AWS SSM IAM访问问题

Question

我的用户通过SSM连接到我的AWS EC2实例。这些实例没有公共IP，也没有跳转主机，因此无法直接连接。

每个EC2实例都有一个名称标记，我希望IAM策略受到标记名称的限制。由于多种原因，通过实例ID限制是不可行的。

NAME服务器上的ec2标记是client-name。这里，ec2 2的策略可以很好地使用来限制对实例的访问。我可以通过控制台看到这个。然而，SSM策略似乎不起作用，我已经做了100多个改变，试图使它工作。我一直看到下面的错误。会很感激你的帮助。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Name": "client-name"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ssm:*",
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ssm:*:*:document/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Name": "client-name"
                }
            }
        },
        {
            "Effect": "Deny",
            "Action": [
                "ec2:DeleteTags",
                "ec2:CreateTags"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ec2:DescribeInstances",
            "Resource": "*"
        }
    ]
}

名为testuser_delme2的用户使用以下命令进行连接，错误如下：

aws ssm start-session --target i-003000333337777c7 --document-name AWS-StartPortForwardingSession --parameters portNumber="3389",localPortNumber="3389"

错误：

An error occurred (AccessDeniedException) when calling the StartSession operation: User: arn:aws:iam::222666555000:user/testuser_delme2 is not authorized to perform: ssm:StartSession on resource: arn:aws:ssm:ap-southeast-1::document/AWS-StartPortForwardingSession because no identity-based policy allows the ssm:StartSession action

Answer 1

好吧，我找出了问题，然后把它发到这里，以防它对别人有帮助。由于一些奇怪的原因，ssm启动会话的工作方式与其他SSM命令不同。

这是正确的方法：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["ec2:*","ssm:StartSession"],
            "Resource": "*",
            "Condition": {"StringEquals": {"aws:ResourceTag/Name": "client-name"}}
        },
        {
            "Effect": "Deny",
            "Action": ["ec2:DeleteTags", "ec2:CreateTags"],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": ["ec2:DescribeInstances", "s3:ListAllMyBuckets", "kms:*"],
            "Resource": "*"
        },
        {
         "Effect": "Allow",
         "Action": "ssm:*",
         "Resource": "arn:aws:ssm:*:*:*"
        },
        {
         "Effect":"Allow",
         "Action":["ssm:SendCommand"],
         "Resource":["arn:aws:ec2:*:*:instance/*"],
         "Condition": {"StringEquals": {"aws:ResourceTag/Name": "client-name"}}
        }
    ]
}