AWS IAM - EC2 - 限制对特定子网的访问答案

【问题标题】：AWS IAM - EC2 - Restrict access to specific subnetAWS IAM - EC2 - 限制对特定子网的访问
【发布时间】：2020-01-26 03:12:53
【问题描述】：

我正在尝试创建一个策略来限制用户仅在某个子网中运行实例，但以下方法不起作用（匿名帐户 ID、子网 ID 和 SID）

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "SID",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeImages",
            "ec2:DescribeInstances",
            "ec2:DescribeTags",
            "ec2:StartInstances",
            "ec2:StopInstances"
        ],
        "Resource": [
            "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER:subnet/subnet-id",
            "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::network-interface/*",
            "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::instance/*",
            "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::volume/*",
            "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::image/ami-*",
            "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::key-pair/*",
            "arn:aws:ec2:eu-west-1:ACCOUNT NUMBER::security-group/*"
        ]
    }
]

}

我也试过了，还是不行

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "SID",
        "Effect": "Allow",
        "Action": [
            "ec2:DescribeImages",
            "ec2:DescribeInstances",
            "ec2:DescribeTags",
            "ec2:StartInstances",
            "ec2:StopInstances"
        ],
        "Condition": {
            "StringEquals": {
                "ec2:subnet": "subnet-id"
            }
        },
        "Resource": [
            "*"
        ]
    }
]

}

不胜感激，谢谢！

【问题讨论】：

您是否尝试过在条件块中使用子网 arn 而不是子网 ID？

标签： amazon-web-services amazon-ec2 amazon-iam