Ограничение типа экземпляра и области запроса в AWS

Question

У меня есть этот случай, когда я хочу ограничить создание экземпляров EC2 следующими условиями:

• Тип экземпляра: "*.nano", "*.small", "*.micro", "*.medium", "*.large"
• Регион при создании EC2: eu-central-1

Я создал следующие политики EC2:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateDhcpOptions",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:ModifyVolumeAttribute",
                "ec2:ReplaceRouteTableAssociation",
                "ec2:DeleteVpcEndpoints",
                "ec2:CreateKeyPair",
                "ec2:ResetInstanceAttribute",
                "ec2:AttachInternetGateway",
                "ec2:ReportInstanceStatus",
                "ec2:UpdateSecurityGroupRuleDescriptionsIngress",
                "ec2:DeleteRouteTable",
                "ec2:ModifySpotFleetRequest",
                "ec2:ModifySnapshotAttribute",
                "ec2:DeleteVpnGateway",
                "ec2:CreateNetworkInterfacePermission",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:CreateRoute",
                "ec2:CreateInternetGateway",
                "ec2:DeleteInternetGateway",
                "ec2:UnassignPrivateIpAddresses",
                "ec2:CreateReservedInstancesListing",
                "ec2:CancelExportTask",
                "ec2:BundleInstance",
                "ec2:ImportKeyPair",
                "ec2:ModifyNetworkInterfaceAttribute",
                "ec2:AssignPrivateIpAddresses",
                "ec2:DisassociateRouteTable",
                "ec2:CreateVolume",
                "ec2:ReplaceNetworkAclAssociation",
                "ec2:CreateVpcEndpointServiceConfiguration",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:CreateNetworkInterface",
                "ec2:CancelSpotInstanceRequests",
                "ec2:DetachVpnGateway",
                "ec2:CreateDefaultVpc",
                "ec2:DeleteDhcpOptions",
                "ec2:DeleteNatGateway",
                "ec2:CreateSubnet",
                "ec2:ModifyVpcEndpoint",
                "ec2:DeleteNetworkAclEntry",
                "ec2:CreateVpnConnection",
                "ec2:DeleteSpotDatafeedSubscription",
                "ec2:DisassociateAddress",
                "ec2:ModifyVpcEndpointServicePermissions",
                "ec2:ImportVolume",
                "ec2:MoveAddressToVpc",
                "ec2:CreateNatGateway",
                "ec2:ModifyFleet",
                "ec2:RunScheduledInstances",
                "ec2:ModifyIdentityIdFormat",
                "ec2:CreateVpc",
                "ec2:RequestSpotFleet",
                "ec2:ModifyImageAttribute",
                "ec2:ReleaseHosts",
                "ec2:ModifySubnetAttribute",
                "ec2:CreateDefaultSubnet",
                "ec2:CreateSpotDatafeedSubscription",
                "ec2:CreateSnapshot",
                "ec2:DeleteLaunchTemplateVersions",
                "ec2:DeleteNetworkAcl",
                "ec2:ModifyReservedInstances",
                "ec2:ReleaseAddress",
                "ec2:CreateInstanceExportTask",
                "ec2:DeleteLaunchTemplate",
                "ec2:AssociateDhcpOptions",
                "ec2:ModifyInstancePlacement",
                "ec2:AssignIpv6Addresses",
                "ec2:ImportInstance",
                "ec2:AttachVpnGateway",
                "ec2:AcceptVpcEndpointConnections",
                "ec2:ModifyFpgaImageAttribute",
                "ec2:ResetSnapshotAttribute",
                "ec2:CancelConversionTask",
                "ec2:ImportSnapshot",
                "ec2:CreateVpnConnectionRoute",
                "ec2:DisassociateSubnetCidrBlock",
                "ec2:DeleteVpcEndpointConnectionNotifications",
                "ec2:CreateLaunchTemplate",
                "ec2:RestoreAddressToClassic",
                "ec2:DeleteCustomerGateway",
                "ec2:EnableVgwRoutePropagation",
                "ec2:DisableVpcClassicLink",
                "ec2:DisableVpcClassicLinkDnsSupport",
                "ec2:AllocateHosts",
                "ec2:ModifyVpcTenancy",
                "ec2:CancelImportTask",
                "ec2:ModifyIdFormat",
                "ec2:ConfirmProductInstance",
                "ec2:DeleteFlowLogs",
                "ec2:CopySnapshot",
                "ec2:DeleteSubnet",
                "ec2:ModifyVpcEndpointServiceConfiguration",
                "ec2:UnmonitorInstances",
                "ec2:MonitorInstances",
                "ec2:DeleteVpcPeeringConnection",
                "ec2:AcceptVpcPeeringConnection",
                "ec2:CreateImage",
                "ec2:PurchaseHostReservation",
                "ec2:CopyImage",
                "ec2:DisableVgwRoutePropagation",
                "ec2:AssociateVpcCidrBlock",
                "ec2:ReplaceRoute",
                "ec2:RejectVpcPeeringConnection",
                "ec2:AssociateRouteTable",
                "ec2:DisassociateVpcCidrBlock",
                "ec2:DeleteVolume",
                "ec2:CreatePlacementGroup",
                "ec2:ReplaceNetworkAclEntry",
                "ec2:ModifyVpcPeeringConnectionOptions",
                "ec2:CreateVpnGateway",
                "ec2:UnassignIpv6Addresses",
                "ec2:ImportImage",
                "ec2:DeleteVpnConnection",
                "ec2:CreateVpcPeeringConnection",
                "ec2:RejectVpcEndpointConnections",
                "ec2:EnableVpcClassicLink",
                "ec2:PurchaseScheduledInstances",
                "ec2:ModifyVolume",
                "ec2:ResetImageAttribute",
                "ec2:UpdateSecurityGroupRuleDescriptionsEgress",
                "ec2:CreateVpcEndpointConnectionNotification",
                "ec2:ResetNetworkInterfaceAttribute",
                "ec2:RegisterImage",
                "ec2:CreateRouteTable",
                "ec2:DeleteNetworkInterface",
                "ec2:CreateFleet",
                "ec2:DetachInternetGateway",
                "ec2:CreateCustomerGateway",
                "ec2:ModifyHosts",
                "ec2:ModifyVpcEndpointConnectionNotification",
                "ec2:EnableVolumeIO",
                "ec2:CreateFlowLogs",
                "ec2:AssociateSubnetCidrBlock",
                "ec2:DeleteVpc",
                "ec2:CreateEgressOnlyInternetGateway",
                "ec2:AssociateAddress",
                "ec2:DeleteKeyPair",
                "ec2:CancelBundleTask",
                "ec2:DeregisterImage",
                "ec2:DeleteSnapshot",
                "ec2:PurchaseReservedInstancesOffering",
                "ec2:DeleteTags",
                "ec2:RequestSpotInstances",
                "ec2:CancelSpotFleetRequests",
                "ec2:DeleteFleets",
                "ec2:DeleteVpcEndpointServiceConfigurations",
                "ec2:DeleteFpgaImage",
                "ec2:DeleteNetworkInterfacePermission",
                "ec2:CreateSecurityGroup",
                "ec2:CreateNetworkAcl",
                "ec2:ModifyVpcAttribute",
                "ec2:ModifyInstanceAttribute",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:DeleteEgressOnlyInternetGateway",
                "ec2:DetachNetworkInterface",
                "ec2:DeletePlacementGroup",
                "ec2:DeleteRoute",
                "ec2:CopyFpgaImage",
                "ec2:AllocateAddress",
                "ec2:CreateLaunchTemplateVersion",
                "ec2:DeleteVpnConnectionRoute",
                "ec2:ModifyInstanceCreditSpecification",
                "ec2:CreateVpcEndpoint",
                "ec2:DeleteSecurityGroup",
                "ec2:CreateFpgaImage",
                "ec2:AcceptReservedInstancesExchangeQuote",
                "ec2:ModifyLaunchTemplate",
                "ec2:AttachNetworkInterface",
                "ec2:EnableVpcClassicLinkDnsSupport",
                "ec2:CancelReservedInstancesListing",
                "ec2:CreateNetworkAclEntry",
                "ec2:ResetFpgaImageAttribute"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aws:RequestedRegion": "eu-central-1"
                }
            }
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:DetachVolume",
                "ec2:AttachVolume",
                "ec2:RebootInstances",
                "ec2:AttachClassicLinkVpc",
                "ec2:TerminateInstances",
                "ec2:DetachClassicLinkVpc",
                "ec2:CreateTags",
                "ec2:RunInstances",
                "ec2:StopInstances",
                "ec2:ReplaceIamInstanceProfileAssociation",
                "ec2:StartInstances",
                "ec2:DisassociateIamInstanceProfile",
                "ec2:AssociateIamInstanceProfile"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aws:RequestedRegion": "eu-central-1",
                    "ec2:InstanceType": [
                        "*.nano",
                        "*.small",
                        "*.micro",
                        "*.medium",
                        "t2.large"
                    ]
                }
            }
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        }
    ]
}

Я получаю следующую ошибку всякий раз, когда создаю экземпляр любого типа, упомянутый ранее или любые другие типы:

Launch Failed
You are not authorized to perform this operation.
Creating security groups Successful (sg-0f49c6462ba8c1f3b)
Authorizing inbound rules Successful
Initiating launches  Failure

Answer 1

Единственными действиями, которые должны быть ограничены типом экземпляра, будут RunInstances (для запуска экземпляров) и ModifyInstanceAttribute (для изменения типа экземпляра).

Вы можете назначить все остальныеразрешения не ограничены типом экземпляра, но ограничены регионом.

С Amazon EC2: разрешает полный доступ к EC2 в определенном регионе, программно и в консоли - Управление идентификацией и доступом AWS :

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ec2:*",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ec2:Region": "<REGION>"
                }
            }
        }
    ]
}

Более простой способ управления доступом к регионам AWS с помощью политик IAM |Блог безопасности AWS также показывает другой способ:

    {
        "Effect": "Allow",
        "Action": [
            "ec2:*"
        ],
        "Resource": "*",
        "Condition": {"StringEquals": {"aws:RequestedRegion": "eu-central-1"}}

    },

Я не уверен, какой из них лучше использовать.

Затем, чтобы запретить пользователям запускать нежелательные типы экземпляров,добавьте политику Deny, которая переопределяет политику разрешения.

С Ограничение допустимого типа экземпляра AWS с помощью политики IAM (которая включает в себя символы подстановки для разрешенных типов экземпляров):

    {
        "Sid": "limitedSize",
        "Effect": "Deny",
        "Action": ["ec2:RunInstances", "ec2:ModifyInstanceAttribute"],
        "Resource": "arn:aws:ec2:*:*:instance/*",
        "Condition": {
            "ForAnyValue:StringNotLike": {
                "ec2:InstanceType": [
                    "*.nano",
                    "*.small",
                    "*.micro",
                    "*.medium"
                ]
            }
        }
    }

Или из Как ограничить по регионам и типам экземпляров в AWS с IAM -:: blyx.com:: Blog:: Toni de la Fuente (где указано, какие типы экземпляров не разрешено):

{
    "Sid": "OnlyAllowCertainInstanceTypesToBeCreated",
    "Effect": "Deny",
    "Action": [
        "ec2:RunInstances",
        "ec2:ModifyInstanceAttribute",
    ],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "ec2:InstanceType": [
                "m2.xlarge",
                "cg1.4xlarge",
                "c3.4xlarge"
            ]
        }
    }
}