Skip to main content

AWS IAM Policy

Admin Only

This page is only visible to organization administrators.

EntryGuard requires specific AWS IAM permissions to manage Security Group ingress rules. EntryGuard includes a built-in IAM Policy Generator that creates the exact policy you need based on your configured resources.

Using the IAM Policy Generator​

Navigate to IAM Policy under the Admin section in the sidebar.

The page shows:

  1. Included Resources — A list of all AWS resources you've configured in EntryGuard, showing their resource type, name, and identifier (e.g., "Security Group — Production DB (sg-0abc123)")
  2. Generated Policy — The IAM policy JSON tailored to your specific resources

Click Copy to copy the policy to your clipboard, then apply it to your AWS IAM user.

tip

If you see "No AWS resources configured", add resources on the Resources page first, then return here.

Minimum Required Permissions​

PermissionPurpose
ec2:AuthorizeSecurityGroupIngressAdd IP whitelisting rules
ec2:RevokeSecurityGroupIngressRemove IP rules when sessions expire
ec2:DescribeSecurityGroupsVerify Security Groups exist
sts:GetCallerIdentityVerify credentials during setup

Setting Up the IAM User in AWS​

1. Create IAM User​

  1. Sign in to the AWS IAM Console
  2. Navigate to Users → Add users
  3. Enter username: entryguard-service
  4. Select Access key - Programmatic access
  5. Click Next: Permissions

2. Attach Policy​

  1. Select Attach existing policies directly
  2. Click Create policy
  3. Switch to the JSON tab
  4. Paste the policy from EntryGuard's IAM Policy Generator page
  5. Click Next: Tags → Next: Review
  6. Name the policy: EntryGuardSecurityGroupAccess
  7. Click Create policy
  8. Go back and select the newly created policy
  9. Click Next: Tags → Next: Review → Create user

3. Save Credentials​

  1. Copy the Access key ID
  2. Click Show and copy the Secret access key
  3. Add them as a credential in EntryGuard
warning

The secret access key is only shown once. If you lose it, you'll need to create new credentials.

Restricting to Specific Security Groups​

For enhanced security, modify the generated policy's Resource field to limit access to specific Security Groups:

{
  "Resource": [
    "arn:aws:ec2:eu-west-1:123456789012:security-group/sg-0abc123",
    "arn:aws:ec2:us-east-1:123456789012:security-group/sg-0def456"
  ]
}

Note: ec2:DescribeSecurityGroups must remain with Resource: "*" (AWS limitation).

Best Practices​

  1. Dedicated user — Create a separate IAM user for EntryGuard (no console access)
  2. Minimum permissions — Use the generated policy; don't grant additional permissions
  3. Rotate credentials — Rotate access keys every 90 days
  4. Monitor usage — Enable CloudTrail logging and review EntryGuard API calls

Next Steps​

API Reference: For programmatic access, see Resources API.