跨账号共享AMI遇权限错误：AutoScalingGroup创建失败排查

在Dev账号（ID：1111111）创建的AMI需要在同区域的Prod账号（ID：22222222）中用于创建WEBAutoScalingGroup，但创建失败，报错如下：

WEBAutoScalingGroup - AWS::AutoScaling::AutoScalingGroup - CREATE_FAILED - API: autoscaling:CreateAutoScalingGroup Not authorized for images: [ami-02adsdsw4d8216f7b0a]

该镜像在Dev环境可正常使用，已配置AWS::ImageBuilder::DistributionConfiguration并为两个账号设置启动权限，Image Builder权限配置如下：

---
AWSTemplateFormatVersion: '2010-09-09'
Description: image builder policy

Parameters:
  Dev:
    Default: 11111111111
    Type: String
  Prod:
    Default: 22222222222
    Type: String
    
Resources:
  ImageBuilderpolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Extra permission for Image builder role 
      Roles:
        - EC2InstanceProfileForImageBuilder
      PolicyDocument:
          Version: '2012-10-17'
          Statement:  
              # s3 get object permission for image builder
              - Effect: Allow
                Action:
                  - s3:Get*
                  - s3:List*
                Resource: 
                  - "arn:aws:s3:::dev-imagebuilder-cicd/*"
                  - "arn:aws:s3:::dev-imagebuilder-cicd"
                 

#Imagebuilder policy to cicd role
  IAMPolicyEC2ImageBuilder:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - CICDRole
      Description: Policy to access AWS EC2 Image Builder Service
      ManagedPolicyName: 'EC2ImageBuilderIAMPolicy'
      Path: '/ImageBuilder-Management/'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'imagebuilder:CreateComponent'
              - 'imagebuilder:CreateDistributionConfiguration'
              - 'imagebuilder:CreateImage'
              - 'imagebuilder:CreateImagePipeline'
              - 'imagebuilder:CreateImageRecipe'
            Resource: '*'
            
          - Effect: Allow
            Action:
              - 'imagebuilder:CreateInfrastructureConfiguration'
            Resource: '*'
            
          - Effect: Allow
            Action:
              - 'imagebuilder:CancelImageCreation'
              - 'imagebuilder:Get*'
              - 'imagebuilder:DeleteComponent'
              - 'imagebuilder:DeleteDistributionConfiguration'
              - 'imagebuilder:DeleteImage'
              - 'imagebuilder:DeleteImagePipeline'
              - 'imagebuilder:DeleteImageRecipe'
              - 'imagebuilder:DeleteInfrastructureConfiguration'
              - 'imagebuilder:ImportComponent'
              - 'imagebuilder:StartImagePipelineExecution'
              - 'imagebuilder:TagResource'
              - 'imagebuilder:UntagResource'
              - 'imagebuilder:UpdateDistributionConfiguration'
              - 'imagebuilder:UpdateImagePipeline'
              - 'imagebuilder:UpdateInfrastructureConfiguration'
            Resource: '*'
            
          - Effect: Allow
            Action:
              - 'sns:Publish'
            Resource: !Sub 'arn:aws:sns:${AWS::Region}:${AWS::AccountId}:*imagebuilder*'
          - Effect: Allow
            Action: iam:PassRole
            Resource:
            - !Sub arn:aws:iam::${AWS::AccountId}:instance-profile/EC2InstanceProfileForImageBuilder
            - !Sub arn:aws:iam::${AWS::AccountId}:role/EC2InstanceProfileForImageBuilder
            Condition:
              StringEquals:
                iam:PassedToService: ec2.amazonaws.com
          - Effect: Allow
            Action: iam:CreateServiceLinkedRole
            Resource: arn:aws:iam::*:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder
            Condition:
              StringLike:
                iam:AWSServiceName: imagebuilder.amazonaws.com
          - Effect: Deny
            Action:
            - ec2:RunInstances
            - ec2:AssociateIamInstanceProfile
            Resource: "*"
            Condition:
              StringEquals:
                ec2:InstanceProfile: !Sub arn:aws:iam::${AWS::AccountId}:instance-profile/EC2InstanceProfileForImageBuilder

  Ec2ImageBuilderCrossAccountDistributionAccessPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - CICDRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: "ec2:CreateTags"
            Resource: "arn:aws:ec2:*::image/*"
          - Effect: Allow
            Action:
              - "ec2:DescribeImages"
              - "ec2:CopyImage"
              - "ec2:ModifyImageAttribute"
            Resource: "*"

  EC2ImageBuilderDistributionCrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: EC2ImageBuilderDistributionCrossAccountRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action:
              - "sts:AssumeRole"
          - Effect: Allow
            Principal:
              AWS: 
                - !Sub arn:aws:iam::${Dev}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder
                - !Sub arn:aws:iam::${Prod}:role/aws-service-role/imagebuilder.amazonaws.com/AWSServiceRoleForImageBuilder
            Action:
              - "sts:AssumeRole"

      Policies:
      - PolicyName: EC2ImageBuilderKMSInlinePolicy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action: 
                - 'kms:Encrypt'
                - 'kms:Decrypt'
                - 'kms:ReEncrypt*'
                - 'kms:GenerateDataKey*'
                - 'kms:DescribeKey'
                - 'kms:CreateGrant'
                - 'kms:ListGrants'
                - 'kms:RevokeGrant'
                - 'ec2:CreateLaunchTemplateVersion'
                - 'ec2:ModifyLaunchTemplate'
                - 'ec2:DescribeLaunchTemplates'
                - 'ec2:CreateTags'
              Resource: '*'
            - Effect: Allow
              Action:
                - ec2:CreateLaunchTemplateVersion
                - ec2:ModifyLaunchTemplate
              Resource: "*"
              
            - Effect: Allow
              Action:
                - ec2:DescribeLaunchTemplates
              Resource: "*"
              
            - Effect: Allow
              Action:
                - ec2:CreateTags
              Resource: arn:aws:ec2:*:*:launch-template/*
              
      ManagedPolicyArns:
        - !Ref Ec2ImageBuilderCrossAccountDistributionAccessPolicy
                
 

1. 验证AMI启动权限的实际配置 #

手动确认Dev账号中目标AMI的权限是否正确赋予Prod账号：

• 登录Dev账号的EC2控制台，找到目标AMI，查看权限标签，确认Prod账号ID（22222222）在启动权限列表中
• 或用CLI命令验证：

aws ec2 describe-image-attribute --image-id ami-02adsdsw4d8216f7b0a --attribute launchPermission --region <你的区域>

确保输出包含"UserId": "22222222"。

2. 检查Prod账号创建ASG的角色权限 #

报错核心是ASG创建时权限不足，需确认Prod账号中执行CreateAutoScalingGroup的角色具备以下权限：

• ec2:RunInstances：ASG创建EC2实例时必须的基础权限
• ec2:DescribeImages：用于验证AMI的合法性和权限
• 同时确保该角色无拒绝上述操作的策略语句

示例补充策略片段：

{
  "Effect": "Allow",
  "Action": [
    "ec2:RunInstances",
    "ec2:DescribeImages"
  ],
  "Resource": "*"
}

3. 确认DistributionConfiguration的生效情况 #

Image Builder的分发配置可能未正确同步到AMI：

• 检查DistributionConfiguration的launchPermissions是否明确指定Prod账号ID：

launchPermissions:
  userIds:
    - "22222222"

• 若配置无误，尝试重新触发一次镜像构建，或手动在Dev账号中为AMI添加Prod账号的启动权限。

4. 检查加密AMI的KMS密钥权限 #

如果AMI使用了加密卷，需确保Prod账号有权访问对应的KMS密钥：

• 在Dev账号的KMS控制台找到加密密钥，编辑密钥策略，添加Prod账号权限：

{
  "Sid": "AllowProdAccountAccess",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::22222222:root"
  },
  "Action": [
    "kms:Decrypt",
    "kms:DescribeKey"
  ],
  "Resource": "*"
}

5. 排查组织级SCP限制 #

检查AWS组织的服务控制策略（SCP），确认Prod账号未被限制跨账号AMI访问：

• 查看SCP中是否存在拒绝ec2:RunInstances或ec2:DescribeImages的语句
• 确保SCP允许Prod账号访问Dev账号的AMI资源

内容的提问来源于stack exchange，提问作者Markus