IAM Access issue

To give a person access to a specific EC2 Windows instance, you'll need to set up IAM permissions correctly. Here's how to approach this:

1. First, create an IAM user for the person who needs access:

• Sign in to the AWS Management Console with your root account
• Navigate to IAM (Identity and Access Management)
• Select "Users" from the left navigation and click "Add user"
• Set a username and enable "AWS Management Console access"
• Set a password for the user

2. For permissions to the specific EC2 instance, you'll need to create a custom policy:

• The policy should include permissions for basic EC2 console viewing (ec2:Describe* actions)
• Add specific permissions for the instance they need to access

3. For the specific instance access, you can use a policy that includes:

{
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource": [
"arn:aws:ec2:region:account-id:instance/instance-id"
]
}

Replace "region", "account-id", and "instance-id" with your actual values.

4. For remote access to the Windows instance, you can use Session Manager by adding:

{
"Effect": "Allow",
"Action": "ssm:StartSession",
"Resource": [
"arn:aws:ec2:region:account-id:instance/instance-id",
"arn:aws:ssm:region:account-id:document/AWS-StartSSHSession"
]
}

5. Attach this policy to the IAM user you created.

6. Provide the user with their login credentials and the sign-in URL, which will look like: https://your-account-id.signin.aws.amazon.com/console

Note that it's important to understand that the EC2 "Describe" actions don't support resource-level permissions, so the user will be able to see all EC2 instances in the console, but they will only be able to perform actions (start/stop) on the specific instance you've granted them access to.

If you need to further restrict what the user can do with the instance, you can refine the policy by specifying exactly which actions they're allowed to perform.
Sources
Providing Access to a single EC2 Instance | AWS re:Post
IAM User Confusion | AWS re:Post

Yes, giving a person access to just one EC2 Windows instance depends on what level of access they need:

If they only need RDP access to the instance:

You can do this without using IAM:

RDP into the instance as Administrator.

Create a new Windows user:

net user NewUser strongPassword123! /add net localgroup "Remote Desktop Users" NewUser /add

Share the RDP IP address, username, and password with the user.

Ensure the security group allows RDP from their IP address. ✔️ This is the simplest and safest way if they don’t need AWS Console access.

** If they need AWS Console/EC2 Dashboard access:**

Go to IAM > Create a new user

Assign this custom IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:GetConsoleOutput"
      ],
      "Resource": "*"
    }
  ]
}

Share login instructions securely.