IAM Permissions

Create an IAM user with the minimum permissions needed to deploy redStack.

redStack provisions EC2 instances, VPCs, subnets, security groups, Elastic IPs, network interfaces, VPC peering connections, and route tables. Your AWS credentials need enough permissions to create and destroy all of these resources.

There are two options. Choose based on the type of AWS account you are using.

To be safe, run redStack from a dedicated, single-purpose throwaway AWS account — one used solely for this lab with no other workloads, billing resources, or sensitive data. If a dedicated account is not practical, use Option B (least privilege) to limit the blast radius if credentials are ever compromised.

---

Option A: AdministratorAccess

Recommended for dedicated lab accounts.

If you created a separate AWS account solely for this lab, AdministratorAccess is the right choice. There are no other workloads, billing resources, or sensitive data in the account to protect. Admin access on an empty account carries the same real-world risk as a scoped policy: if the credentials are compromised, the attacker can only reach the lab infrastructure you already plan to tear down.

Least privilege adds meaningful protection when credentials could expose things beyond this lab. On a dedicated account, there is nothing else to expose. Use Option A and save the complexity of Option B for when it actually buys you something.

1. Create the IAM user

   Open the IAM Console and navigate to Users → Create user.

   Set the username to redS-operator (or any name you prefer).

2. Attach AdministratorAccess

   On the Set permissions screen, choose Attach policies directly.

   Search for AdministratorAccess and check the box next to it.

   Click Next, then Create user.

3. Generate an access key

   Open the newly created user and go to the Security credentials tab.

   Click Create access key.

   Select Command Line Interface (CLI), acknowledge the recommendation, then click Next.

   Copy the Access Key ID and Secret Access Key. The secret is shown only once — save it now.

4. Configure the AWS CLI

   Run aws configure from inside your redStack/ directory and enter the values from the previous step:

   aws configure
   

   Prompt	Value
   AWS Access Key ID	The access key ID you just copied
   AWS Secret Access Key	The secret access key you just copied
   Default region name	us-east-1 (or your chosen region — must match aws_region in terraform.tfvars)
   Default output format	json

---

Option B: Least-privilege policy

Only required if you are deploying into a shared or production AWS account.

Use this option if the AWS account running redStack also contains other workloads, active resources, or anything you cannot afford to lose or expose. Scoping the credentials to only what redStack needs limits the blast radius if the access key is ever leaked or misused.

Why each permission is needed

• ec2:* — redStack is EC2-only infrastructure. Every resource Terraform creates and destroys (instances, VPCs, subnets, security groups, ENIs, EIPs, VPC peering, route tables) maps to an EC2 API call. No S3, RDS, Lambda, or other services are used.
• sts:GetCallerIdentity — Terraform calls this at init to verify credentials and identify the account. Without it, terraform init fails before any resources are touched.
• iam:GetUser, iam:GetUserPolicy, iam:ListUserPolicies, iam:ListAttachedUserPolicies — Read-only, self-scoped to ${aws:username}. Lets you inspect your own permissions when debugging an access denied error. No IAM write access is granted and the scope prevents reading any other principal’s policies.

Minimum IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:*",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:GetUser",
        "iam:GetUserPolicy",
        "iam:ListUserPolicies",
        "iam:ListAttachedUserPolicies"
      ],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}

1. Create the IAM user

   Open the IAM Console and navigate to Users → Create user.

   Set the username to redS-operator.

2. Create the least-privilege policy

   On the Set permissions screen, choose Attach policies directly, then click Create policy.

   Select the JSON tab and paste the policy above.

   Name the policy redStack-least-privilege, then click Create policy.

3. Attach the policy to the user

   Return to the user creation screen. Search for redStack-least-privilege and check the box next to it.

   Click Next, then Create user.

4. Generate an access key

   Open the newly created user and go to the Security credentials tab.

   Click Create access key.

   Select Command Line Interface (CLI), acknowledge the recommendation, then click Next.

   Copy the Access Key ID and Secret Access Key. The secret is shown only once.

5. Configure the AWS CLI

   aws configure
   

   Prompt	Value
   AWS Access Key ID	The access key ID you just copied
   AWS Secret Access Key	The secret access key you just copied
   Default region name	us-east-1 (must match aws_region in terraform.tfvars)
   Default output format	json

---

Verify credentials

After running aws configure, confirm the credentials work:

aws sts get-caller-identity

Expected output:

{
    "UserId": "AIDAXXXXXXXXXXXXXXXXX",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/redS-operator"
}

If this command returns an error, check that the access key was entered correctly in aws configure and that the IAM user has not been deactivated.

aws configure writes credentials to ~/.aws/credentials and region/output preferences to ~/.aws/config. Terraform reads these files automatically when it initializes. You only need to run aws configure once per machine.