我无法对 ec2 实例执行标记。我错过了什么

Question

我试图强制用户在创建时标记 ec2 实例。我已经设置了一个测试帐户并附加了一个策略，该策略应该要求他们在创建一个 ec2 实例时标记一个 ec2 实例。 当我使用 cognito 窗口登录测试帐户并尝试创建 ec2 实例时，我不需要标记该实例。

我一直在努力通过堆栈溢出论坛和在线搜索。我遇到的答案都很有道理，但根本行不通。

以下 IAM 政策是我一直在使用的。我一直在修改和尝试无济于事。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*::image/*",
                "arn:aws:ec2:*:123456789:subnet/*",
                "arn:aws:ec2:*:123456789:network-interface/*",
                "arn:aws:ec2:*:123456789:security-group/*",
                "arn:aws:ec2:*:123456789:key-pair/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:123456789:volume/*",
                "arn:aws:ec2:*:123456789:instance/*"
            ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": [
                        "environment",
                        "webserver"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": "arn:aws:ec2:*:123456789:*/*",
            "Condition": {
                "StringEquals": {
                    "ec2:CreateAction": "RunInstances"
                }
            }
        }
    ]
}

我没有收到任何错误消息。使用测试用户帐户创建 ec2 实例时，我可以继续。

任何想法将不胜感激。

Answer 1

[更新]

我确认您的政策无效。 （所有命令都在eu-west-1 上运行）

$ aws ec2 run-instances --image-id ami-0bbc25e23a7640b9b --instance-type t3.micro

{
    "Groups": [],
    "Instances": [
        {
            "AmiLaunchIndex": 0,
            "ImageId": "ami-0bbc25e23a7640b9b",
            "InstanceId": "i-0f695dcb8044ef708",
...

我切换到从our blog 粘贴的此策略副本（我能看到的唯一区别是没有明确提及帐户 ID）

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowToDescribeAll",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowRunInstances",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:*::image/*",
                "arn:aws:ec2:*::snapshot/*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:key-pair/*"
            ]
        },
        {
            "Sid": "AllowRunInstancesWithRestrictions",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVolume",
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": [
                        "key1"
                    ]
                }
            }
        },
        {
            "Sid": "AllowCreateTagsOnlyLaunching",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:CreateAction": "RunInstances"
                }
            }
        }
    ]
}

然后我尝试启动一个没有标签的实例

$ aws --profile test ec2 run-instances --image-id ami-0bbc25e23a7640b9b --instance-type t3.micro 

或者只是标记实例，而不是卷

$ aws --profile test ec2 run-instances --image-id ami-0bbc25e23a7640b9b --instance-type t3.micro --tag-specifications 'ResourceType=instance,Tags=[{Key=key1,Value=production}]'

两个调用都失败了。

An error occurred (UnauthorizedOperation) when calling the RunInstances operation: You are not authorized to perform this operation. 

然后我尝试了两个标签（任何值）

$ aws --profile test ec2 run-instances --image-id ami-0bbc25e23a7640b9b --instance-type t3.micro --tag-specifications 'ResourceType=instance,Tags=[{Key=key1,Value=value1}]' 'ResourceType=volume,Tags=[{Key=key1,Value=value1}]'

它成功了！

{
    "Groups": [],
    "Instances": [
        {
            "AmiLaunchIndex": 0,
            "ImageId": "ami-0bbc25e23a7640b9b",
            "InstanceId": "i-04aa7bd64b5f2ed22",
...