- Più recenti
- Maggior numero di voti
- Maggior numero di commenti
Hello,
At this time, there isn't a way to restrict "ModifyInstanceAttribute" to specific condition or resource. The action "ModifyInstanceAttribute" does not support any resource level permissions or any condition keys.
https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonec2.html
I completely agree with you that this is a valid use case and these actions should support resource level permissions and conditions. This feature is requested by other customers as well and is a popular feature request. We are actively working on your feedback to address the issues listed in your post.
You can keep an eye on our blog[1] and news websites[2] for updates.
[1] http://aws.amazon.com/blogs/aws/
[2] http://aws.amazon.com/new/
Thanks for bringing this to our attention. Have a nice day :)
To restrict instance type change, uses the ec2:attribute service condition key as shown in the example below:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Deny",
"Action": "ec2:ModifyInstanceAttribute",
"Resource": "*",
"Condition": {
"ForAnyValue:StringNotLike": {
"ec2:Attribute/InstanceType": [
"t3.*"
]
}
}
}
]
}
References:
[1]: ec2:Attribute condition key https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#attribute-key
[2]: Multivalued context keys https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-key
Contenuto pertinente
- AWS UFFICIALEAggiornata 3 anni fa
- AWS UFFICIALEAggiornata 2 anni fa
- AWS UFFICIALEAggiornata 2 anni fa
- AWS UFFICIALEAggiornata un anno fa