使用AWS CLI部署EC2 Image Builder配方时权限不足，缺失哪些权限？

我通过脚本生成以下JSON格式的EC2 Image Builder镜像配方：

{
    "name": "MyRecipe",
    "description": "Create image recipe.",
    "semanticVersion": "1.1.0",
    "components": [
        {
            "componentArn": "arn:aws:imagebuilder:us-east-1:MyAccountID:component/MyComponent"
        }
    ],
    "parentImage": "ami-05d47d29a4c2d19e1"
}

执行部署命令：

aws imagebuilder create-image-recipe --cli-input-json file:///tmp/tmpuvshobis/create-recipe.json

其中parentImage指向Ubuntu 22.04 LTS arm64的公共AMI。使用拥有AmazonEC2FullAccess、AmazonS3FullAccess、AWSImageBuilderFullAccess权限的管理员账号可成功部署，但使用受限角色时失败，报错信息如下：

An error occurred (InvalidParameterValueException) when calling the CreateImageRecipe operation: The value supplied for parameter 'parentImage' is not valid. You are not authorized to use the provided image.

该角色的权限策略配置如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ecr:UntagResource",
                "ecr:CompleteLayerUpload",
                "ecr:TagResource",
                "ec2:ModifyLaunchTemplate",
                "ecr:UploadLayerPart",
                "ecr:InitiateLayerUpload",
                "ec2:CreateLaunchTemplateVersion",
                "ecr:PutImage",
                "sts:AssumeRoleWithWebIdentity",
                "imagebuilder:CreateComponent",
                "imagebuilder:UpdateImagePipeline",
                "imagebuilder:CreateImageRecipe",
                "imagebuilder:StartImagePipelineExecution",
                "imagebuilder:CreateImagePipeline",
                "imagebuilder:TagResource",
                "imagebuilder:UntagResource",
                "imagebuilder:GetComponent",
                "ec2:DescribeImages",
                "ec2:DescribeImageAttribute",
                "imagebuilder:ListImages",
                "imagebuilder:GetImage"
            ],
            "Resource": [
                "arn:aws:ec2:us-east-1:MyAccountID:launch-template/lt-MyLaunchTemplate",
                "arn:aws:ecr:us-east-1:MyAccountID:repository/MyRepo",
                "arn:aws:imagebuilder:us-east-1:MyAccountID:image/*",
                "arn:aws:imagebuilder:us-east-1:MyAccountID:image-recipe/*/*",
                "arn:aws:imagebuilder:us-east-1:MyAccountID:image-pipeline/*",
                "arn:aws:imagebuilder:us-east-1:MyAccountID:component/*/*/*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "ecr:GetAuthorizationToken",
            "Resource": "*"
        }
    ]
}

请问该角色缺失哪些必要权限？错误信息未明确说明。

该受限角色缺失以下两项核心权限，需添加到权限策略中：

1. ec2:DescribeImagePermissions
   Image Builder创建镜像配方时，会验证角色是否有权限使用指定的公共AMI，该权限用于查询镜像的共享权限配置，确认当前角色是否被允许使用该AMI。

2. 针对目标AMI的ec2:RunInstances权限
   尽管报错信息指向“无法使用镜像”，但Image Builder在构建镜像的过程中需要启动基于该父AMI的EC2实例，因此必须为目标AMI添加ec2:RunInstances权限。

权限策略添加示例 #

可以在现有策略中新增一条语句，最小化权限范围：

{
    "Sid": "AllowUseTargetParentAmi",
    "Effect": "Allow",
    "Action": [
        "ec2:DescribeImagePermissions",
        "ec2:RunInstances"
    ],
    "Resource": "arn:aws:ec2:us-east-1::image/ami-05d47d29a4c2d19e1"
}

如果需要允许使用同区域内的所有公共Ubuntu AMI（遵循最小权限原则的前提下），可以使用更宽泛的资源匹配：

{
    "Sid": "AllowUsePublicUbuntuAmis",
    "Effect": "Allow",
    "Action": [
        "ec2:DescribeImagePermissions",
        "ec2:RunInstances"
    ],
    "Resource": "arn:aws:ec2:us-east-1::image/ami-*"
}

补充说明 #

当前策略中已包含imagebuilder:CreateImageRecipe及对应的资源范围（arn:aws:imagebuilder:us-east-1:MyAccountID:image-recipe/*/*），这部分无需调整。核心问题是公共AMI的权限验证和实例启动权限未配置，导致Image Builder无法完成配方创建流程。

内容的提问来源于stack exchange，提问作者Arno