Deploying Next.js 14 Fullstack on AWS EC2 > Restrict Access with IAM Service

Restrict Access with IAM Service

Best practice: Avoid using the Root User. Instead, create IAM Users with minimal permissions needed to manage resources. This makes management easier and reduces security risks.

In this section, we will create a policy to restrict a user to only interact with EC2 Instances in the ap-southeast-1 region.

1. Access the AWS IAM Management Console

2. Create Custom Policies

2.1. On the left navigation menu, select Policies.

2.2. In the Policies interface, click Create policy.

2.3.

Step 1 - Specify permissions:

Go to the JSON tab, paste the following JSON into the Policy Editor, and click Next.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:RequestedRegion": "ap-southeast-1"
        }
      }
    }
  ]
}

Specify permissions.png

This policy allows users to manage EC2 instances only in the ap-southeast-1 region.

2.4.

Step 2 - Review and Create:

Enter a Policy Name: ec2-restricted-region.
Enter a Description: Allow access to EC2 only in ap-southeast-1.
Click Create policy.

review-and-create

3. Create a User Group and Assign the Policy

To reuse this policy, assign it to an IAM Group. All IAM Users in this group will have the same permissions.

3.1. Access User groups from the left navigation menu. user-group

3.2. In the User groups interface, click Create group.

3.3. In the Create user group interface:

Enter User Group Name: ec2-restricted-group.
Under Filter by Type, select Customer Managed.
Choose the policy created earlier.
Click Create user group.
After creation, you should see a summary like this:

4. Create a User and Assign Them to the Group

4.1. Access Users from the left navigation menu. user-tab

4.2. Click Create user.

4.3.

Step 1 - Specify user details:

Enter a username: restricted_user.
Select Provide user access to the AWS Management Console.
Choose I want to create an IAM user.
Set a custom password: restricted_user1.
Click Next.
4.4.

Step 2 - Set permissions:

Select Add user to group.
Choose the group created earlier (e.g., ec2-restricted-group).
Click Next.
4.5.

Step 3 - Review and Create:

Review the user and permissions.
Click Create user.
4.6.

Step 4 - Retrieve password:

Save or download the .csv file to manage user credentials.
4.7. Log in as the IAM User:
Copy the sign-in URL.
Log in using the username: restricted_user and password: restricted_user1.
After signing in, change your password.

Testing:

Check the EC2 service in us-east-2: The policy should restrict access in this region.
Check the EC2 service in ap-southeast-1: Access should be allowed.

Restrict Access with IAM Service

1. Access the AWS IAM Management Console

2. Create Custom Policies

3. Create a User Group and Assign the Policy

4. Create a User and Assign Them to the Group

Testing:

Completed! 🚀