我正在使用 SCP 策略在沒有標簽時停止創建 ec2 資源（子網、安全組、實體、vpc）。我正在使用標簽策略來檢查合規標簽。
但是，一旦我在我的 scp 策略中為 vpc 添加操作和資源，我就無法創建子網、安全組。
在沒有 vpc 資源的情況下，以下 SCP 策略可以正常作業 -
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1ForProjectTag",
"Effect": "Deny",
"Action": [
"ec2:RunInstances",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"Null": {
"aws:RequestTag/project": [
"true"
]
}
}
}
]
}
此 SCP 策略正在破壞 - 即我也無法創建具有適當標簽的安全組/子網。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1ForProjectTag",
"Effect": "Deny",
"Action": [
"ec2:RunInstances",
"ec2:CreateSecurityGroup",
"ec2:CreateSubnet",
"ec2:CreateVpc"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"Null": {
"aws:RequestTag/project": [
"true"
]
}
}
}
]
}
有人可以解釋一下嗎？
uj5u.com熱心網友回復：
不建議在同一陳述句中組合不同的 Actions 和 Resource。它可能會導致意外行為或一些問題。此外，并非所有操作都適用于所有資源，您需要指定合適的操作。
因此，首先有必要將陳述句拆分為多個。然后將效果從允許更改為拒絕，并將條件更改為“StringNotEquals”。
SCP 應該與此類似：
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1ForProjectTag",
"Effect": "Deny",
"Action": [
"ec2:RunInstances"
],
"Resource": [
"arn:aws:ec2:*:*:instance/*"
],
"Condition": {
"ForAllValues:StringNotEquals": {
"aws:TagKeys": [
"project"
]
}
}
},
{
"Sid": "Statement2ForProjectTag",
"Effect": "Deny",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"ForAllValues:StringNotEquals": {
"aws:TagKeys": [
"project"
]
}
}
},
{
"Sid": "Statement3ForProjectTag",
"Effect": "Deny",
"Action": [
"ec2:CreateSubnet"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"ForAllValues:StringNotEquals": {
"aws:TagKeys": [
"project"
]
}
}
},
{
"Sid": "Statement4ForProjectTag",
"Effect": "Deny",
"Action": [
"ec2:CreateVpc"
],
"Resource": [
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"ForAllValues:StringNotEquals": {
"aws:TagKeys": [
"project"
]
}
}
}
]
}
轉載請註明出處，本文鏈接：https://www.uj5u.com/gongcheng/476136.html