Infrastructure InternalAccess ControlEc2 Access Control Tags

EC2 Access Control Tags

This document is the reference point for tagging aws ec2 instances access controls. Please refer to Infra-Tagging-Guidance for the necessary context.

Overview

This document defines what it means to be the owner, admin, or user of an ec2 instance.

This is a work in progress! In what follows, we define each role and the use cases of that role.

Owner

Keyac:owner
ValueOwner role’s id:team tag
Exampleace-infra
DutiesDictate who should have access to which control.
Allowed ActionsNo action (Notation Only)
Use CasesRefer bellow
ImplicationsNA

Use Cases:

  • The data engineering team requests an ec2 instance X for manual data cleaning. The request also mentions that they want to administrate the instance. A few days later, someone from team A requests to access X to help them. The infra team should mention the data engineering team and ask if they want team A to have admin or user access. The issue from team A only proceeds if someone from the data engineering team confirms it.

Admin

Keyac:admin
Valuelist of roles’ id:team tags
Example:ace-infra:ace-data-engineering:
DutiesAdministrate the instance
Allowed ActionsStopInstance/StartInstance/TerminateInstance
Use CasesTBD.
ImplicationsNA

Session Fellow:

  • Have access through the and the acc-ssm-admin document.
  • Signed in via ace-admin user.

User

Keyac:user
Valuelist of roles’ id:team tags
Example:ace-infra:ace-data-engineering:
DutiesUsing the instance
Allowed ActionsStopInstance/StartInstance
Use CasesTBD.
ImplicationsNA

Session Fellow:

  • Have access through ssm and the ace-ssm-user document.
  • Signed in as ace-user user.

Instance Profiles

The instance profiles should also contain the same tags as the ac:owner team.

ApplicationsReadme