Content tagged with "iam"
Hands-on verification of S3 account regional namespaces via CLI. Measured per-region prefix length limits, tested IAM condition key enforcement, and discovered built-in name protection in the global namespace.
Hands-on verification of the Aurora DSQL SQLx connector for Rust. Connection code drops from ~50 lines to one, and the OCC retry helper works — but default max_attempts=3 falls short under high concurrency.
Hands-on verification of Aurora PostgreSQL Express Configuration. VPC-free setup in ~30 seconds, TLS 1.3 via Internet Access Gateway, and default IAM auth — with real measurements and edge cases.
Hands-on verification of EKS Pod Identity session policies. Restrict IAM role permissions per association without creating additional roles. Covers session tag exclusivity, policy size limits, and trade-offs to evaluate before adoption.
After fixing an IAM policy, ArgoCD's error backoff delays automatic retry. The argocd.argoproj.io/refresh=hard annotation triggers an immediate retry.
When the IAM policy is scoped to a specific repository ARN, accessing a non-existent repo returns AccessDeniedException, not 'repository not found'. Compare the IAM Resource ARN with the repoURL to debug.
If ECS Managed Daemons won't start, check that the instance profile uses AmazonECSInstanceRolePolicyForManagedInstances. The legacy AmazonEC2ContainerServiceforEC2Role won't work.
Security Agent Application is one per region, not one per account. An Application created in Tokyo is invisible from us-east-1. Each region requires its own create-application call.
Security Agent pentest fails at PREFLIGHT with AccessDeniedException if the service role lacks logs:CreateLogGroup. Not mentioned in official docs.
AWS DevOps Agent IAM actions use the aidevops prefix, not devops-agent. The boto3 client name is devops-agent but IAM policies need aidevops:*. AWS CLI support was added in v2.34.20.
AmazonECSInfrastructureRolePolicyForLoadBalancers ARN doesn't use the service-role/ prefix. Using the same pattern as other ECS policies causes AttachRolePolicy to fail.
Session policy denials say 'no session policy allows', while IAM role denials say 'no identity-based policy allows'. Knowing the difference makes IAM troubleshooting much easier.
Foundation Model ARNs use arn:aws:bedrock:region::foundation-model/... with no account ID. Replacing the ACCOUNT_ID placeholder from samples breaks the IAM policy.
The access entry auto-created by EKS Capabilities has no deploy permissions. Without associate-access-policy, ArgoCD Application sync silently fails.
EC2 FullAccess and even AdministratorAccess fail with InsufficientRolePermissions. A dedicated managed policy is required.
Some docs reference CheckpointDurableExecutions (plural), but the actual required action is singular. Plural form causes permission errors.