amazon-web-services - 跨账户共享 AMI

Question

我已在 dev (acct-id - 1111111) 中创建了镜像，并且需要在 prod (22222222)(同一区域)上使用相同的镜像。但我收到以下错误。图像在 Dev 工作区上构建，然后在 PROD 工作区中使用它。开发人员正在正常工作，我已配置了 AWS::ImageBuilder::DistributionConfiguration，并为这两个工作区配置了启动权限。

WEBAutoScalingGroup - AWS::AutoScaling::AutoScalingGroup - CREATE_FAILED - API: autoscaling:CreateAutoScalingGroup Not authorized for images: [ami-02adsdsw4d8216f7b0a]

我的图像生成器权限如下。

---
AWSTemplateFormatVersion: '2010-09-09'
Description: image builder policy

Parameters:
  Dev:
    Default: 11111111111
    Type: String
  Prod:
    Default: 22222222222
    Type: String
    
Resources:
  ImageBuilderpolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Extra permission for Image builder role 
      Roles:
        - EC2InstanceProfileForImageBuilder
      PolicyDocument:
          Version: '2012-10-17'
          Statement:  
              # s3 get object permission for image builder
              - Effect: Allow
                Action:
                  - s3:Get*
                  - s3:List*
                Resource: 
                  - "arn:aws:s3:::dev-imagebuilder-cicd/*"
                  - "arn:aws:s3:::dev-imagebuilder-cicd"
                

#Imagebuilder policy to cicd role
  IAMPolicyEC2ImageBuilder:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - CICDRole
      Description: Policy to access AWS EC2 Image Builder Service
      ManagedPolicyName: 'EC2ImageBuilderIAMPolicy'
      Path: '/ImageBuilder-Management/'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'imagebuilder:CreateComponent'
              - 'imagebuilder:CreateDistributionConfiguration'
              - 'imagebuilder:CreateImage'
              - 'imagebuilder:CreateImagePipeline'
              - 'imagebuilder:CreateImageRecipe'
            Resource: '*'
            
          - Effect: Allow
            Action:
              - 'imagebuilder:CreateInfrastructureConfiguration'
            Resource: '*'
            
          - Effect: Allow
            Action:
              - 'imagebuilder:CancelImageCreation'
              - 'imagebuilder:Get*'
              - 'imagebuilder:DeleteComponent'
              - 'imagebuilder:DeleteDistributionConfiguration'
              - 'imagebuilder:DeleteImage'
              - 'imagebuilder:DeleteImagePipeline'
              - 'imagebuilder:DeleteImageRecipe'
              - 'imagebuilder:DeleteInfrastructureConfiguration'
              - 'imagebuilder:ImportComponent'
              - 'imagebuilder:StartImagePipelineExecution'
              - 'imagebuilder:TagResource'
              - 'imagebuilder:UntagResource'
              - 'imagebuilder:UpdateDistributionConfiguration'
              - 'imagebuilder:UpdateImagePipeline'
              - 'imagebuilder:UpdateInfrastructureConfiguration'
            Resource: '*'
            
          - Effect: Allow
            Action:
              - 'sns:Publish'
            Resource: !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:*imagebuilder*'
          - Effect: Allow
            Action: iam:PassRole
            Resource:
            - !Sub arn:aws:iam::${AWS::AccountId}:instance-profile/EC2InstanceProfileForImageBuilder
            - !Sub arn:aws:iam::${AWS::AccountId}:role/EC2InstanceProfileForImageBuilder
            Condition:
              StringEquals:
                iam:PassedToService: ec2.amazonaws.com
          - Effect: Allow
            Action: iam:CreateServiceLinkedRole
            Resource: arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder
            Condition:
              StringLike:
                iam:AWSServiceName: imagebuilder.amazonaws.com
          - Effect: Deny
            Action:
            - ec2:RunInstances
            - ec2:AssociateIamInstanceProfile
            Resource: "*"
            Condition:
              StringEquals:
                ec2:InstanceProfile: !Sub arn:aws:iam::${AWS::AccountId}:instance-profile/EC2InstanceProfileForImageBuilder

  Ec2ImageBuilderCrossAccountDistributionAccessPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - CICDRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: "ec2:CreateTags"
            Resource: "arn:aws:ec2:*::image/*"
          - Effect: Allow
            Action:
              - "ec2:DescribeImages"
              - "ec2:CopyImage"
              - "ec2:ModifyImageAttribute"
            Resource: "*"

  EC2ImageBuilderDistributionCrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EC2ImageBuilderDistributionCrossAccountRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action:
              - "sts:AssumeRole"
          - Effect: Allow
            Principal:
              AWS: 
                - !Sub arn:aws:iam::${Dev}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder
                - !Sub arn:aws:iam::${Prod}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder
            Action:
              - "sts:AssumeRole"

      Policies:
      - PolicyName: EC2ImageBuilderKMSInlinePolicy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action: 
                - 'kms:Encrypt'
                - 'kms:Decrypt'
                - 'kms:ReEncrypt*'
                - 'kms:GenerateDataKey*'
                - 'kms:DescribeKey'
                - 'kms:CreateGrant'
                - 'kms:ListGrants'
                - 'kms:RevokeGrant'
                - 'ec2:CreateLaunchTemplateVersion'
                - 'ec2:ModifyLaunchTemplate'
                - 'ec2:DescribeLaunchTemplates'
                - 'ec2:CreateTags'
              Resource: '*'
            - Effect: Allow
              Action:
                - ec2:CreateLaunchTemplateVersion
                - ec2:ModifyLaunchTemplate
              Resource: "*"
              
            - Effect: Allow
              Action:
                - ec2:DescribeLaunchTemplates
              Resource: "*"
              
            - Effect: Allow
              Action:
                - ec2:CreateTags
              Resource: arn:aws:ec2:*:*:launch-template/*
              
      ManagedPolicyArns:
        - !Ref Ec2ImageBuilderCrossAccountDistributionAccessPolicy
                
 

不确定为什么会失败并出现“未授权图像”错误。

Answer 1

我不确定 Image Builder 是否与解决您遇到的问题相关。创建AMI时，您需要share使用帐户 222222。如果您使用 Image Builder 管道构建 AMI，只需将 aws ec2 modify-image-attribute 命令添加到管道

为了进行测试，在自动扩展组中使用 AMI 之前，请尝试在产品帐户中从中启动实例。如果您不能 - 首先解决这个问题。