由网友(我不是神，但我是万能的)分享简介：我按照这个链接文档http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#ex5我想提供一种指定标签的用户特定的图像启动权限，部门=开发。I want to provide a user specific Image L...

我按照这个链接文档

http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#ex5

我想提供一种指定标签的用户特定的图像启动权限，部门=开发。

I want to provide a user specific Image Launch permission which specified tag, "department=dev".

{
   "Version": "2012-10-17",
   "Statement": [{
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [ 
         "arn:aws:ec2:region::image/ami-*"
      ],
      "Condition": {
         "StringEquals": {
            "ec2:ResourceTag/department": "dev"
         }
      }
   },
   {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": [ 
          "arn:aws:ec2:region:account:instance/*",
          "arn:aws:ec2:region:account:volume/*",
          "arn:aws:ec2:region:account:key-pair/project_keypair",
          "arn:aws:ec2:region:account:security-group/sg-1a2b3c4d"
         ]
      }
   ]
}

我还添加了一个分开的描述警察，因为我使用的接口没有CLI。

I also added a separated Describe police because i am using interface not cli .

但是，当我启动情况下其显示初始化失败而停止。我去code中的错误信息，并提供给我

But when i launch instances its show initialization failed and stop . I decode the error message and it provide me

{
    "DecodedMessage": "{"allowed":false,"explicitDeny":false,"matchedStatements":{"items":[]},"failures":{"it
ems":[]},"context":{"principal":{"id":"AIDAJXOEQNA64A677DGQO","name":"DevOps1","arn":"arn:aws:iam::95524
6940111:user/DevOps1"},"action":"ec2:RunInstances","resource":"arn:aws:ec2:us-east-1:955246940111:network-interf
ace/*","conditions":{"items":[{"key":"ec2:Subnet","values":{"items":[{"value":"arn:aws:ec2:us-east-1:955
246940111:subnet/subnet-9d25b5b6"}]}},{"key":"ec2:Region","values":{"items":[{"value":"us-east-1"}]}},{"ke
y":"ec2:AvailabilityZone","values":{"items":[{"value":"us-east-1c"}]}},{"key":"ec2:Vpc","values":{"ite
ms":[{"value":"arn:aws:ec2:us-east-1:955246940111:vpc/vpc-ebeed48e"}]}}]}}}"

请帮忙

推荐答案

尝试添加

ARN：AWS：EC2：美国东部-1：955246940111：网络接口/ *

"arn:aws:ec2:us-east-1:955246940111:network-interface/*"

在策略中的资源列表。

这就是去codeD AUTH消息报告缺少/错误的。

That's what the decoded auth message is reporting as missing/wrong.

另外，还要确保你与你的政策的实际值替换区域和帐户的任何实例，假设你还没有。

Also make sure you replace any instances of region and account with the actual values in your policy, assuming you haven't already.