Skip to content
This repository has been archived by the owner on Aug 30, 2024. It is now read-only.

iam 3.4 cluster policies

Jump to bottom
Steve Jones edited this page Sep 6, 2017 · 3 revisions

Table of Contents

Overview

This document contains requirements and specification for IAM policy updates allowing restriction of images to availability zones. This feature is under consideration for inclusion in the 3.4 release.

Tracking

Status Draft
Updated 2013/08/28 Initial document
Updated 2013/08/29 Listed ARN conditions, added more use cases.

Requirements

Hard

  • Policy allows restricting specified images to specified availability zones when running instances.

Soft

  • Policy can be specified at the account level and applies to account administrators.
  • Propagation of restrictions to images created from an image with a restriction (also snapshots)
  • Ability to specify restrictions indirectly using mechanisms such as product codes or resource tags

Analysis

AWS Gap

EC2/IAM added support for EC2 specific condition keys earlier in 2013. This includes the key: 

  ec2:AvailabilityZone

which at first appears useful for restricting images to certain availability zones. This is not the case as the new conditions allow restriction/filtering against (properties of) existing resources rather than filtering on request properties.

Availabiliy Zone Selection

In the case of running an instance without specification of an availability zone it is important that the policy mechanism supports selection of an availability zone suitable for the image being launched. This implies that any new condition must restrict/filter availability zones.

Specification

We will add a new condition key and support for the ARN evaluation type to allow restriction of specified images to specified availability zones.

IAM Refresh

ARN condition support is required, other items are nice to have.

EC2 Actions Updated

The actions permitted in an IAM policy will be updated to the 2013-07-15 API version.

New Conditions

The following conditions are used for conditions on ARN values:

  • ArnEquals
  • ArnNotEquals
  • ArnLike
  • ArnNotLike
The following conditions are useful for conditions on values that are optional:
  • Null condition
  • ..IfExists conditions ( e.g. StringEqualsIfExists, ArnLikeIfExists )

New EC2 Condition Keys

The following EC2 conditions can further restrict users permissions on instances, volumes and security groups:

  • ec2:AvailabilityZone
  • ec2:InstanceProfile
  • ec2:InstanceType
  • ec2:ParentSnapshot
  • ec2:Region
  • ec2:RootDeviceType
  • ec2:VolumeSize
Additionally these conditions can be present in a policy but are not fully implemented as we do not support the underlying functionality:
  • ec2:EbsOptimized
  • ec2:PlacementGroup
  • ec2:Tenancy
  • ec2:VolumeIops
  • ec2:VolumeType
  • ec2:Vpc
The following condition will not be implemented:
  • ec2:ResourceTag/tag-key

IAM Extension

IAM/EC2 extensions will be added for this feature.

Account Deny Effect

Currently only quota policies can be attached to accounts, we will extend this to allow statements with a deny effect (see use cases for an example)

Extension Condition Keys

The following Eucalyptus specific extension condition key will be added:

  • ec2:TargetImage (or ec2:RequestImage?)
This will be of type ARN and will allow restriction based on the image specified in the current request.

Use Cases

Restrict Image to Availability Zone

This case covers user policy for preventing launch of an image in an availability zone.

  • Attach policy to user:
  {
    "Statement":[
      {
        "Effect":"Allow",
        "Action":"ec2:*",
         "Resource":"*"
      },
      {
        "Effect": "Deny",
        "Action": [ "ec2:*" ],
        "Resource": "arn:aws:ec2:::availabilityzone/PARTI00",
        "Condition": {
          "ArnLike": {
            "ec2:TargetImage": "arn:aws:ec2:*:*:image/emi-239D37F2"
          }
        }
      }
    ]
  }
  • Launch non permitted image as user:
  $> euca-run-instances -z PARTI00 emi-239D37F2
  euca-run-instances: error (RunInstancesType): Not authorized to use cluster PARTI00

RunInstance without specified Availability Zone

This case covers running an instance of an image that is permitted in some availability zones.

  • Attach relevant policy to user.
  • Launch of image is successful (availability zone selected)

RunInstance without specified Availability Zone (Failure)

This case if for running an instance of an image that is not permitted in any availability zone.

  • Launch non permitted image:
  $> euca-run-instances emi-239D37F2
  euca-run-instances: error (RunInstancesType): Not enough resources: no availability zone is available in which you have permissions to run instances.

Account policy

This case covers account level policy denial.

  • Attach policy to account:
  {
    "Statement": [ {
      "Effect": "Deny",
      "Action": [ "ec2:RunInstances" ],
      "Resource": "arn:aws:ec2:::availabilityzone/PARTI00",
      "Condition": {
          "ArnLike": {
              "ec2:TargetImage": "arn:aws:ec2:*:*:image/emi-239D37F2"
          }
      }
    } ]
  }
  • Verify administrator in account is not able to run image.

Terminate Instance in Availability Zone

This case covers restriction of instance termination to a specified availability zone.

  • Attach policy to user
  {
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Action": [ "ec2:TerminateInstances" ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:AvailabilityZone": "PARTI00"
        }
      }
    }]
  }
  • User can only terminate instances in specified availability zone

Region Condition Key

AWS allows the region condition key to be used in any EC2 action. This case covers use of the condition outside of the expected (instance, security group and volume) actions.

  • Attach policy to user
  {
    "Statement":[
      {
        "Effect": "Allow",
        "Action": [ "ec2:*" ],
        "Resource": "*",
        "Condition": {
          "StringEquals": {
            "ec2:Region": "eucalyptus"
          }
        }
      }
    ]
  }
  • Create and describe a key pair as the user.

..IfExists Conditions Accepted

This case ensures that the ..IfExists versions of all conditions are recognized.

  • Upload a policy containing ..IfExists versions of each supported condition (other than the Null condition)
  • Policy uploads successfully (conditions are recognized)

..IfExists Condition Operation

In this case the condition is only evaluated if the key is present. For run/describe operations the key is null.

  • Upload policy with check against null condition key:
  {
    "Statement":[
      {
        "Effect": "Allow",
        "Action": [ "ec2:*" ],
        "Resource": "*",
        "Condition": {
          "StringEqualsIfExists": {
            "ec2:AvailabilityZone": "PARTI00"
          }
        }
      }
    ]
  }
  • Ensure instances can be run, described and deleted in the zone.

Null Condition Operation

This use case covers the Null condition and ec2:AvailabilityZone condition key. The key is present for only some actions (see references)

  • Add policy for user
  {
    "Statement":[{
        "Action":["ec2:*"],
        "Effect":"Allow",
        "Resource":["*"],
        "Condition":{
           "Null":{"ec2:AvailabilityZone":"true"}
        }
      }
    ]
  }
  • Verify that a volume can be created and described but not deleted as the user.

References

tag:rls-3.4 tag:iam
Clone this wiki locally