Limit a user to one instance in stack on Opsworks

Question

I have multiple instances on a stack on opsworks. I also have IAM for the devs using the stack. Now, if I want to limit one user to use only his instance and not have control on any other instance, is there a way to do it?

Answer 1

As far as I know this isn't possible by default, and it kind of defeats the goals of OpsWorks.

The idea with OpsWorks is that all instances within a layer are more or less homogeneous and are automatically configured to that homogeneous state by the setup, configure and deploy life-cycle events.

Using it to create instances then allowing users to log in to "their" instance defeats the purpose because then presumably all the instances in your layer will be unique and you won't be able to replace them with an identical instance automatically.

Rather than letting your devs access one of the instances in your production stack, I suggest cloning your production stack and creating a separate dev stack for them. Another alternative is to have an "a" and "b" stack, and when you deploy stack changes you swap your production endpoints (ie. domain names) from one to another.