Settings

How to authenticate

1. Use an existing AWS CLI profile in ~/.aws/credentials.
2. Or set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in .env.local.
3. Restart the dev server after changing credentials.

IAM actions used

• sts:GetCallerIdentityShow which account you are signed in as
• ec2:DescribeInstancesList instances
• ec2:StartInstancesStart a stopped instance
• ec2:StopInstancesStop a running instance
• ec2:RebootInstancesReboot a running instance
• ec2:RunInstancesLaunch a new Windows instance
• ec2:DescribeImagesList Windows AMIs
• ec2:DescribeSubnetsPick a subnet when launching
• ec2:DescribeSecurityGroupsPick a security group when launching
• ec2:CreateKeyPairCreate a key pair and download the PEM
• ec2:DescribeKeyPairsList key pairs
• ec2:DeleteKeyPairDelete a key pair
• ec2:GetPasswordDataGet the Windows launch password
• ec2:DescribeAddressesList Elastic IPs
• ec2:AllocateAddressCreate a static Elastic IP
• ec2:AssociateAddressAttach a static IP to an instance
• ec2:DisassociateAddressDetach a static IP
• ec2:ReleaseAddressRelease an unused Elastic IP
• ssm:SendCommandGenerate or set a Windows password
• ssm:GetCommandInvocationRead the password-reset result
• ce:GetCostAndUsageMonth-to-date and daily spend
• ce:GetCostForecastRest-of-month forecast
• billing:GetCreditsCredits remaining

apployd-developer cannot attach this policy to itself. Run this from an admin user or root:

aws iam put-user-policy --user-name apployd-developer --policy-name AwsLiteCostsAndCredits --policy-document file://aws-lite-billing-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:GetCallerIdentity",
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances",
        "ce:GetCostAndUsage",
        "ce:GetCostForecast",
        "billing:GetCredits"
      ],
      "Resource": "*"
    }
  ]
}