# Identity and access management in AWS Transit Gateway
AWS uses security credentials to identify you and to grant you access to your AWS resources. You can use features of AWS Identity and Access Management (IAM) to allow other users, services, and applications to use your AWS resources fully or in a limited way, without sharing your security credentials.
By default, IAM users don't have permission to create, view, or modify AWS resources. To allow a user to access resources such as a transit gateway, and to perform tasks, you must create an IAM policy that grants the user permission to use the specific resources and API actions they'll need, then attach the policy to the group to which that user belongs. When you attach a policy to a user or group of users, it allows or denies the users permission to perform the specified tasks on the specified resources.
To work with a transit gateway, one of the following AWS managed policies might meet your needs:
+ [AmazonEC2FullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2FullAccess.html)
+ [AmazonEC2ReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonEC2ReadOnlyAccess.html)
+ [PowerUserAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/PowerUserAccess.html)
+ [ReadOnlyAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ReadOnlyAccess.html)
## Example policies to manage transit gateways
The following are example IAM policies for working with transit gateways.
**Create a transit gateway with required tags**
The following example enables users to create transit gateway. The `aws:RequestTag` condition key requires users to tag the transit gateway with the tag `stack=prod`. The `aws:TagKeys` condition key uses the `ForAllValues` modifier to indicate that only the key `stack` is allowed in the request (no other tags can be specified). If users don't pass this specific tag when they create the transit gateway, or if they don't specify tags at all, the request fails.
The second statement uses the `ec2:CreateAction` condition key to allow users to create tags only in the context of `CreateTransitGateway`.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "AllowCreateTaggedTGWs",
"Effect": "Allow",
"Action": "ec2:CreateTransitGateway",
"Resource": "arn:aws:ec2:{{us-east-1}}:{{123456789012}}:transit-gateway/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/stack": "prod"
},
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"stack"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:{{us-east-1}}:{{123456789012}}:transit-gateway/*",
"Condition": {
"StringEquals": {
"ec2:CreateAction": "CreateTransitGateway"
}
}
}
]
}
```
------
**Working with transit gateway route tables**
The following example enables users to create and delete transit gateway route tables for a specific transit gateway only (`tgw-11223344556677889`). Users can also create and replace routes in any transit gateway route table, but only for attachments that have the tag `network=new-york-office`.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:DeleteTransitGatewayRouteTable",
"ec2:CreateTransitGatewayRouteTable"
],
"Resource": [
"arn:aws:ec2:{{us-east-1}}:{{123456789012}}:transit-gateway/tgw-{{11223344556677889}}",
"arn:aws:ec2:*:*:transit-gateway-route-table/*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTransitGatewayRoute",
"ec2:ReplaceTransitGatewayRoute"
],
"Resource": "arn:aws:ec2:*:*:transit-gateway-attachment/*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/network": "new-york-office"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateTransitGatewayRoute",
"ec2:ReplaceTransitGatewayRoute"
],
"Resource": "arn:aws:ec2:*:*:transit-gateway-route-table/*"
}
]
}
```
------
## Permissions for 1:1 NAT
Only the transit gateway owner can view or modify the NAT configuration of an attachment. This applies to every attachment on the transit gateway, including attachments owned by other accounts through AWS RAM sharing. Attachment owners can't view or change NAT configuration, and the transit gateway owner can't delegate this to them. The following table shows the result for each caller.
| Caller | `GetTransitGatewayAttachmentNatConfiguration` / `ModifyTransitGatewayAttachmentNatConfiguration` | `NatGatewaySupport` in `DescribeTransitGatewayAttachments` |
| --- | --- | --- |
| transit gateway owner | Allowed | Included |
| Attachment owner (different account) | UnauthorizedOperation | Not included |
| Any other account | InvalidTransitGatewayAttachmentID.NotFound | Attachment not returned |
The following table lists the IAM actions for 1:1 NAT.
| Action | Purpose |
| --- | --- |
| ec2:ModifyTransitGatewayAttachmentNatConfiguration | Enable or disable NAT, and set NAT rules and route options. |
| ec2:GetTransitGatewayAttachmentNatConfiguration | View NAT configuration. Policies that grant ec2:Describe\* don't include this action. |
Both actions support resource-level permissions on the transit gateway attachment. To restrict which attachments a principal can manage, specify the attachment ARN or use tag-based conditions.
The following example allows NAT management only on attachments tagged `environment=prod`.
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:ModifyTransitGatewayAttachmentNatConfiguration",
"ec2:GetTransitGatewayAttachmentNatConfiguration"
],
"Resource": "arn:aws:ec2:*:*:transit-gateway-attachment/*",
"Condition": {
"StringEquals": { "ec2:ResourceTag/environment": "prod" }
}
}
]
}
```