我正在尝试使用aws cli启动ec2实例,但出现了未经授权的错误。我可以运行启动,停止,终止命令,没有问题,但runInstance失败。我已经将所有必要的角色附加到ec2实例上。
以下是附加角色的政策。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:CreateTags",
"ec2:RunInstances",
"ec2:StopInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"sts:DecodeAuthorizationMessage"
],
"Resource": "*"
}
]
}
下面是我的用于启动ec2实例的cli命令
aws --region us-east-2 ec2 run-instances --image-id ami-02e680c45XXX351e \
--subnet-id subnet-2e0254 \
--security-group-ids sg-094a23e956177 \
--count 1 \
--instance-type t2.micro \
--key-name MyOhioKeyPair \
--query "Instances[0].InstanceId" \
--tag-specifications 'ResourceType=instance,Tags=[{Key='Application',Value="wu-digital-eai"}]'
运行此命令时,我收到一条编码错误消息。下面是解码后的消息。
{
"DecodedMessage": "{
\"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{
\"items\":[]},\"failures\":{\"items\":[]},\"context\":{
\"principal\":{\"id\":\"AROAIXRNU55ISQID4PHZA:i-027f9b5ea64f\",\"arn\":\"arn:aws:sts::56596531:assumed-role/LaunchInstanceTest/i-027f9b6aa64f\"},
\"action\":\"ec2:RunInstances\",\"resource\":\"arn:aws:ec2:us-east-2:55532131:network-interface/*\",\"conditions\":{\"items\":[{
\"key\":\"ec2:Vpc\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:565532131:vpc/vpc-dc6b4\"}]}},
{\"key\":\"ec2:NetworkInterfaceID\",\"values\":{\"items\":[{\"value\":\"*\"}]}},
{\"key\":\"aws:Resource\",\"values\":{\"items\":[{\"value\":\"network-interface/*\"}]}},
{\"key\":\"aws:Account\",\"values\":{\"items\":[{\"value\":\"56532131\"}]}},
{\"key\":\"ec2:AvailabilityZone\",\"values\":{\"items\":[{\"value\":\"us-east-2b\"}]}},
{\"key\":\"ec2:IsLaunchTemplateResource\",\"values\":{\"items\":[{\"value\":\"false\"}]}},
{\"key\":\"aws:Region\",\"values\":{\"items\":[{\"value\":\"us-east-2\"}]}},
{\"key\":\"aws:Service\",\"values\":{\"items\":[{\"value\":\"ec2\"}]}},
{\"key\":\"ec2:Subnet\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:56532131:subnet/subnet-2e54\"}]}},
{\"key\":\"aws:Type\",\"values\":{\"items\":[{\"value\":\"network-interface\"}]}},
{\"key\":\"ec2:Region\",\"values\":{\"items\":[{\"value\":\"us-east-2\"}]}},
{\"key\":\"aws:ARN\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:56532131:network-interface/*\"}]}}]}}}"
}
在阅读一些博客时,我发现上述错误中的这一行 \“ action \”:\“ ec2:RunInstances \” 可以确切说明问题。但是ec2:RunInstances策略已正确附加到角色。
有人可以帮助我了解我在这里想念的是什么吗?
答案 0 :(得分:0)
结果证明,除了“运行实例”策略外,我们还必须赋予其他特权,例如-使用EC2密钥对,安全组,弹性块存储(EBS)卷和Amazon Machine Image(AMI)来访问启动权限。 。以下是为我解决了该问题的json政策。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:CreateTags",
"ec2:StopInstances"
],
"Resource": "arn:aws:ec2:*:*:instance/*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstances",
"sts:DecodeAuthorizationMessage"
],
"Resource": "*"
},
{
"Sid": "VisualEditor2",
"Effect": "Allow",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:key-pair/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:volume/*",
"arn:aws:ec2:*:*:image/ami-*",
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:subnet/*"
]
}
]
}
以下是来自aws的一个很好的链接:Demystifying EC2 Resource-Level Permissions