亞馬遜ec2註冊未授權

Question

我想捆綁，上傳和註冊實例存儲AMI從運行的實例。當涉及到調用EC2註冊我得到的迴應：

Client.UnauthorizedOperation: You are not authorized to perform this operation. 

的實例下通過IAM角色授予的權限運行。該策略使用數據管線預設：

{ 
"Version": "2012-10-17", 
"Statement": [ 
    { 
    "Effect": "Allow", 
    "Action": [ 
    "s3:List*", 
    "s3:Put*", 
    "s3:Get*", 
    "s3:DeleteObject", 
    "dynamodb:DescribeTable", 
    "dynamodb:Scan", 
    "dynamodb:Query", 
    "dynamodb:GetItem", 
    "dynamodb:BatchGetItem", 
    "dynamodb:UpdateTable", 
    "rds:DescribeDBInstances", 
    "rds:DescribeDBSecurityGroups", 
    "redshift:DescribeClusters", 
    "redshift:DescribeClusterSecurityGroups", 
    "cloudwatch:PutMetricData", 
    "datapipeline:PollForTask", 
    "datapipeline:ReportTaskProgress", 
    "datapipeline:SetTaskStatus", 
    "datapipeline:PollForTask", 
    "datapipeline:ReportTaskRunnerHeartbeat" 
    ], 
    "Resource": [ 
    "*" 
    ]} 
]} 

我需要在這裏添加什麼來授權ec2-register運行？ ..或者我誤解了這一切是如何運作的？

Answer 1

最後的答案很簡單，只是在上面的JSON策略中將正確的字符串添加到action數組中。我也不需要與dynamodb，rds，redshift或數據管道有關的權限，所以我刪除了它們。

首先，我固定它通過改變權限要足夠寬，它的工作（在我需要的服務，S3和EC2）：

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Effect": "Allow", 
     "Action": [ 
     "s3:*", 
     "ec2:*", 
     "cloudwatch:PutMetricData" 
     ], 
     "Resource": [ 
     "*" 
     ] 
    } 
    ] 
} 

然後將範圍縮小到我想確切的命令通過用我想要調用的適當函數替換「ec2：*」中的*來進行調用。