Open anhkhoa45 opened 3 years ago
Hi anhkhoa45@, what you mentioned is partially correct! The IAM role defines that all dev users are only able to call StartSession against AWS-StartSSHSession and DevSSMRunShell documents. Then in DevSSMRunShell document, the runAsDefaultUser
configuration means the session will start with this system user by default. However, if the dev has the password to switch to another system user, he/she can still do so. This leaves the access control to how you manage the system users. If devs are not supposed to use any other system user, then your assumption is correct.
We have a document described as below (lets call it DevSSMRunShell)
The dev IAM users only have policy to start the session on DevSSMRunShell:
Does this guaranty that the dev IAM users only have permission to start session on OS's
dev-user
?I don't want to strictly use
SSMSessionRunAs
tag on IAM role since maybe in the future I want to start session as different OS user as well.