寫寫我的個(gè)人學(xué)習(xí)心德，本文僅為個(gè)人學(xué)習(xí)心德，與AWS無關(guān)

通過Amazon Organization使用SCP可以限制多個(gè)aws accounts

將下列SCP復(fù)制,在aws organization管理account中,創(chuàng)建SCP并將其attach到相應(yīng)OU或account中即可.SCP的說明請參考官方文檔[1]
注意中國區(qū)，A要將所有ARN中的aws換成aws-cn

直接列出允許的AMI,拒絕其它

但是與IAM不同的是由于SCP不支持NotResource，唉！所以我們還是需要使用Condition。以下sample會對所有regions適用，只允許使用us-east-1和us-east-2這兩個(gè)region的Amazon Linux AMI（同樣的AMI在不同region其AMI ID也是不同的，所以需要窮舉）,如果只想對特定region限制，可以將*改為相應(yīng)的region名

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LaunchingEC2withAMIsAndTags",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": [
        "arn:aws:ec2:*::image/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "ec2:ImageID": [
            "ami-05fa00d4c63e32376",
            "ami-0568773882d492fc8"
          ]
        }
      }
    }
  ]
}

使用Tag篩選AMI

Resource中ARN中的region，只對其一個(gè)region有效果，不會阻止其它region，如果想適用于所有region，可以請us-east-1替換為*

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LaunchingEC2withAMIsAndTags",
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:us-east-1::image/ami-*",
      "Condition": {
        "StringNotEquals": {
          "ec2:ResourceTag/Environment":[ "Prod","Certified"]
        }
      }
    }
  ]
}

得到報(bào)錯(cuò)效果如下圖：

Screen Shot 2022-08-31 at 08.58.27.png

使用IAM,可以控制單個(gè)user,role或group

直接列出允許的AMI

"arn:aws:ec2:us-east-1::image/ami-090fa75af13c156b4",
"arn:aws:ec2:us-east-2::image/ami-051dfed8f67f095f5",
為允許使用的AMI值,可以自行添加需要的值

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:RunInstances",
            "Resource": [
                "arn:aws:ec2:us-east-1::image/ami-090fa75af13c156b4",
                "arn:aws:ec2:us-east-2::image/ami-051dfed8f67f095f5",
                "arn:aws:ec2:*:<accountid>:subnet/*",
                "arn:aws:ec2:*:<accountid>:network-interface/*",
                "arn:aws:ec2:*:<accountid>:volume/*",
                "arn:aws:ec2:*:<accountid>:instance/*",
                "arn:aws:ec2:*:<accountid>:key-pair/*",
                "arn:aws:ec2:*:<accountid>:security-group/*"
            ]
        }
    ]
}

使用Tag篩選AMI,參考官方文章[2]

以下例子表明當(dāng)AMI的tag key是"Environment",其value為"Prod"時(shí),才可以使用此AM啟動(dòng)Iec2.請根據(jù)需要自行修改最后一行中的標(biāo)簽KV值

{
      "Sid": "LaunchingEC2withAMIsAndTags",
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "arn:aws:ec2:us-east-1::image/ami-*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "Prod"
        }
      } 
    }

參考文獻(xiàn)

[1]SCP syntax
[2]How can I restrict access to launch Amazon EC2 instances from only tagged AMIs?