如何配置IAM策略限制用户访问指定AWS Elastic Beanstalk生产环境

• 关联服务过度授权：原策略第二条Statement直接授予ec2:*、s3:*、rds:*、autoscaling:*、cloudformation:*等服务的全量操作权限，这是用户获得近似全AWS服务访问权限的核心原因，Elastic Beanstalk操作仅需要这些服务的特定操作权限，无需全量授权。
• 限制条件参数错误：elasticbeanstalk:InApplication条件键的合法取值为应用的ARN，而非你填写的生产环境ARN，导致限制条件永远无法触发，相当于没有加任何访问限制。
• 未使用显式拒绝规则：IAM权限判定逻辑中显式Deny优先级高于所有Allow规则，仅通过Allow加StringNotEquals排除条件的方式无法覆盖所有Elastic Beanstalk操作场景，尤其是部分不支持资源级条件的操作，必须增加显式Deny语句锁定生产环境的访问权限。
• IAM权限存在安全隐患：原策略对Elastic Beanstalk关联角色授予了iam:*权限，用户可通过修改角色权限的方式提升自身访问范围，违背最小权限原则。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "elasticbeanstalk:*",
            "Resource": [
                "arn:aws:elasticbeanstalk:<region>:<account id>:environment/<target-app-name>/<prod-env-name>",
                "arn:aws:elasticbeanstalk:<region>:<account id>:application/<target-app-name>/applicationversion/*",
                "arn:aws:elasticbeanstalk:<region>:<account id>:application/<target-app-name>/configurationtemplate/*"
            ],
            "Condition": {
                "StringEqualsIfExists": {
                    "elasticbeanstalk:InApplication": "arn:aws:elasticbeanstalk:<region>:<account id>:application/<target-app-name>"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticbeanstalk:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "ec2:RunInstances",
                "ec2:TerminateInstances",
                "ec2:CreateSecurityGroup",
                "ec2:DeleteSecurityGroup",
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupEgress",
                "s3:CreateBucket",
                "s3:DeleteBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:ListBucket",
                "cloudformation:*",
                "autoscaling:*",
                "elasticloadbalancing:*",
                "cloudwatch:*",
                "sns:*",
                "sqs:*",
                "rds:DescribeDBInstances",
                "rds:CreateDBInstance",
                "rds:DeleteDBInstance",
                "dynamodb:CreateTable",
                "dynamodb:DescribeTable"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole",
                "iam:GetRole"
            ],
            "Resource": [
                "arn:aws:iam::<account id>:role/aws-elasticbeanstalk-ec2-role",
                "arn:aws:iam::<account id>:role/aws-elasticbeanstalk-service-role",
                "arn:aws:iam::<account id>:instance-profile/aws-elasticbeanstalk-ec2-role"
            ]
        }
    ]
}

• 替换策略中所有占位符：<region>为你的AWS区域代码（如us-east-1、cn-north-1）、<account id>为你的12位AWS账号ID、<target-app-name>为生产环境所属的应用名称、<prod-env-name>为要禁止访问的生产环境名称。
• 可通过IAM策略模拟器验证生产环境访问限制是否生效，再将策略挂载到目标IAM用户。
• 如有额外关联服务操作需求，可按需在第三条Statement中增加对应操作权限，避免授予全服务*权限。

内容的提问来源于stack exchange，提问作者user16806482