Question

我无法弄清楚如何让我公司的其他人使用AWS Elastic Beanstalk部署到（测试）服务器。

此页面仅建议对ELB的全局权限控制：http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.managed-policies.html

Answer 1

Rhys Godfrey博客文章标题为Using IAM to secure Elastic Beanstalk Applications on AWS，有一些很好的指导。

我们有一个Elastic Beanstalk应用程序和一组用户。这个用户组应该能够仅监视和部署弹性beanstalk环境，以及重启或终止应用实例。他们不应该改变应用程序或环境配置，或删除环境。用户不应该影响其他应用程序或AWS 服务，但他们可以看到其他领域的细节。我们假设用户将使用AWS控制台。

我已在此处转发IAM政策以供参考。

他的方法很好看，它通过引用实例EG Environment=testing上的EC2标记来考虑应用程序环境，这在您的用例中是必需的。

{  
   "Version":"2012-10-17",
   "Statement":[  
      {  
         "Sid":"ElasticBeanstalkEnvironmentPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:DescribeEnvironmentResources",
            "elasticbeanstalk:DescribeEnvironments",
            "elasticbeanstalk:DescribeEvents",
            "elasticbeanstalk:RestartAppServer",
            "elasticbeanstalk:RetrieveEnvironmentInfo",
            "elasticbeanstalk:SwapEnvironmentCNAMEs",
            "elasticbeanstalk:UpdateEnvironment",
            "elasticbeanstalk:RequestEnvironmentInfo"
         ],
         "Resource":[  
            "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:environment/ApplicationName/*"
         ]
      },
      {  
         "Sid":"ElasticBeanstalkGlobalPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:DescribeConfigurationOptions",
            "elasticbeanstalk:DescribeConfigurationSettings",
            "elasticbeanstalk:ListAvailableSolutionStacks",
            "elasticbeanstalk:ValidateConfigurationSettings",
            "elasticbeanstalk:CheckDNSAvailability",
            "elasticbeanstalk:CreateStorageLocation"
         ],
         "Resource":[  
            "*"
         ]
      },
      {  
         "Sid":"ElasticBeanstalkApplicationVersionPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:CreateApplicationVersion",
            "elasticbeanstalk:DescribeApplicationVersions",
            "elasticbeanstalk:UpdateApplicationVersion"
         ],
         "Resource":[  
            "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:applicationversion/ApplicationName/*"
         ]
      },
      {  
         "Sid":"ElasticBeanstalkApplicationPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:DescribeApplications",
            "elasticbeanstalk:UpdateApplication"
         ],
         "Resource":[  
            "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:application/ApplicationName"
         ]
      },
      {  
         "Sid":"Autoscaling",
         "Effect":"Allow",
         "Action":[  
            "autoscaling:SuspendProcesses",
            "autoscaling:Describe*",
            "autoscaling:ResumeProcesses"
         ],
         "Resource":"*"
      },
      {  
         "Sid":"Cloudwatch",
         "Effect":"Allow",
         "Action":[  
            "cloudwatch:Describe*",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:ListMetrics"
         ],
         "Resource":"*"
      },
      {  
         "Sid":"Cloudformation",
         "Effect":"Allow",
         "Action":[  
            "cloudformation:GetTemplate",
            "cloudformation:Describe*"
         ],
         "Resource":"*"
      },
      {  
         "Sid":"IAM",
         "Effect":"Allow",
         "Action":[  
            "iam:ListServerCertificates",
            "iam:ListInstanceProfiles"
         ],
         "Resource":"*"
      },
      {  
         "Sid":"S3ElasticBeanstalkBucket",
         "Action":[  
            "s3:AbortMultipartUpload",
            "s3:GetBucketAcl",
            "s3:GetBucketCORS",
            "s3:GetBucketLocation",
            "s3:GetBucketLogging",
            "s3:GetBucketNotification",
            "s3:GetBucketPolicy",
            "s3:GetBucketRequestPayment",
            "s3:GetBucketTagging",
            "s3:GetBucketVersioning",
            "s3:GetBucketWebsite",
            "s3:GetLifecycleConfiguration",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:GetObjectTorrent",
            "s3:GetObjectVersion",
            "s3:GetObjectVersionAcl",
            "s3:GetObjectVersionTorrent",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:ListBucket",
            "s3:GetObject",
            "s3:DeleteObject"
         ],
         "Effect":"Allow",
         "Resource":[  
            "arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx",
            "arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx/*"
         ]
      },
      {  
         "Sid":"S3Global",
         "Effect":"Allow",
         "Action":"s3:ListAllMyBuckets",
         "Resource":"arn:aws:s3:::*"
      },
      {  
         "Sid":"S3ElasticBeanstalkShared",
         "Effect":"Allow",
         "Action":"s3:*",
         "Resource":[  
            "arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1",
            "arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1/*"
         ]
      },
      {  
         "Sid":"EC2Global",
         "Effect":"Allow",
         "Action":[  
            "ec2:Describe*"
         ],
         "Resource":[  
            "*"
         ]
      }
   ]
}

第二个IAM策略处理给定环境的EC2实例：

{  
   "Version":"2012-10-17",
   "Statement":[  
      {  
         "Sid":"EC2EnvironmentInstances",
         "Effect":"Allow",
         "Action":[  
            "ec2:MonitorInstances",
            "ec2:UnmonitorInstances",
            "ec2:RebootInstances",
            "ec2:StopInstances"
         ],
         "Resource":[  
            "arn:aws:ec2:eu-west-1:123xxxxxxxxx:instance/*"
         ],
         "Condition":{  
            "StringEquals":{  
               "ec2:ResourceTag/elasticbeanstalk:environment-name":"EnvironmentName"
            }
         }
      }
   ]
}

Elastic Beanstalk：允许用户部署

1 个答案: