未经授权从共享私有 AMI 运行 ec2 实例

Question

I created AMI on account 183136277722. I shared it to account 574616038232. I've created iam policy to be able to run this AMI:

            "Condition": {
                "StringEquals": {
                    "ec2:Owner": [
                        "183136277722"
                    ]
                }
            },
            "Action": [
                "ec2:RunInstances"
            ],
            "Resource": "arn:aws:ec2:eu-west-1::image/ami-*",
            "Effect": "Allow",
            "Sid": "RunSharedAmi"
        }

When I try to launch ec2 from AMI when I'm logged in account 574616038232 I get error message:

An error occurred (UnauthorizedOperation) when calling the RunInstances operation: You are not authorized to perform this operation. Encoded authorization failure message: Eq8rCjogNsPD8Rw45V5f7XHeFSTJ8ddXbHdtpWw7AJnEeGMVuOtk1VBe-Z1fR3ONRjcxcJEafrwaVZdyeUjw-ZNGwmDjDN3DyEysimEMNX9TQhcEhaIpUBpSrBXZutEb6cR1n5JVNak9zrcJRiuQhkJybpsPFE80epCoXJlIakq2kYk8uS8no2p28ujo0dLi4GJ63Dlq32zReA338ksB1quGfKX7HVultbfdnOAPkKih_A3HjEs59yMpZZ-l0ngtcLL6yzAcxhocQPe15nyu9S96I-8uI9hmR7HnEE24Aa9qJaj0ZiT57NFckkhVojsWmmsN8XWh02g8P1gSfyyHfPmFj9E2khxGZ9Vvc-oglx6gKbU7XHzlsOygouTD8uNutQS7OFaK_8TIKmAgYHP-CQ_AFk-X1zAbYMhs9TNt3pOu5Gz1xYKnrYUWQetf6gWmyVsQ6ioFMW9fKfFjLPrtQMtLtXqtYuteHSXt6LAWH4ZN5yJOWbHiC9ymoV05GG1UjsrNxlCU5KuS8Nhewfwefefewfwefwefewqwdwd34r23fdsacf23fv32HawKZF0bX-uXLJVSGsAV5MOk1zw6k3_Gwi7Y-ZY-1b7kmGMhYy9rjMLJvw8Q6NjOgQuHyfpeFTodgsX4A0kEuuQMf2hBcaAYCGJbHXnHGh0-5ZMHvinGNbfKtLw7gW_Hb1pmR0ujVDM2GDcdglOu99fT79zWaO9wt1jrzCUgiieIjrQhlEiaQI3uQf5idoGOovpT4EM5wR3vOIDchZqCZozndA8I-lSYS7X3wrFK0EhNq1h_X1mqSVoYUKsUVrgO6XtU2NSpeDsbEVlpjRBb4MOfDSgPumVDM_AlYnil67kFq7fv8aWVzD8cLBmYVDdKjpzrIbxDM2n04q0sAvygQbGForj791uF8SksMM-2J0N7ue5JbtbCbOsVZS9HKOMq5fOAk41wUSL5LuFQKUBEDs3vaHqzh7BUQ3vt4P7CTGsG8Vyp3yva-vd8S0HE1y0zuSTsv65XnqVSQDyZ_ZAEm6cqyBdwz2L3ZGO-_HV_AH

I decoded message and get

{ "DecodedMessage": "{"allowed":false,"explicitDeny":true,"matchedStatements":{"items":[{"statementId":"AllowLaunchOnlyFromApprovedImages","effect":"DENY","principals":{"items":[{"value":"AROCDLSOI5ZZM7QIFOITO"}]},"principalGroups":{"items":[]},"actions":{"items":[{"value":"ec2:RunInstances"}]},"resources":{"items":[{"value":"arn:aws:ec2:eu-west-1::image/ami-*"}]},"conditions":{"items":[{"key":"ec2:Owner","values":{"items":[{"value":"277688789493"},{"value":"amazon"},{"value":"aws-marketplace"},{"value":"737859062117"},{"value":"394136139437"},{"value":"851093456999"},{"value":"335031091084"},{"value":"207456136159"},{"value":"028557712108"},{"value":"164996153968"},{"value":"533600275369"},{"value":"930136447543"},{"value":"658312218119"},{"value":"687831498517"},{"value":"201245860548"},{"value":"574616038232"},{"value":"493917785438"},{"value":"378058653094"},{"value":"901455435209"},{"value":"652668783151"},{"value":"988201728534"},{"value":"669990426999"},{"value":"142986109290"}, {"value":"679593333241"},{"value":"309956199498"},{"value":"602401143452"},{"value":"379101102735"},{"value":"504948279284"},{"value":"951854665038"}]}}]}}]},"failures":{"items":[]},"context":{"principal":{"id":"AROCDLSOI5ZZM7QIFOITO:503217544","arn":"arn:aws:sts::574616038232:assumed-role/hc-mobil-devops/503217544"},"action":"ec2:RunInstances","resource":"arn:aws:ec2:eu-west-1::image/ami-088a17ca0987e0186","conditions":{"items":[{"key":"ec2:ImageID","values":{"items":[{"value":"ami-088a17ca0987e0186"}]}},{"key":"ec2:ImageType","values":{"items":[{"value":"machine"}]}},{"key":"aws:Resource","values":{"items":[{"value":"image/ami-088a17ca0987e0186"}]}},{"key":"aws:Account","values":{"items":[{"value":"574616038232"}]}},{"key":"ec2:IsLaunchTemplateResource","values":{"items":[{"value":"false"}]}},{"key":"ec2:RootDeviceType","values":{"items":[{"value":"ebs"}]}},{"key":"aws:Region","values":{"items":[{"value":"eu-west-1"}]}},{"key":"aws:Service","values":{"items":[{"value":"ec2"}]}},{"key ":"ec2:Owner","values":{"items":[{"value":"183136277722"}]}},{"key":"ec2:Public","values":{"items":[{"value":"false"}]}},{"key":"aws:Type","values":{"items":[{"value":"image"}]}},{"key":"ec2:Region","values":{"items":[{"value":"eu-west-1"}]}},{"key":"aws:ARN","values":{"items":[{"value":"arn:aws:ec2:eu-west-1::image/ami-088a17ca0987e0186"}]}}]}}}"

Why it doesn't work? Did I miss some policies/permissions?

Answer 1

As per the decoded message there are SCPs explicitDeny":true,"matchedStatements":{"items":[{"statementId":"**AllowLaunchOnlyFromApprovedImages**","effect":"DENY at Organization level enforced and a cause of your denial.

Answer 2

You need to grant access to more Resources to allow the ec2:RunInstances call to succeed. Here is a helpful post with a minimal policy: Minimal IAM policy for ec2:RunInstances