Al usar AWS re:Post, aceptas las AWS re:Post Términos de uso
AWS re:Postre:Post

Deny access of read for i am user for instance attribute user data

0

i have an requirement that i want to hide instance user data from any user, like I don't want to allow any iam user/role to read what my instance user data has, I did tried to deny DescribeInstanceAttribute with condition for attribute "UserData"but that didn't worked. i just want to know is it possible to hide this specific instance attribute "userData" from user?

Temas
Seguridad, identidad y cumplimientoCálculo
Etiquetas
Seguridad, identidad y cumplimientoAmazon EC2Políticas de IAM
Idioma
English
rePost-User-9257957
preguntada hace 2 años268 visualizaciones
1 Respuesta
1

It certainly seemed difficult to narrow it down with the condition key. https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions

It's not a radical solution, but why not store the contents of UserData in S3 and control browsing within S3?

I thought it would be good to unify the EC2 user data by getting, unpacking, and executing the UserData object in S3.

profile picture
takakuni
respondido hace 2 años

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas

Contenido relevante