允许用户在有限制的情况下启动 EC2 的 IAM 策略

Question

我正在制定一项 IAM 策略，该策略允许 IAM 用户仅在区域 "us-east-1" 中启动实例 "ami-0885b1f6bd170450c"，且 EBS 量不超过 20gb。在查看政策后，我不确定自己犯了什么错误，仅显示 RunInstances。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "TheseActionsDontSupportResourceLevelPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "TheseActionsSupportResourceLevelPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "ec2:StopInstances",
                "ec2:StartInstances"
            ],
            "Resource": "arn:aws:ec2:us-east-1::image/ami-0885b1f6bd170450c",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "ec2:InstanceType": "t2.micro"
                },
                "StringEquals": {
                    "ec2:Region": "us-east-1"
                }
            }
        },
        {
            "Sid": "EC2CreateVolume",
            "Effect": "Allow",
            "Action": "ec2:CreateVolume",
            "Resource": "*",
            "Condition": {
                "NumericLessThanEquals": {
                    "ec2:VolumeSize": "20"
                }
            }
        }
    ]
}

这是我在启动时收到的解密错误消息

{
  "allowed": false,
  "explicitDeny": false,
  "matchedStatements": {
    "items": []
  },
  "failures": {
    "items": []
  },
  "context": {
    "principal": {
      "id": "AIDAYGEGJ25OKBMOEFSLA",
      "name": "some-user",
      "arn": "arn:aws:iam::562922379100:user/some-user"
    },
    "action": "ec2:RunInstances",
    "resource": "arn:aws:ec2:us-east-1:562922379100:instance/*",
    "conditions": {
      "items": [
        {
          "key": "ec2:MetadataHttpPutResponseHopLimit",
          "values": {
            "items": [
              {
                "value": "1"
              }
            ]
          }
        },
        {
          "key": "ec2:InstanceMarketType",
          "values": {
            "items": [
              {
                "value": "on-demand"
              }
            ]
          }
        },
        {
          "key": "aws:Resource",
          "values": {
            "items": [
              {
                "value": "instance/*"
              }
            ]
          }
        },
        {
          "key": "aws:Account",
          "values": {
            "items": [
              {
                "value": "562922379100"
              }
            ]
          }
        },
        {
          "key": "ec2:AvailabilityZone",
          "values": {
            "items": [
              {
                "value": "us-east-1e"
              }
            ]
          }
        },
        {
          "key": "ec2:ebsOptimized",
          "values": {
            "items": [
              {
                "value": "false"
              }
            ]
          }
        },
        {
          "key": "ec2:IsLaunchTemplateResource",
          "values": {
            "items": [
              {
                "value": "false"
              }
            ]
          }
        },
        {
          "key": "ec2:InstanceType",
          "values": {
            "items": [
              {
                "value": "t2.micro"
              }
            ]
          }
        },
        {
          "key": "ec2:RootDeviceType",
          "values": {
            "items": [
              {
                "value": "ebs"
              }
            ]
          }
        },
        {
          "key": "aws:Region",
          "values": {
            "items": [
              {
                "value": "us-east-1"
              }
            ]
          }
        },
        {
          "key": "ec2:MetadataHttpEndpoint",
          "values": {
            "items": [
              {
                "value": "enabled"
              }
            ]
          }
        },
        {
          "key": "aws:Service",
          "values": {
            "items": [
              {
                "value": "ec2"
              }
            ]
          }
        },
        {
          "key": "ec2:InstanceID",
          "values": {
            "items": [
              {
                "value": "*"
              }
            ]
          }
        },
        {
          "key": "ec2:MetadataHttpTokens",
          "values": {
            "items": [
              {
                "value": "optional"
              }
            ]
          }
        },
        {
          "key": "aws:Type",
          "values": {
            "items": [
              {
                "value": "instance"
              }
            ]
          }
        },
        {
          "key": "ec2:Tenancy",
          "values": {
            "items": [
              {
                "value": "default"
              }
            ]
          }
        },
        {
          "key": "ec2:Region",
          "values": {
            "items": [
              {
                "value": "us-east-1"
              }
            ]
          }
        },
        {
          "key": "aws:ARN",
          "values": {
            "items": [
              {
                "value": "arn:aws:ec2:us-east-1:562922379100:instance/*"
              }
            ]
          }
        }
      ]
    }
  }
}

Answer 1

ec2:TerminateInstances、ec2:StopInstances & ec2:StartInstances 对实例 (arn:aws:ec2:us-east-1::instance/*) 而非映像/AMI (arn:aws:ec2:us-east-1::image/ami-0885b1f6bd170450c) 进行操作。

我还认为，由于缺少一些必需的资源，因此仅使用此策略启动实例会遇到问题。

这是 restricting launching ec2 instance by AMI and TAG 的 AWS 示例，您可能可以适应。