Need clarification for an IAM policy

0

Hi Can I get some clarification as what does this below policy imply?

{
    "Effect": "Allow",
    "Action": "ec2:RunInstances",
    "Resource": "*"
    "Condition": {
        "StringEquals": {
            "aws:ResourceTag/tkey": "tval"
        }
    }
}

Does the policy imply that all the mandatory resources in this document like subnet , security-group , vpc, instance, volume, images should have the resource tag? Also what about the optional resources? Should they have the ResourceTag? This is a follow up question from this question

Deep
已提問 3 個月前檢視次數 158 次
3 個答案
1

Yes, that means in order to perform the action ec2:RunInstances, you will need the required tag. Though, you will also need to grant the ability to create a tag, such as this:

{
    "Effect": "Allow",
    "Action": "ec2:CreateTags",
    "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*",
        "arn:aws:ec2:*:*:network-interface/*"
    ],
    "Condition": {
        "StringEquals": {
            "ec2:CreateAction": [
                "RunInstances",
                "CreateVolume"
            ]
        }
    }
}
profile pictureAWS
已回答 3 個月前
0

Hi, the action ec2:RunInstances applies to the resource defined by "Resource:*" of the same statement. The resources for this authorization are EC2 instances defined by their ids. So, the required tag should be present on the instances to (re)started. It doesn't apply to any other resources used by those instances (optional or required).

To further condition by the presence of this tag, you would have to have similar statements for the other resources and corresponding actions that you want to condition.

Best,

Didier

profile pictureAWS
專家
已回答 3 個月前
0

@Paul Frederiksen I think my question was how does the policy apply for mandatory resources vs optional resources. Thanks for taking effort for answering

Deep
已回答 3 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南