Set up EC2 Instance Connect

To grant an IAM principal permission for EC2 Instance Connect (Amazon CLI)

1. Create a JSON policy document that includes the following:

   • The ec2-instance-connect:SendSSHPublicKey action. This grants an IAM principal permission to push the public key to an instance. With ec2-instance-connect:SendSSHPublicKey, consider restricting access to specific EC2 instances. Otherwise, all IAM principals with this permission can connect to all EC2 instances. You can also restrict access by specifying resource ARNs or by using resource tags as condition keys.

   • The ec2:osuser condition. This specifies the name of the OS user that can push the public key to an instance. Use the default user name for the AMI that you used to launch the instance. The default user name for Amazon Linux 2 is ec2-user, and for Ubuntu it's ubuntu.

   • The ec2:DescribeInstances action. This is required when using the EC2 Instance Connect CLI because the wrapper calls this action. IAM principals might already have permission to call this action from another policy.

   The following is an example policy document. You can omit the statement for the ec2:DescribeInstances action if your users will only use an SSH client to connect to your instances. You can replace the specified instances in Resource with the wildcard * to grant users access to all EC2 instances using EC2 Instance Connect.

   {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Action": "ec2-instance-connect:SendSSHPublicKey",
           "Resource": [
               "arn:aws-cn:ec2:region:account-id:instance/i-1234567890abcdef0",
               "arn:aws-cn:ec2:region:account-id:instance/i-0598c7d356eba48d7"
           ],
           "Condition": {
               "StringEquals": {
                   "ec2:osuser": "ami-username"
               }
           }
         },
         {
           "Effect": "Allow",
           "Action": "ec2:DescribeInstances",
           "Resource": "*"
         }
       ]
   }

   The preceding policy allows access to specific instances, identified by their instance ID. Alternatively, you can use resource tags to control access to an instance. Attribute-based access control is an authorization strategy that defines permissions based on tags that can be attached to users and Amazon resources. For example, the following policy allows a user to access an instance only if that instance has a resource tag with key=tag-key and value=tag-value. For more information about using tags to control access to your Amazon resources, see Controlling access to Amazon resources in the IAM User Guide.

   { 
      "Version":"2012-10-17",
      "Statement":[ 
         { 
            "Effect":"Allow",
            "Action":"ec2-instance-connect:SendSSHPublicKey",
            "Resource": "arn:aws-cn:ec2:region:account-id:instance/*",
            "Condition":{ 
               "StringEquals":{ 
                  "aws:ResourceTag/tag-key":"tag-value"
               }
            }
         },
         {
           "Effect": "Allow",
           "Action": "ec2:DescribeInstances",
           "Resource": "*"
         }
      ]
   }

2. Use the create-policy command to create a new managed policy, and specify the JSON document that you created to use as the content for the new policy.

   $ aws iam create-policy --policy-name my-policy --policy-document file://JSON-file-name

3. Use the attach-user-policy command to attach the managed policy to the specified user. For the --user-name parameter, specify the friendly name (not the ARN) of the user.

   $ aws iam attach-user-policy --policy-arn arn:aws:iam::account-id:policy/my-policy --user-name IAM-friendly-name