Question

我在AWS中有一个多账户结构，其中有一个主账户和子账户。我正在遵循此guide，以便将标签从子实例传播到主帐户，一旦它们被激活，我就可以在主帐户（系统管理员）中管理这些实例。

到目前为止，所有这些工作都可以进行到主帐户中的lambda拥有所需的所有标签的程度。但是，无法在系统管理器中将标签添加到托管实例。不知道为什么在获得权限的情况下角色仍然无法访问标签...

这是我得到的错误：

[ERROR] 2019-03-29T09:14:02.419Z a00a68ba-9904-4199-bcae-cad75f6f5232 An error occurred (ValidationException) when calling the AddTagsToResource operation: Caller is an end user and not allowed to mutate system tags instanceId: mi-0d3bfce27d073c0f2

这是带有附加角色的lambda函数：

AWSTemplateFormatVersion: '2010-09-09'
Description: Management function that copies tags
Resources:
  rSSMTagManagerRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: Automation-SSMTagManagerRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "lambda.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/aws/"
      Policies:
        - PolicyName: "CopyInstanceTagsToSSMPolicy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                - ssm:AddTagsToResource
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
                - tag:*
                Resource: "*"

  fnSSMTagManager:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: Automation-SSM-Tag-Manager
      Handler: index.lambda_handler
      Role: !GetAtt [rSSMTagManagerRole, Arn]
      Description: >
        Copies tags from the list of instances in the event
        context to the specified managed instances.
      Code:
        ZipFile: |+

          import boto3
          import json
          import logging

          #setup simple logging for INFO
          logger = logging.getLogger()
          logger.setLevel( logging.WARN )

          client = boto3.client( 'ssm' )

          def lambda_handler( event, context ):
              """Copies tags from the list of instances in the event
              context to the specified managed instances.
              """
              for instance in event[ "instances" ]:
                 addTags( instance[ "instanceId" ], instance[ "tags" ] )

          def addTags( resourceid, tags ):
              logger.info( "Configuring " + resourceid + " with " + str(tags) )
              try:
                  response = client.add_tags_to_resource(
                      ResourceType='ManagedInstance',
                      ResourceId=resourceid,
                      Tags=tags
                  )
                  logger.info( response )
                  return response
              except Exception as e:
                  errorMessage = str(e) + "instanceId: " + resourceid
                  logger.error( errorMessage )
                  return errorMessage

      Runtime: python3.6
      Timeout: '90'

Answer 1

使用相同的指南。面临完全相同的错误。原来，代理商帐户中的实例包含太多（超过10个）标签，这导致标签管理器出现此错误。修改了标签收集器lambda函数，以仅传播特定标签，而不传播所有标签。那清除了错误。

Lambda没有权限向系统管理器中的托管实例添加标签

1 个答案: