创建自定义运行实例策略出错

Question

我是AWS的IAM新手。我已经创建了一个策略

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TheseActionsDontSupportResourceLevelPermissions",
      "Effect": "Allow",
      "Action": "ec2:DescribeImages",
      "Resource": "*"
    },
    {
      "Sid": "TheseActionsSupportResourceLevelPermissions",
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [
         "arn:aws:ec2:us-east-1:109027:instance/*",
         "arn:aws:ec2:us-east-1:10927:image/*",
         "arn:aws:ec2:us-east-1:109027:security-group/Test_hin",
         "arn:aws:ec2:us-east-1:109027:subnet/subnet-b",
         "arn:aws:ec2:us-east-1:109527:key-pair/*",
         "arn:aws:ec2:us-east-1:10903527:network-interface/vpc-e4",
         "arn:aws:ec2:us-east-1:107:volume/*"
       ]
     }
   ]
}

每当我尝试使用控制台启动一个实例时，它都会提示我没有被授权执行此操作的错误。

​

​

谢谢

Answer 1

尝试使用key pair和network interface资源(看起来您正在尝试启动到VPC)。另外，允许卷资源。

{
    "Version": "2012-10-17",
    "Statement": [
    {
       "Effect": "Allow",
       "Action": "ec2:RunInstances",
       "Resource": [
         "arn:aws:ec2:us-east-1:acct:instance/*",
         "arn:aws:ec2:us-east-1:acct:image/*",
         "arn:aws:ec2:us-east-1:acct:security-group/*",
         "arn:aws:ec2:us-east-1:acct:subnet/*",
         "arn:aws:ec2:us-east-1:acct:key-pair/*",
         "arn:aws:ec2:us-east-1:acct:network-interface/*",
         "arn:aws:ec2:us-east-1:acct:volume/*"
       ]
     }
   ]
}