AWS Setup for E192-08 (PET)

Editor: markdown

This guide documents the AWS setup for PET, following best practices for small research institutions. It covers IAM users, groups, policies, security groups (firewall rules), access controls, and typical usage patterns.

Basic Structure

AWS Account:

Root account exists but is not used for daily work
Central management via IAM user: admin-setup
IAM users are assigned to groups

User Groups:

Group	Purpose
`TechAdmins`	Full access to all resources
`FinanceAdmins`	Billing & budget access
`ResearchStaff`	Full research capability (e.g., EC2)
`Students`	Limited EC2 access
`Guests`	Read-only access
`Alumnis`	Access to archived S3 data

Example Users

Username	Groups
`pgerhart`	ResearchStaff
`tchu`	ResearchStaff
`dschroed`	TechAdmins
`mgruenin`	ResearchStaff
`dlicalsi`	ResearchStaff
`jstrasse`	TechAdmins
`ykleindi`	FinanceAdmins

? IAM Policies

ResearchStaff (simplified):

Start, stop, terminate EC2 instances
Manage EBS volumes and snapshots
Manage own key pairs
No access to critical networking components
Allowed IAM actions for password & MFA management

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEC2BasicActions",
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:RebootInstances",
        "ec2:RunInstances",
        "ec2:TerminateInstances",
        "ec2:CreateTags",
        "ec2:CreateVolume",
        "ec2:AttachVolume",
        "ec2:DetachVolume",
        "ec2:DeleteVolume",
        "ec2:CreateSnapshot",
        "ec2:DeleteSnapshot"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowOwnKeyPairs",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateKeyPair",
        "ec2:DeleteKeyPair",
        "ec2:ImportKeyPair"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowSecurityGroupLookups",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeSecurityGroups",
        "ec2:GetSecurityGroupsForVpc"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ExplicitDenyDangerousStuff",
      "Effect": "Deny",
      "Action": [
        "ec2:DeleteSecurityGroup",
        "ec2:DeleteVpc",
        "ec2:DeleteInternetGateway",
        "ec2:DeleteSubnet",
        "ec2:DeleteRouteTable",
        "ec2:DetachInternetGateway"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowSafeIAMSelfActions",
      "Effect": "Allow",
      "Action": [
        "iam:ChangePassword",
        "iam:GetAccountPasswordPolicy",
        "iam:GetUser",
        "iam:ListVirtualMFADevices",
        "iam:EnableMFADevice",
        "iam:ResyncMFADevice",
        "iam:DeactivateMFADevice",
        "iam:DeleteVirtualMFADevice",
        "iam:ListMFADevices"
      ],
      "Resource": "*"
    }
  ]
}

Other policies (for Students, Guests, FinanceAdmins, Alumnis) follow the same structure with tailored permissions.

Security Groups

Security groups in AWS are region-specific and therefore need to be copied to the region in which they are being used.

1. `open-common-ports`

Intended for general use by researchers and students. Allows global access for web and SSH.

Inbound:

Protocol	Port	Source IPv4	Source IPv6
TCP	22	`0.0.0.0/0`	`::/0`
TCP	80	`0.0.0.0/0`	`::/0`
TCP	443	`0.0.0.0/0`	`::/0`

Outbound: All traffic allowed.

2. `open-TUips-allports`

Full access from trusted TU networks.