使用有限的 IAM 角色用户创建 EB 环境答案

【问题标题】：Create EB env with limited IAM Role User使用有限的 IAM 角色用户创建 EB 环境
【发布时间】：2019-05-08 08:11:42
【问题描述】：

我正在尝试创建一个访问受限的 IAM 用户，该用户仅被允许管理特定 EB 应用程序下的环境。

意思是，在名为 X 的 EB 应用程序下，用户将能够创建/删除/修改任何存在的环境。

这失败了。 IAM 用户可以登录，创建环境，但在设置阶段我收到以下错误（图片来自环境仪表板日志） -

目前用户的 IAM 政策如下所示 -

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole",
                "iam:ListAttachedRolePolicies",
                "ec2:*",
                "cloudformation:*",
                "elasticbeanstalk:CheckDNSAvailability",
                "iam:ListRolePolicies",
                "autoscaling:*",
                "iam:GetRolePolicy",
                "elasticbeanstalk:ListPlatformVersions"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::elasticbeanstalk-*/*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObjectAcl",
                "s3:PutBucketPolicy",
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetBucketPolicy",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "arn:aws:s3:::elasticbeanstalk-[aws-area]-[root-user-id]",
                "arn:aws:s3:::elasticbeanstalk-[aws-area]-[root-user-id]/*"
            ]
        },
        {
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": "elasticbeanstalk:*",
            "Resource": [
                "arn:aws:elasticbeanstalk:*:*:configurationtemplate/[app-name]/*",
                "arn:aws:elasticbeanstalk:[aws-area]:[root-user-id]:environment/[app-name]/*",
                "arn:aws:elasticbeanstalk:[aws-area]:[root-user-id]:applicationversion/[app-name]/*",
                "arn:aws:elasticbeanstalk:[aws-area]:[root-user-id]:application/[app-name]",
                "arn:aws:elasticbeanstalk:*::solutionstack/*"
            ]
        }
    ]
}

有没有办法解决这个问题？如何关联个人资料？似乎缺少某些权限，AWS 无法附加实例配置文件或其他东西

【问题讨论】：

标签： amazon-web-services amazon-iam amazon-elb amazon-elastic-beanstalk

【解决方案1】：

这是我在无法使用发布的政策后提出的政策。我确信这可以进行更多调整以使其更精确等等。

以下特定政策将允许用户与单个 EB 应用程序进行交互。请注意，EB 需要完全访问某些 AWS 服务，例如 EC2、S3、Cloudformation 等。

正如亚马逊文档中所说 -

虽然您可以限制用户与 Elastic Beanstalk 交互的方式 API，目前还没有有效的方法来阻止用户有权创建必要的底层资源在 Amazon EC2 和其他服务中创建其他资源。

政策 -

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateEnvironment",
      "Effect": "Allow",
      "Action": "elasticbeanstalk:CreateEnvironment",
      "Resource": [
        "arn:aws:elasticbeanstalk:[zone]:[user-id]:environment/[eb-app-name]/*",
        "arn:aws:elasticbeanstalk:[zone]:[user-id]:application/[eb-app-name]/*"
      ]
    },
    {
      "Sid": "GlobalUnspecificResources",
      "Effect": "Allow",
      "Action": [
        "sns:*",
        "iam:List*",
        "s3:*",
        "cloudwatch:*",
        "ecs:*",
        "ec2:*",
        "cloudformation:*",
        "sqs:*",
        "autoscaling:*",
        "elasticloadbalancing:*",
        "elasticbeanstalk:DescribePlatformVersion",
        "elasticbeanstalk:DescribeConfigurationSettings",
        "elasticbeanstalk:CheckDNSAvailability",
        "elasticbeanstalk:ListAvailableSolutionStacks",
        "elasticbeanstalk:ListPlatformVersions",
        "elasticbeanstalk:DescribeConfigurationOptions",
      ],
      "Resource": "*"
    },
    {
        "Sid": "IAMActions",
        "Effect": "Allow",
        "Action": [
            "iam:CreateInstanceProfile",
            "iam:Get*",
            "iam:PassRole",
            "iam:CreateRole",
            "iam:AddRoleToInstanceProfile"
        ],
        "Resource": [
          "*"
        ]
      },
    {
      "Sid": "VisualEditor2",
      "Effect": "Allow",
      "Action": [
        "elasticbeanstalk:ComposeEnvironments",
        "elasticbeanstalk:AbortEnvironmentUpdate",
        "elasticbeanstalk:TerminateEnvironment",
        "elasticbeanstalk:DescribeEnvironmentManagedActionHistory",
        "elasticbeanstalk:ValidateConfigurationSettings",
        "elasticbeanstalk:DescribeEnvironmentResources",
        "elasticbeanstalk:RequestEnvironmentInfo",
        "elasticbeanstalk:RebuildEnvironment",
        "elasticbeanstalk:UpdateApplicationVersion",
        "elasticbeanstalk:DescribeEnvironments",
        "elasticbeanstalk:DescribeInstancesHealth",
        "elasticbeanstalk:DescribeApplicationVersions",
        "elasticbeanstalk:DescribeEnvironmentHealth",
        "elasticbeanstalk:DescribeApplications",
        "elasticbeanstalk:DeleteConfigurationTemplate",
        "elasticbeanstalk:RestartAppServer",
        "elasticbeanstalk:CreateConfigurationTemplate",
        "elasticbeanstalk:UpdateConfigurationTemplate",
        "elasticbeanstalk:UpdateApplication",
        "elasticbeanstalk:DescribeEnvironmentManagedActions",
        "elasticbeanstalk:DescribeConfigurationOptions",
        "elasticbeanstalk:ApplyEnvironmentManagedAction",
        "elasticbeanstalk:DescribeEvents",
        "elasticbeanstalk:CreateEnvironment",
        "elasticbeanstalk:DeleteEnvironmentConfiguration",
        "elasticbeanstalk:UpdateEnvironment",
        "elasticbeanstalk:RetrieveEnvironmentInfo"
      ],
      "Resource": [
        "arn:aws:elasticbeanstalk:[zone]:[user-id]:application/[eb-app-name]",
        "arn:aws:elasticbeanstalk:[zone]:[user-id]:application/[eb-app-name]/*",
        "arn:aws:elasticbeanstalk:*:*:environment/*/*",
        "arn:aws:elasticbeanstalk:*:*:applicationversion/*/*",
        "arn:aws:elasticbeanstalk:*:*:configurationtemplate/*/*"
      ]
    }
  ]
}

将 zone 替换为您使用的 zone，将 user id 替换为主帐户用户 id 等。

使用的资源：

【讨论】：