在 ec2 中强制标记答案

【问题标题】：Enforce tagging in ec2在 ec2 中强制标记
【发布时间】：2019-04-23 21:21:07
【问题描述】：

创建了一个 IAM 策略，该策略应将用户限制为现在允许在未满足标签值时创建 ec2 实例

{ “版本”：“2012-10-17”， “陈述”： [ { "Sid": "AllowToDescribeAll", “效果”：“允许”， “行动”： [ “ec2：描述*” ], “资源”：“” }, { "Sid": "AllowRunInstances", “效果”：“允许”， "动作": "ec2:RunInstances", “资源”：[ "arn:aws:ec2:::image/", "arn:aws:ec2:::snapshot/", "arn:aws:ec2:::subnet/", "arn:aws:ec2:::network-interface/", "arn:aws:ec2:::security-group/", “arn:aws:ec2:::key-pair/” ] }, { "Sid": "AllowRunInstancesWithRestrictions", “效果”：“允许”， “行动”： [ "ec2:CreateVolume", “ec2：运行实例” ], “资源”：[ "arn:aws:ec2:::volume/", “arn:aws:ec2:::instance/” ], “健康）状况”： { “字符串相等”：{ "aws:RequestTag/shutdown": "true", "aws:RequestTag/terminate": "真" }, "ForAllValues:StringEquals": { “aws：标签键”：[ “关闭”， “终止” ] } } }, { "Sid": "AllowCreateTagsOnlyLaunching", “效果”：“允许”， “行动”： [ “ec2：创建标签” ], “资源”：[ "arn:aws:ec2:::volume/", “arn:aws:ec2:::instance/*” ], “健康）状况”： { “字符串相等”：{ “ec2:CreateAction”：“运行实例” } } } ] }

【问题讨论】：

标签： amazon-ec2 tags

【解决方案1】：

请通过https://policysim.aws.amazon.com/home/index.jsp?# 与政策模拟器核实

通过以下政策，我可以确认它有效：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowToDescribeAll",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowRunInstances",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:*::image/*",
                "arn:aws:ec2:*::snapshot/*",
                "arn:aws:ec2:*:*:subnet/*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:key-pair/*"
            ]
        },
        {
            "Sid": "AllowRunInstancesWithRestrictions",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVolume",
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/terminate": "true",
                    "aws:RequestTag/shutdown": "true"
                },
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": [
                        "terminate",
                        "shutdown"
                    ]
                }
            }
        },
        {
            "Sid": "AllowCreateTagsOnlyLaunching",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:instance/*"
            ],
            "Condition": {
                "StringEquals": {
                    "ec2:CreateAction": "RunInstances"
                }
            }
        }
    ]
}

【讨论】：

【解决方案2】：

你可以使用这样的东西

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": [
                        "Application",
                        "Environment"
                    ]
                },
                "StringEqualsIfExists": {
                    "aws:RequestTag/Application": [
                        "app-01",
                        "app-02"
                    ],
                    "aws:RequestTag/Environment": [
                        "development",
                        "production"
                    ]
                }
            }
        }
    ]
}

【讨论】：