AWS IAM角色策略配置错误：资源无指定标签时无法禁止删除

云原生阿岚

2026-6-23

问题分析

你的IAM策略条件逻辑完全写反了：当前配置是当资源带有ResourceDelete=True标签时拒绝删除，这和你“缺少标签则拒绝删除”的需求正好相反。另外，第一个Allow语句过度授权（允许所有服务的所有操作），虽然IAM中Deny优先级高于Allow，但这种写法存在安全风险，建议后续按需缩小授权范围。

修正后的策略

以下是符合需求的完整策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowNecessaryActions",
      "Effect": "Allow",
      "Action": [
        "acm:*",
        "autoscaling:*",
        "cloudtrail:*",
        "cloudwatch:*",
        "dms:*",
        "ec2:*",
        "eks:*",
        "elasticache:*",
        "elasticloadbalancing:*",
        "iam:*",
        "kms:*",
        "lambda:*",
        "rds:*",
        "redshift:*",
        "route53:*",
        "s3:*",
        "sns:*",
        "sqs:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyDeleteWithoutTag",
      "Effect": "Deny",
      "Action": [
        "acm:Delete*",
        "autoscaling:Delete*",
        "cloudtrail:Delete*",
        "cloudwatch:Delete*",
        "dms:Delete*",
        "ec2:Delete*",
        "ec2:Terminate*",
        "eks:DeleteCluster",
        "elasticache:Delete*",
        "elasticloadbalancing:Delete*",
        "kms:Delete*",
        "lambda:Delete*",
        "rds:Delete*",
        "redshift:Delete*",
        "route53:Delete*",
        "s3:DeleteBucket*",
        "sns:Delete*",
        "sqs:Delete*"
      ],
      "Resource": "*",
      "Condition": {
        "Or": [
          {
            "Null": {
              "aws:ResourceTag/ResourceDelete": "true"
            }
          },
          {
            "StringNotEquals": {
              "aws:ResourceTag/ResourceDelete": "True"
            }
          }
        ]
      }
    }
  ]
}

关键修正说明

条件逻辑调整：用Or运算符组合两个判断规则，只要满足任一条件就拒绝删除：
1. 资源不存在ResourceDelete标签（Null条件为true）
2. 资源的ResourceDelete标签值不等于True
  这样就实现了“只有标签存在且值为True时，才能执行删除操作”的核心需求。
语法与规范修正：补全了IAM策略必填的Version和外层结构，将DMS改为小写dms（符合AWS服务命名规范）。

内容的提问来源于stack exchange，提问作者Gogo