拥有管理员权限却被Terraform拒绝创建EC2实例求助

你的SCP规则拒绝了未携带owner请求标签的ec2:RunInstances操作，而当前Terraform脚本的问题在于：你在root_block_device块中单独定义了根卷的标签，这会导致Terraflow先通过RunInstances创建实例和根卷（此时根卷的owner标签并未包含在请求中），之后再调用ec2:CreateTags给根卷补打标签。SCP检查的是RunInstances请求中的标签（aws:RequestTag/owner），所以根卷对应的Resource在请求中没有标签，触发了Deny规则。

方案1：让实例标签自动传播到根卷 #

删除root_block_device内的tags配置，保留aws_instance级别的tags。Terraform会自动在RunInstances请求中通过TagSpecifications参数，同时给实例和根卷带上owner标签，满足SCP的条件：

resource "aws_instance" "ec2_instance" {
  ami                    = "ami-051f7e7f640dc1"
  count                  = 1
  instance_type          = "t3.medium"
  key_name               = "keypair"
  vpc_security_group_ids = ["sg-xyz", "sg-abc"]
  subnet_id              = "subnet-xyz"

  # 实例标签会自动同步到根卷
  tags = {
    owner = "aws"
  }

  root_block_device {
    delete_on_termination = true
    encrypted             = true
    volume_size           = 8
    volume_type           = "gp2"
    # 移除此处单独的tags配置
  }

  # 指定Provider别名，避免隐式配置错误
  provider = aws.virginia
}

方案2：调整SCP允许后续给卷打标签 #

如果需要给根卷设置独立标签，可以修改SCP，添加允许ec2:CreateTags的规则，同时保留原有的强制标签校验：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyEC2CreationSCP1",
      "Effect": "Deny",
      "Action": ["ec2:RunInstances"],
      "Resource": [
        "arn:aws:ec2:us-east-1:*:instance/*",
        "arn:aws:ec2:us-east-1:*:volume/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/owner": "true"
        }
      }
    },
    {
      "Sid": "AllowCreateTagsForVolumes",
      "Effect": "Allow",
      "Action": ["ec2:CreateTags"],
      "Resource": ["arn:aws:ec2:us-east-1:*:volume/*"],
      "Condition": {
        "StringEquals": {
          "ec2:CreateAction": "RunInstances"
        }
      }
    }
  ]
}

• 确认aws_instance资源块已指定provider = aws.virginia，避免因Provider不匹配导致的隐性问题。
• 查看Terraform执行计划，确认RunInstances请求中包含TagSpecifications，且同时覆盖实例和卷资源。

内容的提问来源于stack exchange，提问作者sahith palika