Versions Compared

Old Version 11

changes.mady.by.user Paul Allen

Saved on

compared with

New Version 12

changes.mady.by.user Paul Allen

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Create a new role as in Creating Custom Roles to use With Shibboleth. 
    1. Name the role "shib-example2".
    2. Create the corresponding AD group and add target users as members.
  2. Add the following inline policy to the new role:

    1. Custom JSON for the policy: 

      Code Block
      {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/TargetRole": "example2"
                }
            }
        },
        {
            "Action": [
                "ec2:CreateTags",
                "ec2:DeleteTags"
            ],
            "Effect": "Deny",
            "Resource": "*"
        },
        {
            "Effect" : "Allow",
            "Action" : "ec2:Describe*",
            "Resource" : "*"
        },
    ]
}
  3. Label EC2 instances with "TargetRole" tag according to which role should be allowed access to each instance. In order to allow users from the "shib-example2" role to stop/start an instance, give the instance the following tag:
    1. "TargetRole" = "example2"

...