从AWS AMI启动实例并附加IAM策略时遇权限错误求助

1. 解码授权失败消息 #

AWS返回的编码消息可通过CLI解析，明确具体缺失的权限：

• 执行命令：

  aws sts decode-authorization-message --encoded-message KvgfJLnYPXk96wSuddXsUXevnofWQul4lixB8jrmzyL-YFUsUoxWhx6ovSj5zJMRZOWr6cnIX5oitWHGpNO8HJ9q7PhJsBenClv5zSN-TlZ6HHUyQaXGxUNTlz2c21N0VIhVR2P0M0hfzu_PsYyKu7YcL7HruNRunx0aUtIs5MB6WwQrNkasM8DWizLVotw_M2xKVDH3SJbrXXThkjrHFOUhdUnTB8J9e74XrgcK5_uicbYEsR4cTz6IRdiw0y1EV9RJd9lZnkFXVrenqpCPZ-FG-8AZ3mDqAZkMMbOOThURKEZ-vIjIIgZsudCW6gCKgHWe8SUHfNeSVLRc2hNdqb8K8dugc8kS0A1Fmd7f7_29qK2EXGztIwU77bVryWvVeAbzdQU5SqNaYZpkCVbR27MMZnID-YleyykVKO1ZiGeiNBFdqjKp8wiinsRrASZZ1y2VOTDB2j8CuA7Ym_zTlH4f86lkqXRiK-R6LmHsGrYam6Wy3rahAHcHV56pW4fVG-QRMm5Uid4BWR9Pij5bq8OeJ8avjySMm50bdn7yERkc82dM3MvK-dMuV1rPGgRpEpiCfnqfFI5RUJ_d0M_hj-vd7UYfAIfyXqnN1GhrTpY20wgE6fUJGgslojUKOtfMjVHsDH00xocTW96BsZcDlFksMZ9Q4pzXTocbshLB_deX8jklJVSbUuTELxfMGcahnFi8DH2nNHus6Ni9SrtamVNtPf1PHt7cYQ0ANEgX3-zayVXVh1XzDfRyImbsHmTIMVv_7v4dxPVDRC1qNs4KNaVH7fUT1Zzv4FW91Awmf78wVfE--XrREvOaA6ZJBsf66639wcn_5Bd3LBWJnQ4mhii2Y_1QqdfMOeUhflTgBVWYIbQL9KDDWi8982RoryP4CHJVFhpVUiDbsAG8s0a02Dq5wojMQ-to6-LJc_mGMmhuupTT9aXzT9DympkJ56T48KVWtaVuOfVklD4vZ1p2f_TLXgxd-Awlbqiqbpq4s1gaiMPcnuOAltAnU3nSoISIP2RPHILTIbQKMIlwKZYOozj7G8517053pdmYe5vdIntjmxO3_ggTf18KwA47sPE-KBgriFsOnJfh-uG2xvyupIxR5Ea9KX-IeHzCb-CykSpMNBUWx7uC4MdIiov6DmmLp1uARYmL3fNBd_yFna-xXrENT2eoe2lJgcwlatLK0zwlH2wATJJG9zHA5AyoJt4kOpoG9DvYFfKEdJXE7h44ZOhwPnWtRkXLqpZXOSFQEfebpWZ2zYb8jQ
  

• 解码后会得到具体权限缺失详情，比如ec2:RunInstances、iam:PassRole等权限不足。

2. 为操作账户补充必要权限 #

根据解码结果，为执行操作的IAM用户/角色添加对应权限策略：

• 核心必备权限：
  • ec2:RunInstances：允许从AMI启动实例
  • iam:PassRole：允许将指定SSM角色传递给EC2实例
  • 若需创建/关联角色，还需iam:CreateRole、iam:AttachRolePolicy等权限
• 示例策略片段：

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "ec2:RunInstances",
              "Resource": [
                  "arn:aws:ec2:*:*:instance/*",
                  "arn:aws:ec2:*:*:image/ami-*",
                  "arn:aws:ec2:*:*:subnet/*",
                  "arn:aws:ec2:*:*:security-group/*",
                  "arn:aws:ec2:*:*:key-pair/*"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "iam:PassRole",
              "Resource": "arn:aws:iam::ACCOUNT_ID:role/YOUR_SSM_ROLE_NAME",
              "Condition": {
                  "StringEquals": {
                      "iam:PassedToService": "ec2.amazonaws.com"
                  }
              }
          }
      ]
  }
  

3. 验证SSM角色配置 #

确保用于Systems Manager访问的角色配置正确：

• 附加AmazonSSMManagedInstanceCore托管策略，该策略包含SSM管理实例的核心权限
• 确认角色信任关系允许EC2服务扮演它，信任策略示例：

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": {
                  "Service": "ec2.amazonaws.com"
              },
              "Action": "sts:AssumeRole"
          }
      ]
  }
  

4. 检查实例启动配置 #

• 启动实例时，确认选择的IAM角色是已配置好的SSM角色
• 若使用自定义AMI，排查AMI本身是否有权限限制配置

内容的提问来源于stack exchange，提问作者nikhil phulare