AWS EC2: ec2的IAM策略:请求

Question

我需要创建策略，允许用户创建spot请求，但仅具有特定的子网和安全组。这是我所做的：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:RequestSpotInstances",
            "Resource": [
                "arn:aws:ec2:us-east-1:123456789012:image/ami-*",
                "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-af016c92",
                "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-12a34d3c",
                "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-f0e844cd",
                "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-026ae728",
                "arn:aws:ec2:us-east-1:123456789012:key-pair/*",
                "arn:aws:ec2:us-east-1:123456789012:security-group/sg-b5dd94cd",
                "arn:aws:ec2:us-east-1:123456789012:security-group/sg-3bda8c42"
            ]
        }
    ]
}

但是我的spot请求创建仍然失败：

botocore.exceptions.ClientError: An error occurred (UnauthorizedOperation) when calling the RequestSpotInstances operation: You are not authorized to perform this operation.

RequestSpotInstances操作的最小权限子集是多少？

有没有可能对此进行调试？

Answer 1

我知道这是一个老问题，但我刚刚在我的环境中遇到了同样的问题。我的解决方案是为"PassRole“添加一个IAM权限。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Stmt1479335761363",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:RequestSpotInstances",
        "ec2:RunInstances",
        "iam:PassRole"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }]

}

Answer 2

根据EC2文档(here)，ec2:RequestSpotInstances属于“不受支持的资源级权限”类别。不幸的是，您必须将资源标记设置为所有资源，如下所示：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:RequestSpotInstances",
            "Resource": [ "*" ]
        }
    ]
}

至于调试，不要忘记IAM策略模拟器，它可以从AWS Console => IAM =>用户页面访问。