具有EC2实例的EBS卷的IAM策略

Question

我正在尝试创建IAM角色/策略，以使我的EC2实例能够列出和连接EBS卷(通过调用awscli的脚本(。我希望此策略只允许列出/附加具有特定标记的EBS卷。

我注意到，当我在下面的策略中设置Resources: "*"而不设置Conditions时，脚本能够列出/附加卷。但是，一旦我介绍了下面的策略，AWS cli就会抛出以下错误：

./aws ec2 describe-volumes
An error occurred (UnauthorizedOperation) when calling the DescribeVolumes operation: You are not authorized to perform this operation.

以下是我迄今为止在地形中定义的IAM政策：

resource "aws_iam_role" "web_role" {
name = "web_role"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Effect": "Allow",
"Sid": ""
}
]
}
EOF
}

resource "aws_iam_instance_profile" "web_profile" {
name = "web_profile"
role = aws_iam_role.web_role.name
}

resource "aws_iam_role_policy" "web_disk_policy" {
name = "web_disk_policy"
role = aws_iam_role.web_role.id
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:DescribeVolumes"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/app": "web"
}
}
}
]
}
EOF
}

我的EC2实例是用以下内容创建的：

resource "aws_instance" "web_vm" {
...
iam_instance_profile   = aws_iam_instance_profile.web_profile.name
...
tags = {
app = "web"
}
}

创建磁盘时使用：

resource "aws_ebs_volume" "ebs-volume-1" {
availability_zone = "us-west-2a"
size              = 10
tags = {
app = "web"
}
}

Answer 1

DescribeVolumes不支持aws:ResourceTag/${TagKey}条件，也不支持任何其他条件。

Answer 2

大多数针对许多资源的描述/列表类型操作与条件逻辑不兼容。DescribeVolumes不适用于条件，因此将其拆分为不同的语句。

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/app": "web"
}
}
},
{
"Effect": "Allow",
"Action": "ec2:DescribeVolumes",
"Resource": "*"
}
]
}