亚马逊EC2基于标签的启动权限

Question

我遵循这个链接文档

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#ex5

我想提供一个特定于用户的Image Launch权限，该权限指定了标记"department=dev"。

{
   "Version": "2012-10-17",
   "Statement": [{
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [ 
         "arn:aws:ec2:region::image/ami-*"
      ],
      "Condition": {
         "StringEquals": {
            "ec2:ResourceTag/department": "dev"
         }
      }
   },
   {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [ 
          "arn:aws:ec2:region:account:instance/*",
          "arn:aws:ec2:region:account:volume/*",
          "arn:aws:ec2:region:account:key-pair/project_keypair",
          "arn:aws:ec2:region:account:security-group/sg-1a2b3c4d"
         ]
      }
   ]
}

我还添加了一个单独的描述警察，因为我使用的是接口而不是cli。

但当我启动实例时，它的show初始化失败并停止。我解码错误消息，它为我提供

{
    "DecodedMessage": "{"allowed":false,"explicitDeny":false,"matchedStatements":{"items":[]},"failures":{"it
ems":[]},"context":{"principal":{"id":"AIDAJXOEQNA64A677DGQO","name":"DevOps1","arn":"arn:aws:iam::95524
6940111:user/DevOps1"},"action":"ec2:RunInstances","resource":"arn:aws:ec2:us-east-1:955246940111:network-interf
ace/*","conditions":{"items":[{"key":"ec2:Subnet","values":{"items":[{"value":"arn:aws:ec2:us-east-1:955
246940111:subnet/subnet-9d25b5b6"}]}},{"key":"ec2:Region","values":{"items":[{"value":"us-east-1"}]}},{"ke
y":"ec2:AvailabilityZone","values":{"items":[{"value":"us-east-1c"}]}},{"key":"ec2:Vpc","values":{"ite
ms":[{"value":"arn:aws:ec2:us-east-1:955246940111:vpc/vpc-ebeed48e"}]}}]}}}"

请帮助

Answer 1

尝试添加

"arn:aws:ec2:us-east-1:952464940111:网络接口/*"

到策略中的资源列表。

这就是解码后的身份验证消息报告为丢失/错误的内容。

还要确保用策略中的实际值替换region和account的任何实例，假设您还没有。