amazon-web-services - 如何使用 IAM 服务在 AWS 中按实例类型限制实例启动

Question

我正在使用该策略将 RunIstances 限制为仅适用于特定实例类型和特定区域。当我在测试用户下运行启动向导或模拟时，出现“隐式拒绝”错误。

这是政策:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:us-east-1::instance/*"
      ],
      "Condition": {
        "StringEquals": {
          "ec2:InstanceType": [
            "t1.micro",
            "m1.small"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:us-east-1::image/ami-*",
        "arn:aws:ec2:us-east-1::subnet/*",
        "arn:aws:ec2:us-east-1::network-interface/*",
        "arn:aws:ec2:us-east-1::volume/*",
        "arn:aws:ec2:us-east-1::key-pair/*",
        "arn:aws:ec2:us-east-1::security-group/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "ec2:CreateSecurityGroup",
        "ec2:DeleteSecurityGroup",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:CreateKeyPair"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

有人能指出这个问题吗？

Answer 1

在您的资源 block 中，在 arn 行中的两个“:”之间插入一个星号，以指定所有帐户，或将其替换为您的帐号。

"arn:aws:ec2:us-east-1:*:instance/*"

"arn:aws:ec2:us-east-1:*:image/ami-*",
"arn:aws:ec2:us-east-1:*:subnet/*",
"arn:aws:ec2:us-east-1:*:network-interface/*",
"arn:aws:ec2:us-east-1:*:volume/*",
"arn:aws:ec2:us-east-1:*:key-pair/*",
"arn:aws:ec2:us-east-1:*:security-group/*"