Dynamically assign an IAM Role between an IAM user and and EC2 instance

0

I have an IAM Role created; currently assigned to an EC2 instance and works great. How do I dynamically assign the same IAM Role between an IAM user and an EC2 instance? Thanks!

已提問 2 年前檢視次數 647 次
2 個答案
1

In short: Please don't!
Instances (systems) usually have a usage pattern that is totally different from humans. Mixing up their rights is a bound to conflict with the principle of "least privilege".

If somehow you have a use-case that requires this (please double-check!):

  • Write the policy into a managed policy
  • Attach it to the instance profile
  • Attach it to the user (or better, their group)
profile pictureAWS
Obijan
已回答 2 年前
1

Update the Trust Policy of the role to something like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "ec2.amazonaws.com",
                "AWS": "arn:aws:iam::0123456789012:user/johnsmith"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
profile pictureAWS
專家
kentrad
已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南