0

I have created custom IAM policy to have a read access to loadbalancer. But I am getting error as...

An error occurred fetching load balancer data: User: arn:aws:iam::000000000000:user/xxxxxxxx is not authorized to perform: elasticloadbalancing:DescribeLoadBalancers

Bellow is the policy.

{ "Version": "2012-10-17", "Statement":[{ "Effect": "Allow", "Action": [ "elasticloadbalancing:Describe*", ], "Resource": "arn:aws:elasticloadbalancing:us-west-2:000000000000:loadbalancer/*" }] }

Please some one help with this.

Thanks

Sreekanth

Improve this question

2 Answers 2

Reset to default
1

Generally speaking, the Describe* actions do not support resource-level permissions.

For Describe* actions, you need to use * as your resource, otherwise, the commands will fail as not permitted.

Documentation and more information: http://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-authentication-access-control.html#elb-resource-level-permissions

Improve this answer
0

Here is the solution I figured out. Bellow is the policies.

Read only AWS LB Access Policy:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:Describe*" ], "Resource": "*" } ] }
Improve this answer
9
  • Allowing Describe* will not allow Delete*. This is not how IAM policies work. Such a deny policy is not required. IAM policies are "deny by default". So unless there is an allow statement for Delete*, it won't be permitted. The exception is if there is another policy or Managed Policy applied to the user or load balancer that is allowing Delete*. Commented Aug 28, 2016 at 17:01
  • No, I have two more policies attached to the user. I can post them in some time. Commented Aug 28, 2016 at 17:03
  • Policy1..... { "Version": "2012-10-17", "Statement": [ { "Action": [ "ec2:Describe*" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringEquals": { "ec2:Region": "us-west-2" } } } ] } Commented Aug 28, 2016 at 17:05
  • Policy2.....{ "Version": "2012-10-17", "Statement": [ { "Sid": "ECUnrestricted", "Effect": "Allow", "Action": [ "elasticache:Describe*", "elasticache:List*" ], "Resource": "*" } ] } Commented Aug 28, 2016 at 17:07
  • None of these policies will allow change/delete on an ELB. My statement still stands: the deny policy is not required. Commented Aug 28, 2016 at 17:11

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.