适用于角色的AWS S3 IAM策略，用于根据实例标签或实例ID限制几个实例连接到S3存储桶 [英] AWS S3 IAM policy for role for restricting few instances to connect to S3 bucket based in instance tag or instance id

问题描述

我已经将一个AWS S3与所有实例相关联，以获取对所有S3存储桶的读取特权.现在，我需要向角色授予写权限(放置对象)的策略，以便其中一些实例可以对S3中的某些文件夹具有写权限.有什么方法可以通过实例标签(对我来说更好的选择)或实例ID来实现.

I have a AWS S3 already associated with all the instances for read privileges to all S3 buckets. Now I need to add a policy to the roles for write privileges(Put object) so that a few of these instances can have write permissions to certain folders in the S3. Is there any way to achieve it through instance tag(better option for me) or instance id.

我尝试添加IAM策略，但是在设置条件时，我的实例未获得所需的特权.

I tried adding an IAM policy but when I set the condition, my instances are not getting the required privileges.

我使用的IAM策略是:

The IAM policy I used is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1456567757624",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::testbucket/testfolder1/*",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:ec2:eu-west-1:<accountno>:instance/<instanceid1>"
        }
      }
    },
    {
      "Sid": "Stmt1456567757625",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::testbucket/testfolder2/*",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:ec2:eu-west-1:<accountno>:instance/<instanceid2>"
        }
      }
    }
  ]
}

推荐答案

根据使用aws:userid代替使用aws:SourceArn！

请求可用于的信息策略变量文档的表格显示了aws:userid的各种值，包括:

The Request Information That You Can Use for Policy Variables documentation has a table showing various values of aws:userid including:

对于分配给Amazon EC2实例的角色，该角色设置为role-id:ec2-instance-id

因此，您可以使用用于启动Amazon EC2实例以允许访问的角色的角色ID 或实例ID .

Therefore, you could use the Role ID of the role that is used to launch the Amazon EC2 instance to permit access OR the Instance ID.

例如，这是基于角色ID :

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SID123",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:userid": [
                        "AROAIIPEUJOUGITIU5BB6*"
                    ]
                }
            }
        }
    ]
}

当然，如果要基于角色ID分配权限，则可以轻松地在角色本身内授予权限.

Of course, if you are going to assign permission based on a Role ID, then you can just as easily grant permissions within the Role itself.

这是基于实例ID :

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SID123",
            "Effect": "Allow",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:userid": [
                        "*:i-03c9a5f3fae4b630a"
                    ]
                }
            }
        }
    ]
}

实例ID将随实例一起保留，但是如果启动了一个新实例，即使来自同一Amazon Machine Image(AMI)，也会分配一个新实例.

The Instance ID will remain with the instance, but a new one will be assigned if a new instance is launched, even from the same Amazon Machine Image (AMI).

这篇关于适用于角色的AWS S3 IAM策略，用于根据实例标签或实例ID限制几个实例连接到S3存储桶的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！