为Elastic Beanstalk实例配置SSH时遭遇授权错误，求权限排查

问题场景 #

执行eb ssh --setup Test-env配置Elastic Beanstalk实例的SSH访问，确认环境名称、密钥对名称后触发如下错误：

eb ssh --setup Test-env
WARNING: You are about to setup SSH for environment "Test-env". If you continue, your existing instances will have to be **terminated** and new instances will be created. The environment will be temporarily unavailable.
To confirm, type the environment name: Test-env

Type a keypair name.
(Default is aws-eb):
Generating public/private rsa key pair.
C:\Users\steeve\.ssh\aws-eb already exists.
Overwrite (y/n)?
ERROR: NotAuthorizedError - Operation Denied. You are not authorized to perform this operation. Encoded authorization failure message: CMrME2Q3zO8uzTOfmkZKzzZFtYI619QHlTlFKlnZYzbaLYS6bpdJqBg8yYOUj7WU7YJLqabtHgtp4U6kSMlNxvjpodMsdNirEP4aEr6yZL3Rum7MczDWdow9CdWJE_TOS3ULP2aFEa4Uas4rfwpCmEN1S7NRBIpGHrC_obKy3UgQygeXrcRJhxsvsfzTcEP7sLGd5y5KajPqoFso0HY2B0qSJ9XObX9bQrZ2wnADKaUuM1dyrJlJH_OAzNivJR1DeciqWkWjLJRHHWef7XhS3bpZJCXkM7ahpTwXZ5SOS5f1F-NU1dVxVzR9wYyp5XVhI0SM1FkEAFhK6T3TkkV6XqoYYKdwuyzQFoIX57LFpPLCxxAchM0xq2wenIlnlqW4Puu4g6oeo2SEd7E7HBd0Zk_QQx0dW1pZYZroLXMc37fZAYsEDOooeOq5I-qF-DIxMse_vMQnPMKpb5JW9g4vz_ZP0ToRirgWNdP0dd5rT7v2TbRnNFdFG3j3RoSe46qgaEt5GcFEjmwb-Kog_GE

解决步骤 #

1. 解析授权失败消息 #

AWS返回的编码消息可通过IAM控制台或AWS CLI解码，明确缺失的具体权限：

• CLI解码命令：替换编码消息后执行：

aws iam decode-authorization-message --encoded-message "CMrME2Q3zO8uzTOfmkZKzzZFtYI619QHlTlFKlnZYzbaLYS6bpdJqBg8yYOUj7WU7YJLqabtHgtp4U6kSMlNxvjpodMsdNirEP4aEr6yZL3Rum7MczDWdow9CdWJE_TOS3ULP2aFEa4Uas4rfwpCmEN1S7NRBIpGHrC_obKy3UgQygeXrcRJhxsvsfzTcEP7sLGd5y5KajPqoFso0HY2B0qSJ9XObX9bQrZ2wnADKaUuM1dyrJlJH_OAzNivJR1DeciqWkWjLJRHHWef7XhS3bpZJCXkM7ahpTwXZ5SOS5f1F-NU1dVxVzR9wYyp5XVhI0SM1FkEAFhK6T3TkkV6XqoYYKdwuyzQFoIX57LFpPLCxxAchM0xq2wenIlnlqW4Puu4g6oeo2SEd7E7HBd0Zk_QQx0dW1pZYZroLXMc37fZAYsEDOooeOq5I-qF-DIxMse_vMQnPMKpb5JW9g4vz_ZP0ToRirgWNdP0dd5rT7v2TbRnNFdFG3j3RoSe46qgaEt5GcFEjmwb-Kog_GE"

解码结果会直接显示被拒绝的操作名称。

2. 核心权限参考 #

执行eb ssh --setup需要以下几类权限，可根据解码结果精准调整：

• Elastic Beanstalk：elasticbeanstalk:UpdateEnvironment、elasticbeanstalk:DescribeEnvironments
• EC2：ec2:CreateKeyPair、ec2:DescribeKeyPairs、ec2:TerminateInstances、ec2:RunInstances（操作会替换现有实例）
• IAM（如需关联实例配置文件）：iam:PassRole

3. 示例权限策略 #

给当前用户或角色附加以下策略（替换YOUR_ACCOUNT_ID为你的AWS账号ID，可按需缩小资源范围）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "elasticbeanstalk:UpdateEnvironment",
                "elasticbeanstalk:DescribeEnvironments"
            ],
            "Resource": "arn:aws:elasticbeanstalk:*:*:environment/*/Test-env"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateKeyPair",
                "ec2:DescribeKeyPairs",
                "ec2:TerminateInstances",
                "ec2:RunInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::YOUR_ACCOUNT_ID:role/aws-elasticbeanstalk-ec2-role"
        }
    ]
}

4. 验证权限 #

附加策略后重新执行eb ssh --setup Test-env，确认操作正常完成。

内容的提问来源于stack exchange，提问作者steeve