I think you're also saying you know. I don't believe there's any simple and reliable way to distinguish between API calls made by the EventBridge Scheduler and other workloads, if they use the same role. The service is designed with the intent that the separation be done with separate roles.
The soft quota on the number of IAM roles per account is 1,000, and the hard quota is higher. Would you like to tell a bit more about how you're hitting such a high quota with just two types of resources, which are some form of compute and EventBridge Scheduler? There's very likely a more streamlined approach that would work for you, but it's hard to assess without some more information.
Relevant content
- AWS OFFICIALUpdated 7 months ago
- AWS OFFICIALUpdated 2 years ago
The hard limit is not that much higher - it is 5000. The reason this limit is an issue for us is we have hundreds of microservices, each of which is deployed to many regions. Multiple roles per stack make the hard limit an issue for us. It's something we're solving through decomposition to multiple accounts, but the point is the limit is a real issue for us, and the separation of roles isn't really feasible. We may end up creating specific role/s for Scheduler, to be shared across all the microservices that use is, but that's not ideal either.
Anyway, thanks for confirming my suspicion that conditions can't be used here.