Question

我正在尝试创建一个IAM角色/策略，以使我的EC2实例能够列出和附加EBS卷（通过调用aws cli的脚本）。我希望该政策仅允许列出/附加具有特定标签的EBS卷。

我注意到，当我在下面的策略中设置Resources: "*"而没有设置Conditions时，该脚本能够列出/附加卷。但是，一旦我介绍了下面的策略，AWS CLI就会引发以下错误：

./aws ec2 describe-volumes

An error occurred (UnauthorizedOperation) when calling the DescribeVolumes operation: You are not authorized to perform this operation.

这是我到目前为止在terraform中定义的IAM策略：

resource "aws_iam_role" "web_role" {
  name = "web_role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}


resource "aws_iam_instance_profile" "web_profile" {
  name = "web_profile"
  role = aws_iam_role.web_role.name
}


resource "aws_iam_role_policy" "web_disk_policy" {
  name = "web_disk_policy"
  role = aws_iam_role.web_role.id

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachVolume",
                "ec2:DetachVolume",
                "ec2:DescribeVolumes"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "StringEquals": {
                  "ec2:ResourceTag/app": "web"
                }
            }
        }
    ]
}
EOF
}

然后使用以下内容创建我的EC2实例：

resource "aws_instance" "web_vm" {
  ...

  iam_instance_profile   = aws_iam_instance_profile.web_profile.name
  ...

  tags = {
    app = "web"
  }
}

和使用以下命令创建的磁盘

resource "aws_ebs_volume" "ebs-volume-1" {
  availability_zone = "us-west-2a"
  size              = 10

  tags = {
    app = "web"
  }
}

Answer 1

针对许多资源的大多数描述/列表类型操作与条件逻辑不兼容。 DescribeVolumes不适用于条件，因此将其拆分为另一个语句。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:AttachVolume",
                "ec2:DetachVolume"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:volume/*"
            ],
            "Condition": {
                "StringEquals": {
                  "ec2:ResourceTag/app": "web"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeVolumes",
            "Resource": "*"
        }
    ]
}

Answer 2

DescribeVolumes does not support aws:ResourceTag/${TagKey}条件，也没有其他条件。

具有EC2实例的EBS卷的IAM策略

2 个答案: