使用 aws cli 启动实例会出现未经授权的错误

Question

我正在尝试使用 aws cli 启动一个 ec2 实例，但我遇到了未经授权的错误。我可以毫无问题地运行启动、停止、终止命令，但 runInstance 失败。我已将所有必要的角色附加到 ec2 实例。

以下是附加角色的政策。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:TerminateInstances",
                "ec2:StartInstances",
                "ec2:CreateTags",
                "ec2:RunInstances",
                "ec2:StopInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "sts:DecodeAuthorizationMessage"
            ],
            "Resource": "*"
        }
    ]
}

下面是我启动 ec2 实例的 cli 命令

aws --region us-east-2 ec2 run-instances --image-id ami-02e680c45XXX351e \
--subnet-id subnet-2e0254 \
--security-group-ids sg-094a23e956177 \
--count 1 \
--instance-type t2.micro \
--key-name MyOhioKeyPair \
--query "Instances[0].InstanceId" \
--tag-specifications 'ResourceType=instance,Tags=[{Key='Application',Value="wu-digital-eai"}]'

运行此命令时，我收到一条编码错误消息。以下是解码后的消息。

{
    "DecodedMessage": "{
    \"allowed\":false,\"explicitDeny\":false,\"matchedStatements\":{
    \"items\":[]},\"failures\":{\"items\":[]},\"context\":{
    \"principal\":{\"id\":\"AROAIXRNU55ISQID4PHZA:i-027f9b5ea64f\",\"arn\":\"arn:aws:sts::56596531:assumed-role/LaunchInstanceTest/i-027f9b6aa64f\"},
    \"action\":\"ec2:RunInstances\",\"resource\":\"arn:aws:ec2:us-east-2:55532131:network-interface/*\",\"conditions\":{\"items\":[{
    \"key\":\"ec2:Vpc\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:565532131:vpc/vpc-dc6b4\"}]}},
    {\"key\":\"ec2:NetworkInterfaceID\",\"values\":{\"items\":[{\"value\":\"*\"}]}},
    {\"key\":\"aws:Resource\",\"values\":{\"items\":[{\"value\":\"network-interface/*\"}]}},
    {\"key\":\"aws:Account\",\"values\":{\"items\":[{\"value\":\"56532131\"}]}},
    {\"key\":\"ec2:AvailabilityZone\",\"values\":{\"items\":[{\"value\":\"us-east-2b\"}]}},
    {\"key\":\"ec2:IsLaunchTemplateResource\",\"values\":{\"items\":[{\"value\":\"false\"}]}},
    {\"key\":\"aws:Region\",\"values\":{\"items\":[{\"value\":\"us-east-2\"}]}},
    {\"key\":\"aws:Service\",\"values\":{\"items\":[{\"value\":\"ec2\"}]}},
    {\"key\":\"ec2:Subnet\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:56532131:subnet/subnet-2e54\"}]}},
    {\"key\":\"aws:Type\",\"values\":{\"items\":[{\"value\":\"network-interface\"}]}},
    {\"key\":\"ec2:Region\",\"values\":{\"items\":[{\"value\":\"us-east-2\"}]}},
    {\"key\":\"aws:ARN\",\"values\":{\"items\":[{\"value\":\"arn:aws:ec2:us-east-2:56532131:network-interface/*\"}]}}]}}}"
}

在阅读一些博客时，我发现上述错误中的这一行 \"action\":\"ec2:RunInstances\" 说明了确切的问题。但 ec2:RunInstances 策略已正确附加到角色。

谁能帮助我理解我在这里缺少什么？

Answer 1

事实证明，除了运行实例策略之外，我们还必须提供更多特权，例如 - 使用 EC2 密钥对、安全组、弹性块存储 (EBS) 卷和 Amazon 系统映像 (AMI) 访问启动.以下是为我解决问题的 json 策略。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:TerminateInstances",
                "ec2:StartInstances",
                "ec2:CreateTags",
                "ec2:StopInstances"
            ],
            "Resource": "arn:aws:ec2:*:*:instance/*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "sts:DecodeAuthorizationMessage"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ec2:*:*:key-pair/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:volume/*",
                "arn:aws:ec2:*:*:image/ami-*",
                "arn:aws:ec2:*:*:network-interface/*",
                "arn:aws:ec2:*:*:subnet/*"
            ]
        }
    ]
}

这里是来自 aws 的关于完全相同问题的精彩链接：Demystifying EC2 Resource-Level Permissions