amazon-web-services - 使用 cloudformation 附加 IAM 角色

Question

我正在尝试创建一个 Web 服务器(Ec2 实例)，该服务器具有使用 ccloudformation 访问 S3 存储桶的 IAM 角色。它创建角色，但不将角色附加到 ec2-instance。

webserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: sg-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VPC
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone: us-east-2a
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: "8"
            VolumeType: gp2
      ImageId: ami-0bdcc6c05dec346bf
      InstanceType: t2.micro
      KeyName: key-webserver
      NetworkInterfaces:
        - Description: Primary network interface
          DeviceIndex: 0
          SubnetId: !Ref SubnetA
          GroupSet:
            - Ref: webserver
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - Ref: S3FullAccess
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:List*
            Resource: "*"
      Roles:
        - Ref: S3FullAccess
  S3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"

yml 文件工作正常。它创建 ec2 实例和安全组，但不将 IAM 角色附加到 ec2 实例

Answer 1

您没有将其附加到 EC2 资源，它应该通过 IamInstanceProfile 添加它。 EC2 的属性。

该值应为!Ref ListS3BucketsInstanceProfile

实例配置文件永远不会自动附加到实例。

webserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: sg-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VPC
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone: us-east-2a
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: "8"
            VolumeType: gp2
      ImageId: ami-0bdcc6c05dec346bf
      InstanceType: t2.micro
      IamInstanceProfile: !Ref ListS3BucketsInstanceProfile
      KeyName: key-webserver
      NetworkInterfaces:
        - Description: Primary network interface
          DeviceIndex: 0
          SubnetId: !Ref SubnetA
          GroupSet:
            - Ref: webserver
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - Ref: S3FullAccess
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:List*
            Resource: "*"
      Roles:
        - Ref: S3FullAccess
  S3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"

有关实例配置文件的更多信息，请查看此 link .