I AM User with EC2 Full access, can see the instance but is unable to connect to it

Question

Hi, 
Our access woes continue!! After syncing the geo-location, my I AM Users could finally see the running instances, but despite full EC2 Access, they cannot connect to the instance. When they try to connect it gives this error: because no identity-based policy allows the iam:ListUsers action not authorized to perform: iam:ListUsers on resource

They have full EC2access, what are we missing. Please help/

Answer

Hi

My understanding is you cannot connect to EC2 despite having Full EC2 permission.
And you want to see what configuration is missing?

First, i am not clear how you try to access EC2? Are you using 
1. EC2 Instance connect?
2. Session Manager?
3. SSH client?

if you using EC2 instance connect. Ensure the instance allow SSH port and you have proper permission. EC2 full access is not giving this permission, use EC2 Instance Connect.  Follow this [document](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-set-up.html#ec2-instance-connect-configure-IAM-role)

if you using Session Manager, ensure you instal the SSM agent in the EC2 and you have right Session Manager permission. Use SSM permission in addition to EC2 permission. You don't need full EC2 permission. Follow this [document](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.html#restrict-access-quickstart-end-user).

If you using SSH client, ensure you have the right SSH key. However, given the error you use. I don't think you use this.

I hope it help.

I AM User with EC2 Full access, can see the instance but is unable to connect to it

相關內容