[Music]
hello I'm father a call support engineer
here at the ADA blast office in Dublin
sometimes customers want to allow an IM
users or groups access to launch new
Amazon ec2 instances and create new
Amazon EBS volumes but only when they
pass the required tags along with the
creation request today I'm going to show
you how to do this using ion policy
conditions to restrict access to create
new resources let's get started I've
already logged into the AWS management
console and my user has full permissions
to I am so I can manage other users from
here let's go to the IM console you can
use manage policies for this so let's
create a new one choose policies and
then create policy
chose Jason and paste a policy provided
in the article here I have already
copied the policy from there this
example policy allows a user to launch
an ec2 instance and create an IBS volumn
only if the user applies all the tags
that are defined in the policy if the
user applies any tag that is not
included in the policy the action is
denied let me break it down for you the
first statement allow to describe all is
to allow all kind of describe actions in
AC to service this will allow the user
to describe images and VP C's for
example the second statement allow run
instances is necessary for other
resources used to run instances that are
not this instance in a volume itself the
third statement allow run instance with
restrictions is where we're actually
using the conditions for tags look at
the resource it's only instance and
volume we put the condition key a SS
request tag that is the condition
available when you launch a new instance
right below we use the qualifier for all
values where we enforce that all tags
match exactly the value this condition a
SS tackies is necessary to enforce case
sensitivity as well the last allow
create tags only when launching allows
tags only when creating a new instance
so users cannot add new tags to a
pre-existing instance you can click
review policy
name your policy and I mean this as
policy one and choose create policy
now go to the users tab
and choose the user I have user 1 for
this
choose add permissions attach existing
policies
keep in mind you can also use groups to
manage users permissions and select the
policy just created policy one
next review
at permissions
I have also created policy to with the
second example from the article I'll
attach it to user two so we can test it
later I'm going to user to add the
policy to that I mentioned
you
see that in policy too we are using the
qualifier for any value this is the main
difference between the two policies now
as you can see I'm logging as user one
who have just added a policy tool let's
check how to policy behaves go to ec2
console
and choose launch instance
select AMI
select the instance type choose next
next again
next and then add the text this policy
allows adding only when matching all the
exact keys and values let's first write
this with no keys and expect a failure
when launching choose next configure
security groups keep in mind the
policies we are testing to not allow
users to create security groups or key
pairs so the user must select
pre-existing security groups and keepers
review and launch
and launch choose an existing key pair
and knowledge and launch instance we
have a launch failure as expected now go
back to reveal screen to add some text
to test choose edit tags
an EdTech madding key one and value one
reveal and launch
failed again as expected let's go back
and edit the tags again
now let's add key to and value two
now we have the two keys and valves
exactly as the policy
success now let's test the second policy
example to launch ec2 instances that
have at least one matching tag and value
now as you can see I'm logged as user
two with the policy to attach and check
how the policy behaves go to ec2 console
and choose launch instance
selector am I
select the instance type choose next
next again next and add the text this
policy allows adding tags when matching
a list with one of the keys and their
respective value let's first try it with
no keys inspector failure when launching
the policies we're testing to not allow
users to create security groups or key
pairs so the user must select
pre-existing security groups and key
pairs review and launch launch select an
existing key pair on knowledge and
launch instance we have a launch failure
as expected now we go back to review
screen to add some tags to test choose
edit tags
and that tech at key one and value to
review and launch
lunch failed again as expected now let's
go back and edit tags again
change to q1 and value one
now we have the kyun value exactly as
the policy you can even add key 3 and
value 3 in this case and it will work
the same way
referral and launch
success you can see a few more examples
in use case scenarios in the knowledge
center article with this video thanks
for watching and a happy call computing
from all of us here at a tablet
[Music]
you
[Music]