使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post

Scp Tag enforcement is not working on Ec2.

0

I have created an SCP to deny ec2 resource creation if there is no tag. The instance is only get created if it has an environment tag key mentioned in it.

Here is my policy :

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Scp1",
      "Effect": "Deny",
      "Action": [
        "ec2:CreateTags",
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:RequestTag/environment": "true"
        }
      }
    }
  ]
}
主題
運算管理與治理
標籤
Amazon EC2AWS Organizations
語言
English
Shubham
已提問 2 年前檢視次數 1021 次
2 個答案
0

Yes I am trying to achieve this thing but I want to achieve this by using AWS SCP. All post which I have seen they all have same json file as mine. But while implementation it is not working.

Shubham
已回答 2 年前
  • RichardFan
    2 年前

    So what condition type you are using?

    ForAllValues:StringEquals? Or StringNotLike?

  • Shubham
    2 年前

    I have used Both but no luck.

  • RichardFan
    2 年前

    Can you also post the policy you use with StringNotLike to see if there is any other issue?

  • Shubham
    2 年前
    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Scp1",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:RequestTag/environment": "true"
        }
      }
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Scp1",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
      ],
      "Condition": {
        "ForAllValues:StringNotLike": {
          "aws:RequestTag/environment": "true"
        }
      }
    }
  ]
}
  • RichardFan
    2 年前

    Your policy with

    "ForAllValues:StringNotLike": {
          "aws:RequestTag/environment": "true"
        }

    means all your new EC2 instances need to have a tag environment and the tag value must be exactly true

    Is this what you expect and what you get?

0

I guess you are trying to achieve something like this: https://aws.amazon.com/premiumsupport/knowledge-center/iam-policy-tags-deny/ (Sid: AllowRunInstancesWithRestrictions1)

Your policy can be modified as follow:

{
    "Effect": "Deny",
    "Action": [
        "ec2: CreateTags",
        "ec2: RunInstances"
    ],
    "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:volume/*"
    ],
    "Condition": {
        "StringNotLike": {
            "aws:RequestTag/cost_center": "?*"
        }
    }
}
RichardFan
已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

回答問題指南

相關內容