如何创建实例类型为t2.micro的ec2 cloudformation策略 [英] how to create a policy of ec2 cloudformation with instancetype t2.micro
问题描述
我正在尝试创建一个策略,使某些用户可以在特定区域中使用amid:ami-0fc61db8544a617ed特定实例和instancetype:t2.micro放置实例,并使用8gb这样的特定存储空间我有这个模板
I am trying to create a policy where some user can lauch instance with amid:ami-0fc61db8544a617ed specific and instancetype:t2.micro in a specific region with specific storage like 8gb I have this template
AWSTemplateFormatVersion: 2010-09-09
Description: ---
Policita para usuarios test
Parameters:
GroupTest1Parameter:
Type: String
Default: GroupTest1
Description: Este es el valor de entrada GroupTest1Parameter
Resources:
PolictyTest1:
Type: AWS::IAM::Policy
Properties:
PolicyName: PolictyTest1
Groups:
- Fn::ImportValue: !Sub "${GroupTest1Parameter}-VPCID"
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'ec2:RunInstances'
- 'cloudformation:Describe*'
- 'cloudformation:List*'
- 'cloudformation:Get*'
Resource: 'arn:aws:ec2:*:*:instance/*'
# Condition:
# StringEquals:
# ec2:ImageType: ami-0fc61db8544a617ed
Outputs:
PolictyTest1:
Description: politica que deniega
Value: !Ref PolictyTest1
Export:
Name: !Sub "${AWS::StackName}-VPCID"
但是它不起作用.该模板可以很好地创建模板,但是当我尝试使用与此策略相关的用户测试来测试策略时,他不能对ec2实例进行处理我在读 https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonec2.html#amazonec2-actions-as-permissions
But it does not work. The template creates fine, but when I am trying to test te policy by using a user test related to this policy, he can not lauch instances of ec2 I am reading https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonec2.html#amazonec2-actions-as-permissions
推荐答案
要测试您的方案,我执行了以下操作:
To test your scenario, I did the following:
- 创建了一个IAM用户
- 将此串联策略分配给用户:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:*:ACCOUNT:network-interface/*",
"arn:aws:ec2:*:ACCOUNT:volume/*",
"arn:aws:ec2:*:ACCOUNT:key-pair/*",
"arn:aws:ec2:*:ACCOUNT:security-group/*",
"arn:aws:ec2:*:ACCOUNT:subnet/*",
"arn:aws:ec2:*::image/ami-*"
]
},
{
"Effect": "Allow",
"Action": "ec2:RunInstances",
"Resource": [
"arn:aws:ec2:*:ACCOUNT:instance/*"
],
"Condition": {
"StringEquals": {
"ec2:InstanceType": "t2.micro"
}
}
}
]
}
(其中将 ACCOUNT
设置为我的AWS账户ID.)
(Where ACCOUNT
was set to my AWS Account ID.)
然后,我能够使用以下命令成功启动 t2.micro
实例:
I was then able to successfully launch a t2.micro
instance using:
aws ec2 run-instances --image-id ami-xxx --security-group-id sg-xxx --instance-type t2.micro
我尝试将其更改为 t2.nano
,并收到了 UnauthorizedOperation
错误.
I tried changing it to t2.nano
and received a UnauthorizedOperation
error.
请注意,上面的 run-instances
命令非常少.它故意没有尝试指定诸如以下内容:
Please note that the above run-instances
command was quite minimal. It intentionally did not attempt to specify things like:
- IAM角色
- 标签
- 密钥对
这些项目需要向用户授予其他权限.因此,在测试策略时,请使用最少的一组要求(与上述类似)来测试策略.
These items require granting of additional permissions to the user. Therefore, when testing your policy, use a minimal set of requirements (similar to the above) to test the policy.
这篇关于如何创建实例类型为t2.micro的ec2 cloudformation策略的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!