如何限制进程可见的FSxN文件系统？授权调用DescribeFileSystems报错

我尝试限制某进程仅能查看特定FSx文件系统，已为EC2实例附加包含如下语句的IAM角色：

"Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "fsx:Describe*",
                "fsx:List*",
                "fsx:UpdateFileSystem"
            ],
            "Resource": [
                "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-0e8d9xxxxxxxef3b",
                "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-07bcxxxxxxxx5e43"
            ]
        }
]

但调用aws fsx describe-file-systems时出现权限拒绝错误：

ubuntu@ip-10-129-10-194:~$ aws fsx describe-file-systems --region=us-west-2
 
An error occurred (AccessDeniedException) when calling the DescribeFileSystems operation: User: arn:aws:sts::75xxxxxxx648:assumed-role/Cloud-Manager-Operator-399y9hM/i-00d9xxxxxxf16 is not authorized to perform: fsx:DescribeFileSystems on resource: arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/* because no identity-based policy allows the fsx:DescribeFileSystems action

即使指定了角色中已授权的FSx文件系统ID，仍然报错：

ubuntu@ip-10-129-10-194:~$ aws fsx describe-file-systems --region=us-west-2 --file-system-ids fs-07bxxxxxx5e43
 
An error occurred (AccessDeniedException) when calling the DescribeFileSystems operation: User: arn:aws:sts::75xxxxxxx648:assumed-role/Cloud-Manager-Operator-399y9hM/i-00d9bxxxxxff16 is not authorized to perform: fsx:DescribeFileSystems on resource: arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/* because no identity-based policy allows the fsx:DescribeFileSystems action

需求：如何让AWS自动忽略无权限的文件系统，只返回有权限访问的结果？

原因分析 #

• 当调用DescribeFileSystems不指定具体文件系统ID时，AWS会尝试访问所有文件系统资源（arn:aws:fsx:区域:账号:file-system/*），而现有策略仅授权特定资源，因此触发权限拒绝。
• 即使指定文件系统ID，部分场景下AWS仍会先校验对*资源的权限，导致报错。

解决办法 #

方案1：添加带条件限制的全局Describe权限 #

修改IAM策略，允许fsx:DescribeFileSystems对所有资源的访问，但通过条件限制仅能查看指定文件系统：

"Statement": [
    {
        "Sid": "AllowDescribeSpecificFSx",
        "Effect": "Allow",
        "Action": "fsx:DescribeFileSystems",
        "Resource": "*",
        "Condition": {
            "ForAllValues:StringEquals": {
                "fsx:FileSystemId": ["fs-0e8d9xxxxxxxef3b", "fs-07bcxxxxxxxx5e43"]
            }
        }
    },
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "fsx:Describe*",
            "fsx:List*",
            "fsx:UpdateFileSystem"
        ],
        "Resource": [
            "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-0e8d9xxxxxxxef3b",
            "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-07bcxxxxxxxx5e43"
        ]
    }
]

此配置下，调用describe-file-systems时AWS会自动过滤无权限的文件系统，仅返回已授权的结果。

方案2：调用命令时显式指定所有有权限的文件系统ID #

每次调用命令时，直接传入所有已授权的文件系统ID：

aws fsx describe-file-systems --region=us-west-2 --file-system-ids fs-0e8d9xxxxxxxef3b fs-07bcxxxxxxxx5e43

该方式无需修改IAM策略，但需要确保每次调用都指定正确的ID，适合脚本化场景。

方案3：单独拆分DescribeFileSystems的资源级权限 #

将fsx:DescribeFileSystems单独拆分，明确指定授权的资源：

"Statement": [
    {
        "Sid": "AllowDescribeSpecificFSx",
        "Effect": "Allow",
        "Action": "fsx:DescribeFileSystems",
        "Resource": [
            "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-0e8d9xxxxxxxef3b",
            "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-07bcxxxxxxxx5e43"
        ]
    },
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "fsx:Describe*",
            "fsx:List*",
            "fsx:UpdateFileSystem"
        ],
        "Resource": [
            "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-0e8d9xxxxxxxef3b",
            "arn:aws:fsx:us-west-2:75xxxxxxx648:file-system/fs-07bcxxxxxxxx5e43"
        ]
    }
]

注意：这种写法的有效性取决于FSx的权限模型，若方案1可行，优先选择方案1。

内容的提问来源于stack exchange，提问作者kcantrel