I have seen in earlier posts that I can restrict access to S3 bucket using the EC2 instance IAM Role. But the catch here is, if I have an account with several users in it, I cannot restrict the use of an IAM role to a particular group or individuals within that account. This inability prevents me from blocking anyone in that account to spin an instance using that IAM role.
So my dilemma is, if I have given S3 access based on EC2 Role and cannot lock down the users within an account who can use that role, this opens my S3 bucket to everyone in the account.
Please let me know if there is a way I can, either (1) Restrict EC2 instances getting spun up using a particular role, OR, (2) Restrict S3 access based on EC2 Role AND user logged into the instance.
Launching an Amazon EC2 instance with an assigned requires the PassRole permission, which can further specify which roles can be passed to the instance.
By default, you should not give anybody the PassRole permission. You could then assign it to appropriate Users/Groups, specifying exactly which roles they can use.
This avoids the chance that a User within limited permissions can gain extra permissions by launching an instance with a Role, and then using the temporary credentials granted to the instance to do activities beyond their assigned permissions.
This is similar to the AssumeRole permission, which controls who is allowed to assume which roles.
For more information, see: Granting Permission to Launch EC2 Instances with IAM Roles (PassRole Permission)