When you spin up an Amazon Linux AMI instance, the ec2-user automatically gets sudo privileges through the /etc/sudoers.d/ directory configuration. Unlike traditional Linux distributions where you'd find everything in /etc/sudoers, Amazon uses a modular approach.

Execute this command to view the actual configuration:

cat /etc/sudoers.d/90-cloud-init-users

You'll typically see content similar to:

# User rules for ec2-user
ec2-user ALL=(ALL) NOPASSWD:ALL

Amazon uses cloud-init for initial configuration, which creates this file during instance provisioning. This method provides several advantages:

• Easy maintenance (file gets regenerated on instance refresh)
• Separation from the main sudoers file
• Cloud-friendly configuration management

For your specific need of limiting ec2-user's privileges while maintaining system administration capabilities, here's a recommended approach:

# 1. Create a new sudoers file for your custom rules
sudo visudo -f /etc/sudoers.d/99-custom-permissions

# 2. Add these restricted permissions:
ec2-user ALL=(ALL) NOPASSWD: /bin/systemctl restart httpd,/bin/systemctl restart mysqld,/usr/bin/vim /etc/httpd/conf.d/*.conf

For production systems, consider:

# Create a dedicated admin group
sudo groupadd webadmins

# Add users to the group
sudo usermod -a -G webadmins ec2-user

# Configure group permissions
%webadmins ALL=(ALL) NOPASSWD: /bin/systemctl restart httpd,/bin/systemctl status httpd

Always test sudo permissions before logging out:

sudo -l

This command will list the allowed (and forbidden) commands for your current user.

If you encounter issues:

• Check the syntax with visudo -c
• Verify file permissions (must be 0440)
• Remember that files in /etc/sudoers.d/ are read in alphabetical order

When you launch an Amazon Linux AMI instance, the ec2-user comes pre-configured with sudo privileges through a clever mechanism that might not be immediately obvious in the standard /etc/sudoers file. Here's how it works:

# Check sudo permissions for ec2-user
$ sudo -lU ec2-user
User ec2-user may run the following commands on this host:
    (ALL) ALL

Amazon Linux uses the /etc/sudoers.d directory for user-specific sudo configurations. The specific file granting ec2-user privileges is:

$ cat /etc/sudoers.d/90-cloud-init-users
# User rules for ec2-user
ec2-user ALL=(ALL) NOPASSWD:ALL

This configuration allows passwordless sudo access, which is typical for cloud-init managed instances.

To implement least privilege principles while maintaining functionality, consider creating a custom sudoers file:

$ sudo visudo -f /etc/sudoers.d/webadmin
# Web administration privileges
webadmin ALL=(root) NOPASSWD: /bin/systemctl restart httpd
webadmin ALL=(root) NOPASSWD: /bin/systemctl restart mysqld
webadmin ALL=(www-data) /usr/bin/vi /var/www/html/*

For production systems, consider these additional security measures:

• Replace the blanket NOPASSWD rule with specific commands
• Create separate system and application administration accounts
• Implement sudo command logging

# Example of command-specific sudo rules
ec2-user ALL=(root) NOPASSWD: /usr/bin/yum update
ec2-user ALL=(root) NOPASSWD: /usr/bin/systemctl restart *

Always verify your sudo configurations:

$ sudo visudo -c  # Check all sudoers files for syntax errors
$ sudo -lU ec2-user  # View effective privileges

Remember that changes to sudo configuration can lock you out of your system if not done carefully. Always maintain alternative access methods when modifying these files.