对托管实例应用限制的 AWS IAM 策略 — ARN 无效？

Question

I'm facing some very weird issues when it comes to policies and managed instances. For example, one of my users is getting this error:

User: arn:aws:iam::708332864XX:user/XXXX is not authorized to perform: ssm:StartSession on resource: arn:aws:ssm:us-east-2:708332864XX:managed-instance/mi-055c2be5596fXXXXX

However, when looking at the policies, I don't have the ability to select a managed-instance as a resource:

If I try to just simply replace instance with managed-instance , then it says the ARN is invalid:

How would I give a user ssm:StartSession permission on managed instances then in this case? The following policy does nothing:

        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ssm:TerminateSession",
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws:ssm:us-east-2:708332864587:managed-instance/*"
            ]
        }

Apparently this doesn't do anything:

Answer 1

TLDR; I would suggest to use the instance ARN instead. I would also verify that your role have access to all documents or at least to SSM-SessionManagerRunShell .

The long explanation:

If you read about StartSession in https://docs.aws.amazon.com/service-authorization/latest/reference/list_awssystemsmanager.html you can learn that for StartSession you have in the Resrouce column three different Resource types

Actions	Description	Access Level	Resource
StartSession	Grants permission to initiate a connection to a specified target for a Session Manager session	write	document instance task

Each of them has a different ARN structure:

document - arn:${Partition}:ssm:${Region}:${Account}:document/${DocumentName}
instance - arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId} 
task - arn:${Partition}:ecs:${Region}:${Account}:task/${TaskId}

You can put any other ARNs in the rule, but they will have no effect. But in one they or other the user need access to all the required resources.

For example (mentioned in the other answer as well): In your question you have

aws:arn: ec2 :.....: managed-instance with quote: "If I try to just simply replace instance with managed-instance, then it says the ARN is invalid". Yes, because it is. You cannot just combine the parts of ARNs randomly. Valid ARNs are only the documented ones: https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html

When you describe your "managed instance" you should see in it an id of an EC2 instance. This is the only instance which does exist. The ssm "managed instance" is a structure which stores only the ssm-related data for that particular EC2 instance.

`

If you read the example policy in the AWS documentation for StartSession you see there:

https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started-restrict-access-quickstart.html

So you you need to figure out how to get the ec2 instance id from the managed instance id like for example with

https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws:ec2:region:987654321098:instance/i-02573cafcfEXAMPLE",
                "arn:aws:ssm:region:account-id:document/SSM-SessionManagerRunShell" 
            ],
            "Condition": {
                "BoolIfExists": {
                    "ssm:SessionDocumentAccessCheck": "true" 
                }
            }
        },

--cut--

Keep in mind that in AWS you may not be able to limit access per resource level for all services. That's especially for newer services. Or you may not be able to do it easily. For example you can create a lambda function which will start your ec2 instance and will create a policy for it (I don't say that you should do it that way, but it is possible).

Sometimes you can use conditions or you can use PassRole/AssumeRole mechanism to allow access to the resource by a mechanism which is outside of the IAM service. You may need to be creative and/or sometimes compromise.

Answer 2

Notice how the managed instance ARN is for the arn:aws:ssm namespace:

arn:aws:ssm:us-east-2:708332864XX:managed-instance/mi-055c2be5596fXXXXX

You are trying to add permission for the arn:aws:ec2 namespace, which is why it isn't working.