Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Using IAM Locally

Amazon Identity and Access Management (IAM) helps you securely control access to Amazon resources that run on your Amazon Snowball Edge device. You use IAM to control who is authenticated (signed in) and authorized (has permissions) to use resources.

IAM is supported locally on your device. You can use the local IAM service to create new users and attach IAM policies to them. You can use these policies to allow the access necessary to perform assigned tasks. For example, you can give a user the ability to transfer data, but limit their ability to create new Amazon EC2-compatible instances.

Additionally, you can create local, session-based credentials using Amazon Security Token Service (Amazon STS) on your device. For information about the IAM service, see Getting started in the IAM User Guide.

Your device's root credentials can't be disabled, and you can't use policies within your account to explicitly deny access to the Amazon Web Services account root user. We recommend that you secure your root user access keys and create IAM user credentials for everyday interaction with your device.

Using the Amazon CLI and API Operations on Snowball Edge

When using the Amazon CLI or API operations to issue IAM, Amazon STS, Amazon S3, and Amazon EC2 commands on Snowball Edge, you must specify the region as "snow." You can do this using aws configure or within the command itself, as in the following examples.

aws configure --profile abc
Amazon Access Key ID [None]: AKIAIOSFODNN7EXAMPLE
Amazon Secret Access Key [None]: 1234567
Default region name [None]: snow
Default output format [None]: json
        

Or

aws iam list-users --profile snowballEdge --endpoint http://192.0.2.0:6078 --region snow 
        

List of Supported IAM Amazon CLI Commands on a Snowball Edge

Following is a description of the subset of Amazon CLI commands and options for IAM that are supported on Snowball Edge devices. If a command or option isn't listed following, it's not supported. Unsupported parameters for commands are noted in the description.

Supported IAM API Operations

Following are the IAM API operations that you can use with a Snowball Edge, with links to their descriptions in the IAM API Reference.

Supported IAM Policy Version and Grammar

Following is the local IAM support version 2012-10-17 of the IAM policy and a subset of the policy grammar.

IAM Policy Examples

The following are examples of policies that grant permissions to a Snowball Edge device.

Example 1: Allows the GetUser call for a sample user through the IAM API

Use the following policy to allow the GetUser call for a sample user through the IAM API.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "iam:GetUser",
            "Resource": "arn:aws:iam:::user/example-user"
        }
    ]
}

Example 2: Allows Full Access to the Amazon S3 API

Use the following policy to allow full access to the Amazon S3 API.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "*"
            
        }
    ]
}

Example 3: Allows Read and Write Access to a Specific Amazon S3 Bucket

Use the following policy to allow read and write access to a specific bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListObjectsInBucket",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::bucket-name"
        },
        {
            "Sid": "AllObjectActions",
            "Effect": "Allow",
            "Action": "s3:*Object",
            "Resource": "arn:aws:s3:::bucket-name/*"
        }
    ]
}

Example 4: Allows List, Get, and Put Access to a Specific Amazon S3 Bucket

Use the following policy to allow List, Get, and Put Access to a specific S3 bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:List*"
            ],
            "Resource": "arn:aws:s3:::examplebucket/*"
        }
    ]
}

Example 5: Allows Full Access to the Amazon EC2 API

Use the following policy to allow full access to Amazon EC2.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*"
        }
    ]
}

Example 6: Allows Access to Start and Stop Amazon EC2-compatible Instances

Use the following policy to allow access to start and stop Amazon EC2 instances.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances"
            ],
            "Resource": "*"
        }
    ]
}

Example 7: Denies Calls to DescribeLaunchTemplates but Allows All Calls to DescribeImages

Use the following policy to deny calls to DescribeLaunchTemplates but allow all calls to DescribeImages.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ec2:DescribeLaunchTemplates"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeImages"
            ],
            "Resource": "*"
        }
    ]
}

Example 8: Policy for API Calls

Lists all the managed policies that are available on your Snow device, including your own customer-defined managed policies. More details in list-policies.

aws iam list-policies --endpoint http://ip-address:6078 --profile snowballEdge --region snow
{
    "Policies": [
        {
            "PolicyName": "Administrator",
            "Description": "Root user admin policy for Account 123456789012",
            "CreateDate": "2020-03-04T17:44:59.412Z",
            "AttachmentCount": 1,
            "IsAttachable": true,
            "PolicyId": "policy-id",
            "DefaultVersionId": "v1",
            "Path": "/",
            "Arn": "arn:aws:iam::123456789012:policy/Administrator",
            "UpdateDate": "2020-03-04T19:10:45.620Z"
        }
    ]
}                                          

TrustPolicy Example

A trust policy returns a set of temporary security credentials that you can use to access Amazon resources that you might normally not have access to. These temporary credentials consist of an access key ID, a secret access key, and a security token. Typically, you use AssumeRole in your account for cross-account access.

The following is an example of a trust policy. For more information about trust policy, see AssumeRole in the Amazon Security Token Service API Reference.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::AccountId:root" //You can use the Principal ID instead of the account ID. 
                ]
            },
            "Action": [
                "sts:AssumeRole"
            ]
        }
    ]
}