ec2:RunInstances 的最低 IAM 策略

我正在尝试缩小运行预定义机器映像的最小策略范围。该映像基于两个快照，我只想启动“m1.medium”实例类型。

在此基础上并在以下方面的帮助下这一页 http://docs.aws.amazon.com/AWSEC2/latest/APIReference/ec2-api-permissions.html and 本文 http://aws.typepad.com/aws/2013/11/amazon-ec2-resource-level-permissions-for-runinstances.html，我制定了以下政策：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1385026304010",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:InstanceType": "m1.medium"
                }
            },
            "Resource": [
                "arn:aws:ec2:us-east-1::instance/*",
                "arn:aws:ec2:us-east-1::image/ami-f1c3e498",
                "arn:aws:ec2:us-east-1::snapshot/snap-e2f51ffa",
                "arn:aws:ec2:us-east-1::snapshot/snap-18ca2000",
                "arn:aws:ec2:us-east-1::key-pair/shenton",
                "arn:aws:ec2:us-east-1::security-group/sg-6af56d02",
                "arn:aws:ec2:us-east-1::volume/*"
            ]
        }
    ]
}

该策略缩小了确切的映像、快照、安全组和密钥对的范围，同时保持特定实例和卷的开放。

我正在使用 CLI 工具，如下所述here http://docs.aws.amazon.com/cli/latest/reference/ec2/run-instances.html:

aws ec2 run-instances --dry-run \
    --image-id ami-f1c3e498 \
    --key-name shenton \
    --security-group-ids sg-6af56d02 \
    --instance-type m1.medium

The ~/.aws/config如下：

[default]
output = json
region = us-east-1
aws_access_key_id = ...
aws_secret_access_key = ...

该命令产生一个通用的结果You are not authorized to perform this operation消息和编码的授权失败消息表明我的语句都不匹配，因此它拒绝该操作。

更改为"Resource": "*"显然解决了这个问题，但我想获得更多关于为什么上述不起作用的理解。我完全意识到这涉及一定程度的猜测工作，所以我欢迎任何想法。

Amazon Web Services 的 Jeff Barr 联系了我，他热心地帮助我找出了问题所在。

首先，您需要使用以下语句解码授权失败消息：

$ aws sts decode-authorization-message --encoded-message 6gO3mM3p....IkgLj8ekf

确保 IAM 用户/角色具有以下权限sts:DecodeAuthorizationMessage action.

响应包含一个DecodedMessage包含另一个 JSON 编码主体的密钥：

{
    "allowed": false,
    "explicitDeny": false,
    "matchedStatements": {
        "items": []
    },
    "failures": {
        "items": []
    },
    "context": {
        "principal": {
            "id": "accesskey",
            "name": "testuser",
            "arn": "arn:aws:iam::account:user/testuser"
        },
        "action": "ec2:RunInstances",
        "resource": "arn:aws:ec2:us-east-1:account:instance/*",
        "conditions": { ... }
    }
}

Under context => resource它将显示它试图与策略匹配的资源；如您所见，它需要一个帐号。这arn 文档 http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html因此应解读为：

除非另有说明，否则需要区域和帐户。

添加帐号或*在受影响的 ARN 中修复了该问题：

"Resource": [
    "arn:aws:ec2:us-east-1:*:instance/*",
    "arn:aws:ec2:us-east-1:*:image/ami-f1c3e498",
    "arn:aws:ec2:us-east-1:*:snapshot/snap-e2f51ffa",
    "arn:aws:ec2:us-east-1:*:snapshot/snap-18ca2000",
    "arn:aws:ec2:us-east-1:*:key-pair/shenton",
    "arn:aws:ec2:us-east-1:*:security-group/sg-6af56d02",
    "arn:aws:ec2:us-east-1:*:volume/*"
]