Limit permission to delete resources by Company's IP address

Limit EC2 delete permissions by Company’s IP address

create vpc for linux instance

  • With the criteria of zero trust and least privilege permission, deleting resources always needs to comply with very strict requirements such as:

    • Can only be deleted - when accessing the AWS account from the company’s IP address
    • Only specifically tagged resources can be deleted
    • Only resources in the previously allowed list can be deleted
    • …..

  • In the framework of this lab, we will perform the part: only delete EC2 - when accessing the AWS account from the company’s IP address

  1. Get IP address

    create vpc for linux instance

    • IP address: 14.xxx.xxx.xxxx

  2. Create IAM Policy

    • In the AWS console, in the search box, enter IAM
    • Select IAM service

    create vpc for linux instance

    • On the left side of the screen, select Policies
    • Select Create policy

    create vpc for linux instance

    • Create policy in JSON data format instead of Visual. Select JSON

    create vpc for linux instance

    • Scan the entire current code and press the Delete button

    create vpc for linux instance

    • Copy the following code into the Policy editor box, with the meaning: Users only have the right to delete EC2 with the IP address accessing the AWS account at your office
    • Noted: in line aws:SourceIp instead of entering the number sequence 14.xxx.xxx.xxxx which is the IP address you took in step 1, you need to change it to another number sequence.
    • For example: change 14.xxx.xxx.xxxx with 55.165.049.118 which is your home IP address - we do this to prove step 4
{
     "Version": "2012-10-17",
     "Statement": [
         {
             "Sid": "VisualEditor0",
             "Effect": "Allow",
             "Action": "ec2:TerminateInstances",
             "Resource": "arn:aws:ec2:*:148922931563:instance/*"
         },
         {
             "Sid": "VisualEditor1",
             "Effect": "Deny",
             "Action": "ec2:TerminateInstances",
             "Resource": "arn:aws:ec2:*:148922931563:instance/*",
             "Condition": {
                 "NotIpAddress": {
                     "aws:SourceIp": "55.165.049.118"
                 }
             }
         }
     ]
}

  • Select next create vpc for linux instance

  • In the Policy name section, enter: IP_Restrict

  • In the Description section, enter: Allow company's IP address

  • Scroll to the bottom of the page and select Create policy

create vpc for linux instance

  1. Add policy IP_Restrict to group CostTest

    • At IAM Console, left section - select User groups
    • Select CostTest

    create vpc for linux instance

    • Select Permissions

    create vpc for linux instance

    • Select Add permissions, select Attach policies

    create vpc for linux instance

    • In the search box 🔍, enter IP_Restrict.
    • Check the box symbol □ to select a policy, select Attach policies

    create vpc for linux instance

    • Check Permissions policies
      • Now in the CostTest group there is policy IP_Restrict and policy EC2_InstanceTypeRestrict that you created in lab 8.3

    create vpc for linux instance

  2. Check Permissions policies

    • Log in to TestUser with the information you created in lab 8.1, step 4
    • Make sure you are in Region Singapore
    • In the search box 🔍, enter EC2

    create vpc for linux instance

    • At the EC2 interface, in the middle of the page, select Launch instance

    create vpc for linux instance

    • In the Name section, enter EC2_IP

    • In the Architecture section, keep the value 64-bit (x86)

    create vpc for linux instance

    • In the Instance type section, select the triangle symbol, enter t3.small

    • In the key pair name section, select the triangle symbol, select Proceed without a key pair (Not recommended)

    • Select llaunch instance

    create vpc for linux instance

    • Select Instance ID that has just been successfully created

    create vpc for linux instance

    • Check the box symbol to select EC2 instance
    • Select Instance state
    • Select Terminate instance

    create vpc for linux instance

    • Select Terminate

    create vpc for linux instance

    • The system reports an error as shown in the picture because you are not authorized to delete EC2. This demonstrates the success of your policy creation in step 2 - with an IP address different from the company’s IP address.

    create vpc for linux instance

  3. Check Permissions policies with correct IP address

    • In the IAm interface, select Policies
    • In the search box, enter IP_Restrict
    • Select IP_Restrict

    create vpc for linux instance

    • Select Edit

    create vpc for linux instance

    • In line aws:SourceIp, change the IP range: 55.165.049.118 with the IP address you took in step 1: 14.xxx.xxx.xxx
    • Select Next

    create vpc for linux instance

    • Select Save changes

    create vpc for linux instance

    • Return to the EC2 interface
    • Check the box symbol to select the EC2 instance you created in step 4
    • Select Instance state
    • Select Terminate instance

    create vpc for linux instance

    • Select Terminate

    create vpc for linux instance

    • Congratulations, you have successfully deleted EC2 when accessing your AWS account from the company’s IP address.

    create vpc for linux instance