如何编写AWS IAM策略，允许创建S3等资源且仅可删除带指定标签的资源

方案1：仅允许删除带有指定标签的资源 #

该策略允许用户正常创建S3存储桶、子网、Lambda函数，删除操作仅对带有指定标签的资源生效，示例中配置为仅可删除标签ResourceType=ExampleBucket的资源，可根据实际需求修改标签键与值。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCreateResources",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:PutBucketTagging",
                "s3:GetBucketTagging",
                "ec2:CreateSubnet",
                "ec2:CreateTags",
                "ec2:DescribeTags",
                "lambda:CreateFunction",
                "lambda:TagResource",
                "lambda:GetFunction"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowDeleteBySpecifiedTag",
            "Effect": "Allow",
            "Action": [
                "s3:DeleteBucket",
                "ec2:DeleteSubnet",
                "lambda:DeleteFunction"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/ResourceType": "ExampleBucket"
                }
            }
        }
    ]
}

如果不同资源需要匹配不同的指定标签，可拆分AllowDeleteBySpecifiedTag为多个独立Statement，分别配置对应Action和标签条件即可。

方案2：仅允许删除用户自身创建的资源 #

该策略强制用户创建资源时必须添加CreatedBy标签，值为当前用户名，删除时仅允许删除CreatedBy标签与当前用户名一致的资源，实现只能删除自己创建的资源的限制。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCreateResourcesWithCreatorTag",
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:PutBucketTagging",
                "s3:GetBucketTagging",
                "ec2:CreateSubnet",
                "ec2:CreateTags",
                "ec2:DescribeTags",
                "lambda:CreateFunction",
                "lambda:TagResource",
                "lambda:GetFunction"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/CreatedBy": "${aws:username}"
                }
            }
        },
        {
            "Sid": "AllowDeleteSelfCreatedResources",
            "Effect": "Allow",
            "Action": [
                "s3:DeleteBucket",
                "ec2:DeleteSubnet",
                "lambda:DeleteFunction"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/CreatedBy": "${aws:username}"
                }
            }
        }
    ]
}

如果需要避免用户手动填写CreatedBy标签，可搭配AWS Organizations标签策略或者资源创建触发器自动注入标签，无需用户手动操作。

内容的提问来源于stack exchange，提问作者user16759593