Anyone have a reasonable handle on AWS EC2?

Snags

Got a t2.micro instance, and need to grant someone else permission to start/stop it, so they don't keep bugging me with requests.

Want to do it reasonably properly, but not over the top. I've created them a dedicated IAM user account, and granted Full EC2 permissions to it, but when they log in they can't see the existing instance in the list.

So obviously I need to give them permissions to manipulate that particular instance.

All the docs go on about creating IAM Roles, but with a few dire warnings. After a long day and a few beers, that looks like a convoluted way of achieving a simple goal, but ...

Is there a dummy's guide to all this? We're not talking megacorp needing details full on role-based control for a massive instructure. Just one mate letting another mate turn something off and on without buggering up other stuff.

maharg101

This is a reasonable guide

https://protechgurus.com/allow-iam-user-start-stop-reboot-ec2-instances/

One gotcha that springs to mind, have they selected the correct region ? They won't see the instances if not.

digitalscream

That ^^ link should do it - while you've granted the start/stop/reboot permissions, you also need the DescribeXXX permissions to be able to see them.

And yes, the custom policy JSON is basically the only sensible way to do it (for limited values of "sensible").

Oh, and don't think about getting clever with the "Version" field in the JSON - change that, and nothing will work.

AWS is possibly the most convoluted, bloated, unintuitive bit of tech I've ever come across. If it wasn't for the fact that it's basically the only game in town when you need FCA-approved security (other than DIY), I'd never touch the damn thing.

Snags

@maharg101 Thank you, that's brilliant, and clear. Unlike Amazon's own documentation, which looks great until you actually try to penetrate what it means and actually do something with it. Then you realise you've just worked through about 20 linked pages of information without first digesting the 100 page glossary of terms and paying a small fortune for the intensive training course required to actually put any meaning to it.

digitalscream said:

AWS is possibly the most convoluted, bloated, unintuitive bit of tech I've ever come across.

It does feel like a system that is deliberately obfuscated for no good reason. Possibly because it's too big, and no-one has thought to document it in ascending (or descending) levels of complexity from "Simple task primers with worked examples" down to "here's the heavy shit the clever people can do". It almost makes me think fondly of official Microsoft documentation. Almost.

digitalscream

Snags said:

@maharg101 Thank you, that's brilliant, and clear. Unlike Amazon's own documentation, which looks great until you actually try to penetrate what it means and actually do something with it. Then you realise you've just worked through about 20 linked pages of information without first digesting the 100 page glossary of terms and paying a small fortune for the intensive training course required to actually put any meaning to it.

digitalscream said:

AWS is possibly the most convoluted, bloated, unintuitive bit of tech I've ever come across.

It does feel like a system that is deliberately obfuscated for no good reason. Possibly because it's too big, and no-one has thought to document it in ascending (or descending) levels of complexity from "Simple task primers with worked examples" down to "here's the heavy shit the clever people can do". It almost makes me think fondly of official Microsoft documentation. Almost.

Yes, exactly. And...the thing is, most people just want a container system or plain virtual machines with extensible storage. For that, services like Linode are far more appropriate (hell, it even has a storage system that's directly compatible with AWS S3 tools!) and are waaaay cheaper. But AWS has the gateway drug of the free tier for a year...

Snags

Maybe I'll look at Linode when I've got time to port the install. I'm fairly sure we get an Azure instance as part of our regular sub with MS, but that makes my head hurt as well. 

All of this is just to run a FoundryVTT server for mates to play D&D once a week. I've got through my first bag (free year) so need to have a way for the DM to start and stop the thing for himself, rather than having it running 24/7. Not that it would cost much if it did, but ...

digitalscream

Snags said:

Maybe I'll look at Linode when I've got time to port the install. I'm fairly sure we get an Azure instance as part of our regular sub with MS, but that makes my head hurt as well. 

All of this is just to run a FoundryVTT server for mates to play D&D once a week. I've got through my first bag (free year) so need to have a way for the DM to start and stop the thing for himself, rather than having it running 24/7. Not that it would cost much if it did, but ...

For what it's worth, the minimum $5/month Linode should run FoundryVTT fine, although the $10/month one would probably be better.

Snags

Thanks.

Fairly sure with AWS we're only into about $8 if we run constantly, so with knocking the instance out other than for playing time (3 hours or so) and whatever setup time the DM needs (unkown, he does tinker a lot) it may not be worth the aggro. I'll see how it shakes down over the next couple of months.