I added a user "Snapshotter" to my AWS account (via IAM) with permission just to
On one of my instances I want to have a script that periodically created a snapshot, but without storing on that instance any credentials or certificates that allow more permissive access to the account or to other EC2 commands.
How do I achieve that?
In the IAM I can get the "secret access key" and the "access key ID" for the Snapshotter user, but it appears like the private key and X509 certificates are only for the entire account and hence would entail full access.
$ ec2-create-snapshot -h SYNOPSIS ec2addsnap ([ec2-create-snapshot]) ec2addsnap [GENERAL OPTIONS] -d DESCRIPTION VOLUME ... GENERAL OPTIONS -K, --private-key KEY Specify KEY as the private key to use. Defaults to the value of the EC2_PRIVATE_KEY environment variable (if set). Overrides the default. -C, --cert CERT Specify CERT as the X509 certificate to use. Defaults to the value of the EC2_CERT environment variable (if set). Overrides the default.