Introduction

Some Cornell AWS account owners want to give their teams full access to their AWS account, with the exception of AWS Marketplace. The resources described here can help do that.

One situation where these resources would be helpful is when a Cornell AWS account has research credits from AWS and the account owners wants to ensure that AWS Marketplace offerings are not purchased, since such products cannot be covered by AWS credits.

Description

The CloudFormation template at cu-aws-cloudformation/marketplace-iam creates two resources:

Note that this policy and IAM role serve only as first-order safeguards. A savvy AWS user can fairly easily contrive to bypass this policy and role.

Deployment

  1. In the target AWS account, create a new CloudFormation stack using the template.yaml file.
  2. Create an Active Directory group that contains the people you wish to have access to the shib-admin_no_market role in your AWS account.
  3. Make a request to cloud-support@cornell.edu asking that the shib-admin_no_market role be configured for use by your AWS account. Optionally, request that a similar AWS SSO role be created as well. Be sure to provide the name of the AD group you created above.
  4. Once the Cloud Team confirms that the shib-admin_no_market group and/or the AWS SSO role is enabled, ask your team to begin using the new role(s) when using your AWS account.

References