Question

我正在尝试使用aws cli启动ec2实例，但出现了未经授权的错误。我可以运行启动，停止，终止命令，没有问题，但runInstance失败。我已经将所有必要的角色附加到ec2实例上。

以下是附加角色的政策。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:TerminateInstances",
                "ec2:StartInstances",
                "ec2:CreateTags",
                "ec2:RunInstances",
                "ec2:StopInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "sts:DecodeAuthorizationMessage"
            ],
            "Resource": "*"
        }
    ]
}

下面是我的用于启动ec2实例的cli命令

aws --region us-east-2 ec2 run-instances --image-id ami-02e680c45XXX351e \
--subnet-id subnet-2e0254 \
--security-group-ids sg-094a23e956177 \
--count 1 \
--instance-type t2.micro \
--key-name MyOhioKeyPair \
--query "Instances[0].InstanceId" \
--tag-specifications 'ResourceType=instance,Tags=[{Key='Application',Value="wu-digital-eai"}]'

运行此命令时，我收到一条编码错误消息。下面是解码后的消息。

{
    "DecodedMessage": "{
    \"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{
    \"items\":[]},\"failures\":{\"items\":[]},\"context\":{
    \"principal\":{\"id\":\"AROAIXRNU55ISQID4PHZA:i-027f9b5ea64f\",\"arn\":\"arn:aws:sts::56596531:assumed-role/LaunchInstanceTest/i-027f9b6aa64f\"},
    \"action\":\"ec2:RunInstances\",\"resource\":\"arn:aws:ec2:us-east-2:55532131:network-interface/*\",\"conditions\":{\"items\":[{
    \"key\":\"ec2:Vpc\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:565532131:vpc/vpc-dc6b4\"}]}},
    {\"key\":\"ec2:NetworkInterfaceID\",\"values\":{\"items\":[{\"value\":\"*\"}]}},
    {\"key\":\"aws:Resource\",\"values\":{\"items\":[{\"value\":\"network-interface/*\"}]}},
    {\"key\":\"aws:Account\",\"values\":{\"items\":[{\"value\":\"56532131\"}]}},
    {\"key\":\"ec2:AvailabilityZone\",\"values\":{\"items\":[{\"value\":\"us-east-2b\"}]}},
    {\"key\":\"ec2:IsLaunchTemplateResource\",\"values\":{\"items\":[{\"value\":\"false\"}]}},
    {\"key\":\"aws:Region\",\"values\":{\"items\":[{\"value\":\"us-east-2\"}]}},
    {\"key\":\"aws:Service\",\"values\":{\"items\":[{\"value\":\"ec2\"}]}},
    {\"key\":\"ec2:Subnet\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:56532131:subnet/subnet-2e54\"}]}},
    {\"key\":\"aws:Type\",\"values\":{\"items\":[{\"value\":\"network-interface\"}]}},
    {\"key\":\"ec2:Region\",\"values\":{\"items\":[{\"value\":\"us-east-2\"}]}},
    {\"key\":\"aws:ARN\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:56532131:network-interface/*\"}]}}]}}}"
}

在阅读一些博客时，我发现上述错误中的这一行 \“ action \”：\“ ec2：RunInstances \” 可以确切说明问题。但是ec2：RunInstances策略已正确附加到角色。

有人可以帮助我了解我在这里想念的是什么吗？

Answer 1

结果证明，除了“运行实例”策略外，我们还必须赋予其他特权，例如-使用EC2密钥对，安全组，弹性块存储（EBS）卷和Amazon Machine Image（AMI）来访问启动权限。。以下是为我解决了该问题的json政策。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:TerminateInstances",
                "ec2:StartInstances",
                "ec2:CreateTags",
                "ec2:StopInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "sts:DecodeAuthorizationMessage"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:key-pair/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:image/ami-*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:subnet/*"
            ]
        }
    ]
}

以下是来自aws的一个很好的链接：Demystifying EC2 Resource-Level Permissions

使用aws cli启动实例会产生未经授权的错误

1 个答案: