AWS IAM EC2政策限于原始实例

Question

我正在为一个设置工作，在该设置中，由于不活动，我需要终止AWS实例（即，由于一段时间以来，Web服务器访问日志中没有什么新鲜事物）。这些实例正在测试实例，并由CI/CD软件自动创建。

我希望这些实例确定自己被遗弃并终止自己。我想为每一个都分配一个通用的IAM-lole，这只会允许实例终止本身而不是同伴实例。

到目前为止我去过这里：

• https://docs.aws.amazon.com/awsec2/latest/userguide/examplepolicies_ec2.html
• https://docs.aws.amazon.com/iam/latest/userguide/reference_policies_variables.html
• https://docs.aws.amazon.com/iam/latest/userguide/reference_policies_variables.html#policy-vars-wheretouse
• https://www.reddit.com/r/aws/comments/4gglxk/iam_policy_to_lower_ec2_instance_to_to_to_only_query/
• https://docs.aws.amazon.com/iam/latest/userguide/reference_policies_examples_iam_mfa-selfmanage.html

并确定策略中有2个变量：

ec2-instance-id
ec2:SourceInstanceARN

我提出了我的角色政策的变化，但它们都没有起作用：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:TerminateInstances",
            "Resource": "*",
            "Condition": {
                "ArnEquals": {
                    "ec2:SourceInstanceARN": "arn:aws:ec2:*:*:instance/${ec2-instance-id}"
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:TerminateInstances",
            "Resource": "arn:aws:ec2:*:*:instance/${ec2-instance-id}"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:TerminateInstances",
            "Resource": "${ec2:SourceInstanceARN}"
        }
    ]
}

实际上可以实现所需的行为，即仅允许实例对自己执行特定的操作（例如终止）？

更新：
我确实知道我可以使用标签，这就是我在做的事情，但这意味着所有标记的实例都可以终止他们的同龄人。这有点太松散了，我想真正将其限制为实例

aws iam：允许EC2实例停止
IAM策略允许EC2实例API访问仅修改自身

Answer 1

您与condition接近。诀窍是将实例ARN与ec2:sourceInstanceARN进行比较：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:DeleteTags",
                "ec2:DescribeTags",
                "ec2:CreateTags",
                "ec2:TerminateInstances",
                "ec2:StopInstances"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ARN": "${ec2:SourceInstanceARN}"
                }
            }
        }
    ]
}

显然出于测试目的，我允许我的实例标记并停止自己。

Answer 2

因为" aws：arn"条件不再起作用，我找到了以下启动的IAM角色的实例的工作方法：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Allow instance to modify itself",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteTags",
        "ec2:CreateTags"
        ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "aws:userid": "*:${ec2:InstanceID}"
        }
      }
    }
  ]
}