如何将ec2:CreateNetworkInterface权限限制到指定VPC/子网？

问题描述 #

需为AWS Glue作业绑定的IAM角色，限制ec2:CreateNetworkInterface和ec2:DeleteNetworkInterface权限仅能在指定VPC或子网内执行，尝试多种资源与条件配置后均失败，Glue作业执行时提示权限不足。原策略框架如下：

{
    "Effect": "Allow",
    "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface"
    ],
    "Resource": [
        "*"
    ],
    "Condition": {
        "StringLike": {
            "ec2:XXXXX": "*"
        }
    }
}

可行配置方案 #

要实现精准权限限制，需结合资源指定与条件判断，同时满足Glue作业的隐性权限依赖：

1. 拆分权限配置 #

将创建和删除操作分开配置，明确各自的资源范围与条件：

2. 最终策略示例 #

{
    "Effect": "Allow",
    "Action": "ec2:CreateNetworkInterface",
    "Resource": [
        "arn:aws:ec2:${region}:${account-id}:subnet/${目标子网ID1}",
        "arn:aws:ec2:${region}:${account-id}:subnet/${目标子网ID2}",
        "arn:aws:ec2:${region}:${account-id}:network-interface/*"
    ],
    "Condition": {
        "StringEquals": {
            "ec2:Vpc": "arn:aws:ec2:${region}:${account-id}:vpc/${目标VPCID}"
        }
    }
},
{
    "Effect": "Allow",
    "Action": "ec2:DeleteNetworkInterface",
    "Resource": "arn:aws:ec2:${region}:${account-id}:network-interface/*",
    "Condition": {
        "StringEquals": {
            "ec2:Vpc": "arn:aws:ec2:${region}:${account-id}:vpc/${目标VPCID}"
        }
    }
},
{
    "Effect": "Allow",
    "Action": [
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups"
    ],
    "Resource": "*"
}

关键注意点 #

• Glue作业创建网络接口时需读取子网、安全组信息，必须补充ec2:DescribeSubnets和ec2:DescribeSecurityGroups权限，否则会触发权限不足
• 替换策略中的${region}、${account-id}、${目标VPCID}、${目标子网ID}为实际AWS资源标识
• 若仅需限定子网，可将条件中的ec2:Vpc替换为ec2:Subnet，并传入对应子网ARN

内容的提问来源于stack exchange，提问作者s_wheels