IAM 策略通过 Image-Name 拒绝 AMI 图像答案

【问题标题】：IAM Policy Deny AMI Image via Image-NameIAM 策略通过 Image-Name 拒绝 AMI 图像
【发布时间】：2026-02-14 02:15:02
【问题描述】：

我可以通过 IAM 策略中的 arn-ami "arn:aws:ec2:*::image/ami-xxx" 轻松拒绝部署 AWS 映像，但我试图拒绝所有 RedHat 映像（市场 /社区 AMI）部署

这是否可以通过资源标签和 AMI 名称“RHEL-8.2.0_HVM-20200423-x86_64-0-Hourly2-GP2”实现

示例

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyAMIAccess",
            "Effect": "Deny",
            "Action": [
                "ec2:RunScheduledInstances",
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*::image/ami-0810abbfb78d37cdf",
                "arn:aws:ec2:*::image/ami-0e2cfc23d72b5cb98",
                "arn:aws:ec2:*::image/name/RHEL*",
                "arn:aws:ec2:*::image/RHEL*"
            ]
        }
    ]
}```

【问题讨论】：

标签： amazon-iam

【解决方案1】：

试试下面的“允许”资源“*”

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAMIAccess",
      "Effect": "Deny",
      "Action": [
        "ec2:RunScheduledInstances",
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*::image*"
      ],
      "Condition": {
        "StringNotLike": {
          "aws:RequestTag/Name": "RHEL"
        }
      }
    },
    {
      "Sid": "DenyAMIAccess",
      "Effect": "Deny",
      "Action": [
        "ec2:RunScheduledInstances",
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*::image*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/Name": "true"
        }
      }
    }
  ]
}

【讨论】：