Controlling VPC Management

To manage a VPC using JSON

• Use the following sample code -- replacing the * wildcard with specific actions such as "create," "delete," "describe," etc., as appropriate.

  {
      "Statement":[{
      "Effect":"Allow",
      "Action":["ec2:*Vpc*",
                "ec2:*Subnet*",
                "ec2:*Gateway*",
                "ec2:*Vpn*",
                "ec2:*Route*",
                "ec2:*Address*",
                "ec2:*SecurityGroup*",
                "ec2:*NetworkAcl*",
                "ec2:*DhcpOptions*",
                "ec2:RunInstances",
                "ec2:StopInstances",
                "ec2:StartInstances",
                "ec2:TerminateInstances",
                "ec2:Describe*"],
      "Resource":"*"
      }
    ]
    }

To manage a VPC using the AWS Management Console

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the Navigation pane, click Groups, and then select the group that you want to give full access to your VPC.

3. In the bottom pane, go to the Permissions tab and click Manage Policy.

   

4. In the Manage Group Permissions page, in the Policy Name drop-down menu, select AmazonVPCFullAccess and click Apply Policy.

   Note

   If you want only a subset of the privileges listed for the policy to apply to your users, edit the list in the Policy Document box and click Apply Policy.

To grant read-only access to your VPC using JSON

• Use the following sample code to allow a group to look at information about your VPC.

  {
      "Statement":[{
      "Effect":"Allow",
      "Action":["ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeVpnGateways",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeRouteTables",
                "ec2:DescribeAddresses",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeDhcpOptions",
                "ec2:DescribeTags",
                "ec2:DescribeInstances"],
      "Resource":"*"
      }
    ]
  }

To grant read-only access to your VPC using the AWS Management Console

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the Navigation pane, click Groups, and then select the group that you want to give read-only access to your VPC.

3. In the bottom pane, go to the Permissions tab and click Manage Policy. The Manage Group Permissions page appears.

   

4. In the Policy Name drop-down menu, select AmazonVPCReadOnlyAccess and click Apply Policy.

   Note

   If you want only a subset of the privileges listed for the policy to apply to your users, edit the list in the Policy Document box and click Apply Policy.

To grant launch instance privileges to your VPC using JSON

• The following policy allows the group to access the desired actions, and denies the group access to any other actions. The users can launch instances, stop instances, start instances, terminate instances, and describe any of the account's resources (i.e., get a list of the resources). The second statement in the policy protects against any other policy that might grant the user access to a wide range of API actions.

  Note

  The following policy prevents the users from creating or attaching Amazon EBS volumes to instances, or creating snapshots of volumes. It also prevents them from associating Elastic IP addresses with the instances. If the users need those capabilities, you could add the relevant API actions to the policy.

  {
    "Statement":[{
      "Effect":"Allow",
      "Action":["ec2:RunInstances",
                "ec2:StopInstances",
                "ec2:StartInstances",
                "ec2:TerminateInstances",
                "ec2:Describe*"],
       "Resource":"*"
       },
       {
       "Effect":"Deny",
       "NotAction":["ec2:RunInstances",
                    "ec2:StopInstances",
                    "ec2:StartInstances",
                    "ec2:TerminateInstances",
                    "ec2:Describe*"],
       "Resource":"*"
       }
    ]
  }

To grant launch instance privileges to your VPC using the AWS Management Console

1. Open the IAM console at https://console.aws.amazon.com/iam/.

2. In the Navigation pane, click Groups, and then select the group that you want to give a defined set of access privileges to your VPC.

3. On the Permissions tab in the bottom pane, and click Manage Policy. The Manage Group Permissions page appears.

4. Click View Policy Templates, select Custom Policy and click Select. The Manage Group Permissions page appears.

   

   Note

   If you want only a subset of the privileges listed for the policy to apply to your users, edit the list in the Policy Document box and click Apply Policy.