Details
-
Type:
Task
-
Status: Closed (View Workflow)
-
Priority:
Major
-
Resolution: Done
-
Affects Version/s: None
-
Fix Version/s: None
-
Labels:None
-
Story Points:1
-
Epic Link:
-
Sprint:Fall 7, Winter 1, Spring 1, Spring 2, Spring 3
Description
Enable AWS Admin to achieve the following functionality for users in a specific group:
Users added to the group should have permissions to perform the following actions only for EC2 instances with a specific tag:
- Modify EC2 instance state (Start, Stop, and Restart)
- Modify Security Groups associated with those instances
Attachments
Issue Links
- is cloned by
-
-
- Closed
-
Activity
Tested the security group rule modifications for bioviztest20250226. Successfully added an SSH ingress rule with my current IP, and the changes saved without errors, confirming the setup is working as expected.
Attached is the screenshot for reference. !AWS
Manually adding the tags needed to allow developers to turn on and off, and also add or delete new security group rules, from the new host I just set up, for testing purposes.
Ready for testing.
To test:
- Ensure that your Loraine Lab AWS user id belongs to group 2025-EC2Developer (ask Ann Loraine to confirm for you)
- Log into the AWS console using your LoraineLab user id.
- Navigate to the EC2 dashboard.
- Select EC2 called bioviztest20250226
- Select the security group for bioviztest20250226
- Choose the option to modify / edit the ingress rules
- Choose the option to add a new ingress rule for access using "ssh" and your current IP address
- Choose "save"
- If the "save" action completes without an error, this means the configuration is working as expected. If that happens, kindly close this ticket.
The error above was due to that particular task executing before the apache web server gets installed. I moved that particular task to the end of the "apache" role, which took care of the problem.
Made new EC2 and ran setup.yml, but got this error:
ASK [clone : Make symbolic link from cloned repository to /usr/lib/cgi-bin/geneIdLookup.py] ***
fatal: [bioviztest20250226]: FAILED! =>Unknown macro: {"changed"}
Assuming user group has already been setup in IAM (Identity and Access Management)
Create a policy and attach the policy to a user group.
The attached JSON can be used to set policy where users can only read EC2 instances and start/stop instances that have a specific tag, such as Environment=Dev.
After applying this policy, users will only be able to start/stop/reboot instances that have the tag Environment=Dev.
Note: Please ensure that the EC2 instances have the correct tags added to them.
Thanks Pranav Bhatia!