亚马逊EC2基于标签的启动权限 [英] Amazon EC2 Tag Based Launch Permission

问题描述

我按照这个链接文档

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#ex5

我想提供一种指定标签的用户特定的图像启动权限，部门=开发。

I want to provide a user specific Image Launch permission which specified tag, "department=dev".

{
   "Version": "2012-10-17",
   "Statement": [{
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [ 
         "arn:aws:ec2:region::image/ami-*"
      ],
      "Condition": {
         "StringEquals": {
            "ec2:ResourceTag/department": "dev"
         }
      }
   },
   {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [ 
          "arn:aws:ec2:region:account:instance/*",
          "arn:aws:ec2:region:account:volume/*",
          "arn:aws:ec2:region:account:key-pair/project_keypair",
          "arn:aws:ec2:region:account:security-group/sg-1a2b3c4d"
         ]
      }
   ]
}

我还添加了一个分开的描述警察，因为我使用的接口没有CLI。

I also added a separated Describe police because i am using interface not cli .

但是，当我启动情况下其显示初始化失败而停止。我去code中的错误信息，并提供给我

But when i launch instances its show initialization failed and stop . I decode the error message and it provide me

{
    "DecodedMessage": "{\"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{\"items\":[]},\"failures\":{\"it
ems\":[]},\"context\":{\"principal\":{\"id\":\"AIDAJXOEQNA64A677DGQO\",\"name\":\"DevOps1\",\"arn\":\"arn:aws:iam::95524
6940111:user/DevOps1\"},\"action\":\"ec2:RunInstances\",\"resource\":\"arn:aws:ec2:us-east-1:955246940111:network-interf
ace/*\",\"conditions\":{\"items\":[{\"key\":\"ec2:Subnet\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-1:955
246940111:subnet/subnet-9d25b5b6\"}]}},{\"key\":\"ec2:Region\",\"values\":{\"items\":[{\"value\":\"us-east-1\"}]}},{\"ke
y\":\"ec2:AvailabilityZone\",\"values\":{\"items\":[{\"value\":\"us-east-1c\"}]}},{\"key\":\"ec2:Vpc\",\"values\":{\"ite
ms\":[{\"value\":\"arn:aws:ec2:us-east-1:955246940111:vpc/vpc-ebeed48e\"}]}}]}}}"

请帮忙

推荐答案

尝试添加

ARN：AWS：EC2：美国东部-1：955246940111：网络接口/ *

"arn:aws:ec2:us-east-1:955246940111:network-interface/*"

在策略中的资源列表。

这就是去codeD AUTH消息报告缺少/错误的。

That's what the decoded auth message is reporting as missing/wrong.

另外，还要确保你与你的政策的实际值替换区域和帐户的任何实例，假设你还没有。

Also make sure you replace any instances of region and account with the actual values in your policy, assuming you haven't already.

这篇关于亚马逊EC2基于标签的启动权限的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！