Question

我有一个IAM政策，如下：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "TheseActionsDontSupportResourceLevelPermissions",
        "Effect": "Allow",
        "Action": ["ec2:Describe*"],
        "Resource": "*"
    },
    {
        "Sid": "TheseActionsSupportResourceLevelPermissions",
        "Effect": "Allow",
        "Action": [
            "ec2:RunInstances",
            "ec2:TerminateInstances",
            "ec2:StopInstances",
            "ec2:StartInstances"
        ],
        "Resource": "arn:aws:ec2:us-east-1:127890:instance/i-31f"
    }
]

}

但这项政策对我不起作用。请帮助

Answer 1

您首先需要描述您需要完成的内容，但对于初学者，您在第一个ec2:DescribeInstances声明中遗漏了Action：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TheseActionsDontSupportResourceLevelPermissions",
      "Effect": "Allow",
      "Action": "ec2:DescribeInstances",
      "Resource": "*"
    },
    {
      "Sid": "TheseActionsSupportResourceLevelPermissions",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances",
        "ec2:TerminateInstances",
        "ec2:StopInstances",
        "ec2:StartInstances"
      ],
      "Resource": "arn:aws:ec2:us-east-1:accountid:instance/id number"
    }
  ]
}

确保使用了正确的accountid和正确的实例ID。

IAM政策不起作用

1 个答案: