Amazon EC2 IAM 策略：仅限修改单个安全组

Question

我正在尝试在 Amazon AWS 中创建一个 IAM 策略，该策略将允许访问查看或编辑/修改单个安全组。我已遵循 AWS 文档，但未能成功执行此策略。创建的策略如下：

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt123456789123",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeSecurityGroups",
                "ec2:*"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1:000000000000:security-group/sg-a123a1a1"
            ]
        }
    ]
}

是的，我确实意识到我有一个多余的操作，但我注意到您可以指定描述安全组，但没有修改选项；因此“*”是我唯一的选择；值得庆幸的是，该资源应该允许我将此操作限制为单个安全组。

Answer 1

部分可能，请参阅https://serverfault.com/questions/575487/use-iam-to-allow-user-to-edit-aws-ec2-security-groups，实际上可以将编辑限制为仅一组，但我没有列出仅一组工作：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1413232782000",
            "Effect": "Allow",
            "Action": [               
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeInstanceStatus",
                "ec2:DescribeInstances",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeSecurityGroups"              
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "Stmt1413232782001",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",                
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1:<accountid>:security-group/sg-<id>"
            ]
        }
    ]
}

Answer 2

这是我设法拼凑起来的，效果很好！

创建以下策略并将其添加到用户组或创建一个：

更新 {BRACKETS} 中的项目

    {
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "ec2:RevokeSecurityGroupIngress",
            "ec2:AuthorizeSecurityGroupEgress",
            "ec2:AuthorizeSecurityGroupIngress",
            "ec2:RevokeSecurityGroupEgress",
            "ec2:DeleteSecurityGroup"
        ],
        "Resource": "arn:aws:{REGION}:{ACCOUNT_NUMBER}:security-group/{NSG-ID}",
        "Condition": {
            "ArnEquals": {
                "ec2:Vpc": "arn:aws:ec2:{REGION}:{ACCOUNT_NUMBER}:vpc/{VPC-ID}"
            }
        }
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeSecurityGroupReferences",
            "ec2:DescribeVpcs",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeStaleSecurityGroups"
        ],
        "Resource": "*"
    }
]

}

好吧，看起来代码格式化程序无法正常工作，但您可以在此处阅读参考资料：https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_ec2_securitygroups-vpc.html

谢谢！

Answer 3

您可以向安全组添加新规则，例如

aws ec2 authorize-security-group-ingress --group-name MySecurityGroup --protocol tcp --port 3389 --cidr 203.0.113.0/24

并且还要更改标签。