添加VPC资源时，SCP突然行为

Question

我正在使用SCP策略在没有标签时停止EC2资源（子网，安全组，实例，VPC）创建。我正在使用标签策略检查合规标签。

但是，一旦我在SCP策略中添加了VPC的动作和资源，我就无法创建子网，安全组。

在没有VPC资源的情况下，SCP策略在下面的工作正常 -

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1ForProjectTag",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:CreateSecurityGroup",
        "ec2:CreateSubnet"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:subnet/*"
      ],
     "Condition": {
        "Null": {
          "aws:RequestTag/project": [
            "true"
          ]
        }
      }
    }
  ]
}

此SCP策略正在破坏 - 即我无法使用适当的标签ASLO创建安全组/子网。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1ForProjectTag",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "ec2:CreateSecurityGroup",
        "ec2:CreateSubnet",
        "ec2:CreateVpc"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*",
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:subnet/*",
        "arn:aws:ec2:*:*:vpc/*"
      ],
     "Condition": {
        "Null": {
          "aws:RequestTag/project": [
            "true"
          ]
        }
      }
    }
  ]
}

有人可以阐明这一点吗？

Answer 1

在同一语句中将不同的动作和资源结合起来不建议。它可能导致意外的行为或某些问题。另外，并非所有动作都适用于所有资源您需要指定合适的一个。

因此，首先有必要将语句分为多个语句。然后将效果从允许拒绝和条件更改为“字符串notequals”。

SCP应该与此相似：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1ForProjectTag",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:instance/*"
      ],
      "Condition": {
        "ForAllValues:StringNotEquals": {
          "aws:TagKeys": [
            "project"
          ]
        }
      }
    },
    {
      "Sid": "Statement2ForProjectTag",
      "Effect": "Deny",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "ForAllValues:StringNotEquals": {
          "aws:TagKeys": [
            "project"
          ]
        }
      }
    },
    {
      "Sid": "Statement3ForProjectTag",
      "Effect": "Deny",
      "Action": [
        "ec2:CreateSubnet"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:subnet/*"
      ],
      "Condition": {
        "ForAllValues:StringNotEquals": {
          "aws:TagKeys": [
            "project"
          ]
        }
      }
    },
    {
      "Sid": "Statement4ForProjectTag",
      "Effect": "Deny",
      "Action": [
        "ec2:CreateVpc"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:vpc/*"
      ],
      "Condition": {
        "ForAllValues:StringNotEquals": {
          "aws:TagKeys": [
            "project"
          ]
        }
      }
    }
  ]
}