How to Restrict AWS Resource Access to a Specific IAM Role

Question

I have been trying to limit Amazon EC2 access to a specific IAM role in a Cloud Formation template. I used “Deny : NotPrincipal”, but i am getting an error saying ‘Policy document should not specify a principle’. 

Any suggestions as to how to scope AWS Resource to specific IAM role?

Answer 1

You can use iam get-role to find the Role-Id and add it to the policy condition under aws:userId

aws iam get-role --role-name Test-Role

IAM policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "ec2:CopyImage",
            "Resource": "*",
            "Condition": {
                "StringNotLike": {
                    "aws:userId": [
                        "AROAJPXXXXXJE5XOMQARS:*",
                        "AROAJPXXXXXJE5XOMQARS:*",
                        "AROAJXXXXXXV3EZVH2W5A:*",
                        "AROAJXXXXXXBH4XK552KI:*"
                    ]
                }
            }
        }
    ]
}

If you want to know more here is an article from AWS on restricting access to a role.

https://aws.amazon.com/blogs/security/how-to-restrict-amazon-s3-bucket-access-to-a-specific-iam-role/