Ao usar o AWS re:Post, você concorda com os AWS re:Post Termos de uso

How to I create an IAM policy that will allow the user to create AMI's of my instance?

0

I am creating a policy that I can attach to a user that will allow the user to create snapshots of the EC2 instance. However it won't work. In the simulator it always fails and says "denied implicitly denied". Here is the permissions I'm using:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:CreateImage",
            "Resource": [
                "arn:aws:ec2:*:--myaccountnumber--:instance/*",
                "arn:aws:ec2:*::snapshot/*",
                "arn:aws:ec2:*::image/*"
            ]
        }
    ]
}

I've just replaced my account number in the above. Why doesn't this allow me to create an AMI of my instance?

Thanks.

feita há 2 anos924 visualizações
1 Resposta
1

To allow a user to create an Amazon Machine Image (AMI) of an Amazon Elastic Compute Cloud (EC2) instance, you can create an IAM policy that includes the following permissions:

  • ec2:CreateImage: This permission allows the user to create an AMI from an EC2 instance.
  • ec2:DescribeInstances: This permission allows the user to retrieve information about the EC2 instances that they have permission to create AMIs for.
  • ec2:ModifySnapshotAttribute: This permission allows the user to modify the permissions of the snapshots that are used to create the AMI.
  • ec2:CreateTags: This permission allows the user to add tags to the AMI.

Here is an example policy that includes these permissions:


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateImage",
                "ec2:DescribeInstances",
                "ec2:ModifySnapshotAttribute",
                "ec2:CreateTags"
            ],
            "Resource": [
                "arn:aws:ec2:*:--myaccountnumber--:instance/*",
                "arn:aws:ec2:*::snapshot/*",
                "arn:aws:ec2:*::image/*"
            ]
        }
    ]
}

Note that the user will also need permission to create and delete snapshots of the EBS volumes attached to the EC2 instance. The user will also need permission to create and delete the AMI itself.

profile pictureAWS
respondido há 2 anos

Você não está conectado. Fazer login para postar uma resposta.

Uma boa resposta responde claramente à pergunta, dá feedback construtivo e incentiva o crescimento profissional de quem perguntou.

Diretrizes para responder a perguntas