SCP 在组织中限制 EC2 实例的创建，没有强制标签的卷答案

【问题标题】：SCP in Organization to restrict the creation of EC2 instance, volumes without mandatory tagsSCP 在组织中限制 EC2 实例的创建，没有强制标签的卷
【发布时间】：2020-05-20 08:00:51
【问题描述】：

我在组织中添加了一个 SCP 来限制 EC2 实例的创建，没有强制标签的卷。手动创建带有强制标签的实例工作正常。当我在 CloudFormation 中传递所有标签时，它无法创建实例。

政策

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyRunInstanceWithNoProjectTag",
            "Effect": "Deny",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "Null": {
                    "aws:RequestTag/AppID": "true"
                }
            }
        }
    ]
}

错误信息：

API: ec2:RunInstances 您无权执行此操作。编码授权失败消息：ghoOCHN7ZLl0rvdRObGsJeDyE86Nt0lqYYAhVmOHGu7J2zGxbuDWa3VyYl75TfChof_km2U-_Eo4c9Kq6qY_XvmTN-nZa3inB6QEVG0OvOokZuFyFiOS0vSIorhW2uwVmI8w25Fqgf5ueBH0bxq5BnmY7gTCcI9NjCHzEpBY4nudbrNm1iNfQSPldof4CwmibMip_Cs-JgQ2vV76wjo0DgLQDDp6Yzk65-Std9ihGqnlE8DiHBE_dKiUNQtfqXcJ8jsAjjnP-DSmHBprg-IJB-bsOWHElylusj-zCDKby44xiLnG1sv_7pbIhFPcV5gezCaTufGlB9wkZxFuncYPl5Uv6xsL7CmGi_UXHcKeyQpLxMwXRBuo6SWTplsI67_LLskvvj00Kj8_8XDi5kz87B9kkWSiBoykgDHVZPngK6DSMv1YhPAbDu03oVw3wdYxzQO3MwoX-tXGJN63NtYhf-GDO-G9YF599zWSX5kT41FJlmuYDBn7nDPrXpXZLAhIjyulUnQOzuz4aEG_xWDiY-ZAZNuI6o7Df_K0OuI3xU-qKpgssSUt6bR6goHoaQJ_NDSzzoodusYtk69RPv_Pyom5WETfOv9zfGtKAkmn5Sk4NTP7T0rYClOnaUvx_MkKy1Lk6jFGYNfROqs96UIxBsYUhD-QEOjRZQ4-L7GSNIn3cZfCHJ9e5ZuPflQpMQsRiV9tUIessOC8uKnGYRZw4cSeCNzTgjLypcCbFchf01qdFsB4TrTtOTRMzYf1-ImBg4CY3CycmZ8Cduv_wSWTw P>

云形成：

Description: CloudFormation template to create Windows2016 VM
Parameters:
  vpcid:
    Type: String
  subnetid1:
    Type: String  
  az1:
    Type: String   
  instanceType:
    Type: String
    Default: t2.micro   
  ami:
    Type: String   
  CostCenter:
    Type: String
  ApplicationName:
    Type: String
  ProjectID:
    Type: String
  IONumber:
    Type: String
  Environment:
    Type: String
  ApplicationOwner:
    Type: String
  BusinessOwner:
    Type: String
  BusinessUnit:
    Type: String
  Hostname:
    Type: String
  Backup:
    Type: String
    Default: default
  Basesgwindows:
    Type: String
  AppID:
    Type: String
    Default: 1234
Resources:
  instance1:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ami
      InstanceType: !Ref instanceType
      SubnetId: !Ref subnetid1
      AvailabilityZone: !Ref az1
      SecurityGroupIds:
        - !Ref Basesgwindows
      Tags:
        - Key: "BusinessUnit"
          Value: !Ref BusinessUnit
        - Key: "CostCenter"
          Value: !Ref CostCenter
        - Key: "ApplicationName"
          Value: !Ref ApplicationName
        - Key: "ProjectID"
          Value: !Ref ProjectID
        - Key: "IONumber"
          Value: !Ref IONumber
        - Key: "Environment"
          Value: !Ref Environment  
        - Key: "ApplicationOwner"
          Value: !Ref ApplicationOwner
        - Key: "BusinessOwner"  
          Value: !Ref BusinessOwner
        - Key: "Hostname"
          Value: !Ref Hostname
        - Key: "Backup"
          Value: !Ref Backup
        - Key: "AppID"
          Value: !Ref AppID

【问题讨论】：

能否也粘贴您的 cloudformation 代码？
@Hassan Mussana，已添加
@Hassan，任何建议

标签： amazon-web-services amazon-ec2 amazon-cloudformation

【解决方案1】：

AWSTemplateFormatVersion: 2010-09-09
Description: CloudFormation template to create Windows2016 VM
Parameters:
  vpcid:
    Type: String
  subnetid1:
    Type: String  
  az1:
    Type: String   
  instanceType:
    Type: String
    Default: t2.micro   
  ami:
    Type: String   
  CostCenter:
    Type: String
  ApplicationName:
    Type: String
  ProjectID:
    Type: String
  IONumber:
    Type: String
  Environment:
    Type: String
  ApplicationOwner:
    Type: String
  BusinessOwner:
    Type: String
  BusinessUnit:
    Type: String
  Hostname:
    Type: String
  Backup:
    Type: String
    Default: default
  Basesgwindows:
    Type: String
  AppID:
    Type: String
    Default: 1234
Resources:
  instance1:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref ami
      InstanceType: !Ref instanceType
      SubnetId: !Ref subnetid1
      AvailabilityZone: !Ref az1
      SecurityGroupIds:
        - !Ref Basesgwindows
      Tags:
        - Key: "BusinessUnit"
          Value: !Ref BusinessUnit
        - Key: "CostCenter"
          Value: !Ref CostCenter
        - Key: "ApplicationName"
          Value: !Ref ApplicationName
        - Key: "ProjectID"
          Value: !Ref ProjectID
        - Key: "IONumber"
          Value: !Ref IONumber
        - Key: "Environment"
          Value: !Ref Environment  
        - Key: "ApplicationOwner"
          Value: !Ref ApplicationOwner
        - Key: "BusinessOwner"  
          Value: !Ref BusinessOwner
        - Key: "Hostname"
          Value: !Ref Hostname
        - Key: "Backup"
          Value: !Ref Backup
        - Key: "AppID"
          Value: !Ref AppID

【讨论】：