如何使用CLI启动AWS用户不超过一个实例？
我有一项策略允许用户在 AWS 账户中启动 EC2 实例，但我想限制用户只能使用一个实例？
在以下命令中，我使用 --count 关键字，但用户可以将其修改为任意数字。
aws ec2 运行实例 --image-id ami-00ee4df451840fa9d --count 1 --instance-type t2.micro --security-group-ids xxxxxxxxxxxx --key-name xxxxxxxxx --subnet-id xxxxxxxxx --profile userX --region us-west-2
有没有办法限制用户运行只有一个实例？
谢谢
I have a policy that allows the user to launch an EC2 instance in an AWS account, but I want to restrict the user to one instance only?
In the following command, I am using a --count keyword but this can be modified by the user to any number.
aws ec2 run-instances --image-id ami-00ee4df451840fa9d --count 1
--instance-type t2.micro --security-group-ids xxxxxxxxxxxx --key-name xxxxxxxxx --subnet-id xxxxxxxxx --profile userX --region us-west-2
Is there a way to restrict the user to run only one instance?
Thanks
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不可能使用IAM策略来限制IAM用户可以启动的Amazon EC2实例数量。
IAM策略确定是否允许用户提出API请求（例如
RunInstances（）），但无法查看现有资源来做出该决定。在首先检查不存在现有实例之后，您将需要创建一个“服务”，该“服务”将代表用户启动实例。例如，这可能是您编写的Web应用程序，该应用程序可以验证条件，然后代表用户启动实例。
另外，请注意，Amazon EC2实例与“用户”无关 - 它们与AWS帐户相关联。因此，您还需要一种将现有实例与IAM用户相关联的方法，例如添加标签来识别请求该实例的用户。 （确保用户无权修改此标签！）
It is not possible to use IAM Policies to restrict the quantity of Amazon EC2 instances that an IAM User can launch.
IAM Policies determine whether the user is permitted to make an API request (eg
RunInstances()), but are not able to look at existing resources to make that decision.You would need to create a 'service' that will launch instances on behalf of users, after first checking that no existing instance exists. For example, this could be a web-app that you write that verifies the conditions and then launches the instance on behalf of the user.
Also, please note that Amazon EC2 instances are not associated with 'users' -- they are associated with an AWS Account. Therefore, you would also need a means of associating existing instances with IAM Users, such as adding a Tag to identify the user who requested the instance. (Make sure that users don't have permission to modify this tag!)