AWS Classroom notes 16/Dec/2023

Finding ARNs and Actions

Refer Here for pattern
Refer Here for Actions, resources and conditions
Find ARN for EC2 instance in nvirginia region with instance id i-0c0d4238fe7ae9232 in aws account with id 123456789012

arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}
arn:aws:ec2:us-east-1:123456789012:instance/i-0c0d4238fe7ae9232

arn:${Partition}:ec2:${Region}:${Account}:security-group/${SecurityGroupId}

arn:aws:ec2:us-east-1:123456789012:security-group/sg-123456778

Find ARN for AWS RDS instance in mumbai region in aws account with id 123456789012 and rds instance id rds-0c0d4238fe7ae9232

arn:${Partition}:rds:${Region}:${Account}:db:${DbInstanceName}

arn:aws:rds:ap-south-1:123456789012:db:rds-0c0d4238fe7ae9232

Account id 123456789012
region: mumbai ap-south-1
Find ARN for
- elastic ip (EC2) with id eip-12345 arn:aws:ec2:ap-south-1:123456789012:elastic-ip/eip-12345
- eks cluster with id eks-12345 arn:aws:eks:mumbai:123456789012:cluster/eks-12345
- Volume with id ebs-12345 arn:aws:ec2:ap-south-1:123456789012:volume/ebs-12345

Find an action to
- stop ec2 ec2:StopInstances
- terminate ec2 ec2:TerminateInstances
- Delete elastic ip ec2:DisassociateAddress
- Delete rds Database instance rds:DeleteDBInstance
Lets create permission for a user who should have All permissions in ec2 apart from terminating instances
- Statement-1:
  - resource: *
  - Actions: ec2:*
  - Effect: Allow
- Statement-2:
  - resource: *
  - Action: ec2:TerminateInstances
  - Effect: Deny
Lets create a policy for the user to do any thing in AWS but not anything in s3
- Statement-1:
  - resource: *
  - Action: *
  - Effect: Allow
- Statement-2:
  - resource: *
  - Action: s3:*
  - Effect: Deny
Lets create a policy to allow anything in region mumbai but not any other region
- Statement:
  - resource: *
  - Action: *
  - Effect: Allow
  - Condition: aws:region == ap-south-1