Question

在AWS中，有没有办法强制IAM用户标记他/她即将启动的实例？价值是什么并不重要。我想确保它被正确标记，以便可以正确识别长时间运行的实例并通知所有者。目前标记是可选的。

我目前所做的是使用CloudTrail并使用其IAM用户识别实例。我不喜欢它，因为定期运行脚本是额外的工作，而CloudTrail只有7天的数据。如果AWS拥有所有者的实例属性，那就太好了。

在我们的案例中，使用密钥对来识别所有者并不是一个可行的解决方案。任何人以前都遇到过这个问题，你是如何解决它的？

Answer 1

一种方式：不要授予他们启动框的IAM权限。相反，有一个允许他们这样做的Web服务。（无论如何，生产应该是完全自动化的）。当他们使用您的服务时，您可以执行所需的所有规则。是的，这是相当多的工作，所以不是每个人都有。

目前标记是可选的。

比这更糟糕。标记需要第二次API调用，因此即使使用API，由于打嗝，事情也可以在没有标记的情况下启动。

Answer 2

我使用AWS Lambda解决了这个问题。当CloudTrail在S3中创建对象时，它会触发导致Lambda函数执行的事件。 Lambda函数然后解析S3对象并创建标记。滞后约2分钟，但解决方案完美无缺。

Answer 3

正如@helloV所提到的，这可以通过使用AWS CloudTrail日志（一旦正确启用）和AWS Lambda实现。我可以使用python Lambda函数中运行的以下代码来完成此任务：

using System.Linq;  

...

protected GameObject[] GetOverLap(GameType gameType){
    List<Component> collComponents = new List<Component>();
    List<GameObject> gameObjects = new List<GameObject>();

    if (gameType == GameType._3D)
        collComponents = Physics.OverlapSphere(transform.position, radius, layer).Cast<UnityEngine.Component>().ToList();
    else if (gameType == GameType._2D)
        collComponents = Physics2D.OverlapCircleAll(transform.position, radius, layer).Cast<UnityEngine.Component>().ToList();

    foreach (Component c in collComponents)
        gameObjects.Add (c.gameObject);
    return gameObjects.ToArray();
}

Answer 4

查看capitalone.io/cloud-custodian开源项目 - 它可以执行这样的政策

Answer 5

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GrantIAMPassRoleOnlyForEC2",
            "Action": [
                "iam:PassRole"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:iam::*:role/ec2tagrestricted",
                "arn:aws:iam::*:role/ec2tagrestricted"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "ec2.amazonaws.com"
                }
            }
        },
        {
            "Sid": "ReadOnlyEC2WithNonResource",
            "Action": [
                "ec2:Describe*",
                "iam:ListInstanceProfiles"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Sid": "ModifyingEC2WithNonResource",
            "Action": [
                "ec2:CreateKeyPair",
                "ec2:CreateSecurityGroup"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Sid": "RunInstancesWithTagRestrictions",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:us-east-1:*:instance/*",
                "arn:aws:ec2:us-east-1:*:volume/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/test": "${aws:userid}"
                }
            }
        },
        {
            "Sid": "RemainingRunInstancePermissionsNonResource",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:us-east-1::image/*",
                "arn:aws:ec2:us-east-1::snapshot/*",
                "arn:aws:ec2:us-east-1:*:network-interface/*",
                "arn:aws:ec2:us-east-1:*:key-pair/*",
                "arn:aws:ec2:us-east-1:*:security-group/*"
            ]
        },
        {
            "Sid": "EC2RunInstancesVpcSubnet",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": "arn:aws:ec2:us-east-1:*:subnet/*",
            "Condition": {
                "StringEquals": {
                    "ec2:Vpc": "arn:aws:ec2:us-east-1:*:vpc/vpc-8311b8f9"
                }
            }
        },
        {
            "Sid": "EC2VpcNonResourceSpecificActions",
            "Effect": "Allow",
            "Action": [
                "ec2:DeleteNetworkAcl",
                "ec2:DeleteNetworkAclEntry",
                "ec2:DeleteRoute",
                "ec2:DeleteRouteTable",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:DeleteSecurityGroup",
                "ec2:CreateNetworkInterfacePermission",
                "ec2:CreateRoute",
                "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
                "ec2:UpdateSecurityGroupRuleDescriptionsIngress"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:Vpc": "arn:aws:ec2:us-east-1:*:vpc/vpc-8311b8f9"
                }
            }
        },
        {
            "Sid": "AllowInstanceActionsTagBased",
            "Effect": "Allow",
            "Action": [
                "ec2:RebootInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances",
                "ec2:StartInstances",
                "ec2:AttachVolume",
                "ec2:DetachVolume",
                "ec2:AssociateIamInstanceProfile",
                "ec2:DisassociateIamInstanceProfile",
                "ec2:GetConsoleScreenshot",
                "ec2:ReplaceIamInstanceProfileAssociation"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1:347612567792:instance/*",
                "arn:aws:ec2:us-east-1:347612567792:volume/*"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/test": "${aws:userid}"
                }
            }
        },
        {
            "Sid": "AllowCreateTagsOnlyLaunching",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1:347612567792:instance/*",
                "arn:aws:ec2:us-east-1:347612567792:volume/*"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:CreateAction": "RunInstances"
                }
            }
        }
    ]
}

此策略限制用户仅在Tag键为test且值为变量$ {aws.userid}时才能启动ec2实例here 值得注意的事情

这不限制用户可以启动的ec2实例的数量
用户可以更改现有实例标签的标签并获得控制权

我们可以使用TagKeys https://docs.aws.amazon.com/IAM/latest/UserGuide/access_tags.html#access_tags_control-tag-keys来解决上述两种情况，但我没有这样做

Answer 6

将此策略附加到用户或组，以防止他们在没有标记的情况下启动实例：

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Deny",
        "Action": "ec2:RunInstances",
        "Resource": "*",
        "Condition": {
            "Null": {
                "aws:RequestTag/Owner": "true"
            }
        }
    }
}

当用户尝试启动一个实例时，他们会得到一个错误：

（如果有人知道如何显示更清晰的错误消息，请在评论中告诉我们。）

像这样解码错误：

aws sts decode-authorization-message \
  --encoded-message <encoded-message> \
  --query DecodedMessage --output text | jq '.'

部分（巨型）响应如下：

{
  "allowed": false,
  "explicitDeny": true,
  "matchedStatements": {
    "items": [
      {
        "statementId": "",
        "effect": "DENY",
        "principals": {
          "items": [
            {
              "value": "AIDATDOMLI3YFAYEBFGSO"
            }
          ]
        },
        "principalGroups": {
          "items": []
        },
        "actions": {
          "items": [
            {
              "value": "ec2:RunInstances"
            }
          ]
        },
        "resources": {
          "items": [
            {
              "value": "*"
            }
          ]
        },
        "conditions": {
          "items": [
            {
              "key": "aws:RequestTag/Owner",
              "values": {
                "items": [
                  {
                    "value": "true"
                  }
                ]
              }
            }
          ]
        }
      }
    ]
  }
}

显示启动失败，因为缺少 Owner 标签。

Answer 7

您是否在发布时使用/ require userdata脚本？我们使用该脚本过程在启动时正确标记每个实例。

我们将支持脚本刻录到userdata启动的AMI中，并解析参数的命令行。然后使用这些参数为新启动的实例创建标记。

对于手动启动，用户必须加载正确的用户数据脚本才能生效。但是，从自动启动脚本或自动缩放组中正确配置的启动配置，它可以很好地工作。

<script>
PowerShell -ExecutionPolicy Bypass -NoProfile -File c:\tools\server_userdata.ps1  -function Admin -environment production
</script>

使用此方法，使用该用户数据启动的实例将使用Function和Environment标记自动标记。

启动EC2实例时强制标记

7 个答案: