AWS Amazon EC2 Permission

aws_snapshot_create_volume_permission (Terraform)

The Permission in Amazon EC2 can be configured in Terraform with the resource name aws_snapshot_create_volume_permission. The following sections describe 3 examples of how to use the resource and its parameters.

Example Usage from GitHub

Murtu1609/TFAWSShareAmis

resource "aws_snapshot_create_volume_permission" "snaphot_permissions" {
for_each = {for object in data.aws_ebs_snapshot_ids.snapshot_ids.ids : object => object}
  snapshot_id   = each.key
  account_id = var.dest_account_id

niveklabs/aws

resource "aws_snapshot_create_volume_permission" "this" {
  account_id  = var.account_id
  snapshot_id = var.snapshot_id
}

C2Devel/terraform-examples

resource "aws_snapshot_create_volume_permission" "test_volume_permission" {
  snapshot_id = aws_ebs_snapshot.test_snapshot.id

  # NOTE: specify 'account_id' as 'project_name' and 'customer_name' pair
  account_id = var.account_id
}

Parameters

• account_id required - string
• id optional computed - string
• snapshot_id required - string

Explanation in Terraform Registry

Adds permission to create volumes off of a given EBS Snapshot.

Tips: Best Practices for The Other AWS Amazon EC2 Resources

In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.

aws_default_vpc

Ensure to avoid using default VPC

It is better to define the own VPC and use it.

aws_network_acl_rule

Ensure your network ACL rule blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.

aws_ebs_volume

Ensure to use a customer-managed key for EBS volume encryption

It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).

aws_instance

Ensure to avoid storing AWS access keys in user data

It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.

aws_security_group

Ensure your security group blocks unwanted inbound traffic

It is better to block unwanted inbound traffic.