botocore.exceptions.ClientError: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation

Question

我正在尝试通过匹配 EC2 实例中添加的特定标签来过滤掉 AWS 中的实例。为此，我创建了具有以下有限权限的新 IAM 角色：-

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:StopInstances"
            ],
            "Resource": [
                "arn:aws:ec2:<aws-region>:<aws-id>:instance/*"
            ],
            "Condition":{
                "StringLike":{
                    "aws:ResourceTag/Name" : ["sample_type_*"]
                }
            }
        }
    ]
}

我在 boto3 中阅读了 collections 并实现了以下过滤函数来查找实例：-

ec2 = boto3.resource('ec2')
instance_name_prefix = "sample_type_"
filter_list = [
            {"Name": "tag:Name", "Values": [f"{instance_name_prefix}*"]},
            {"Name": "instance-state-name", "Values": ["running"]}
        ]
running_instance_list = ec2.instances.filter(Filters=filter_list)

但这会引发以下错误：-

botocore.exceptions.ClientError: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.

我试图在 AWS docs 中寻找 DescribeInstances 的相关操作，其中显示它不依赖于其他操作。

谁能指出哪里错了？对此有任何提示将不胜感激。

谢谢

Answer 1

大多数上市操作要么允许要么不允许，没有中间地带，也没有可以评估的条件。与列出的资源进行交互显然取决于进一步的 IAM 权限，而不是列表本身。

这里就是这种情况。除了 ec2:Region.

之外，ec2:DescribeInstances 不能被 Conditions 限制

botocore.exceptions.ClientError: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation

botocore.exceptions.ClientError: An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation

amazon-ec2

amazon-web-services

amazon-iam

boto3