Can I Set Up a Cron-Style IAM Policy for Specific Times and Days?
Asked by
TechyNinja42
I'm looking to create an IAM policy that allows access only during certain times of the day or specific days of the week or month. I've seen `aws:CurrentTime` being used, but it seems like the condition expressions only support basic operations like greater than or less than. Is there a way to implement a cron-style policy for AWS IAM?
Answers
You might need some automation to refresh your policy regularly. Fortunately, the replication lag for these policies is pretty short, so you can set things up fairly quickly.
Reply to this answer
If you're looking to allow access between certain dates, you can definitely set up a policy for that. For example, you can use a condition like 'DateGreaterThan' and 'DateLessThan' in your IAM policy. However, if you want to restrict access during specific hours, automation will be necessary.
Reply to this answer
Unfortunately, that's not straightforward in AWS. Our setup uses an on-call rotation synchronized with groups. When someone new goes on-call, automation adds them to a group and removes the previous on-call person. The group has permissions to assume specific roles. If you're not working with humans, you could modify roles and trust policies, adding and removing permissions based on the time needs.
Reply to this answer
Thanks for all the insightful responses!
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions