amazon-web-services - 如何允许或阻止 aws iam 用户运行 sendCommand？

Question

我创建了一个带有 ssm 和 ec2 操作的 aws_iam_policy_document ：

data "aws_iam_policy_document" "AdminEc2Actions" {
  statement {
    effect    = "Allow"
    sid = "sid1"
    actions = [
        "ssm:SendCommand",
        "ec2:Start*",
        "ssm:StartSession"
    ]
    resources = [
      "*"
    ]    
  }   
}

# Create IAM policy for ec2
resource "aws_iam_policy" "AdminEc2Actions" {
  name                = "test-AdminEc2Actions-policies"
  description         = "ec2 policies"
  path                = "/"
  policy              = data.aws_iam_policy_document.AdminEc2Actions.json
}
# Attaches customer managed IAM poloicy to an IAM admins group 
resource "aws_iam_group_policy_attachment" "AdminEc2Actions" {
  group               = aws_iam_group.groups[0].name
  policy_arn          = aws_iam_policy.AdminEc2Actions.arn 
}

但是，由于某种原因，有时会考虑到动作的任何变化，有时会忽略。例如。当我运行这个命令时，我得到：

[[e-mail].1]$ aws s3 mv /tmp/file* s3://test-dent-backup1/daily/
move failed: ../../tmp/file1.txt to s3://test-dent-backup1/daily/file1.txt [Errno 1] Operation not permitted: '/tmp/file1.txt' 

有什么建议么？

标签： amazon-web-servicesamazon-s3amazon-ec2terraformterraform-provider-aws