Elastic Beanstalk：允许用户部署

Posted 2023-03-04

【中文标题】Elastic Beanstalk：允许用户部署

【英文标题】：Elastic Beanstalk: allow user to deploy

【发布时间】：2016-10-17 02:11:12

【问题描述】：

我不知道如何让我公司中的其他人使用 AWS Elastic Beanstalk 部署到（测试）服务器。

此页面仅建议对 ELB 进行全局权限控制：http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.iam.managed-policies.html

【问题讨论】：

您想将其限制在特定的 beanstalk 应用程序中吗？

是的，针对特定应用程序和特定环境。找不到方法。

似乎有人已经在 github 上分享了它。 gist.github.com/magnetikonline/5034bdbb049181a96ac9

看起来很有希望，谢谢。会试试的。

【参考方案1】：

标题为 Using IAM to secure Elastic Beanstalk Applications on AWS 的 Rhys Godfrey 博客文章提供了一些很好的指导。

我们有一个 Elastic Beanstalk 应用程序和一组用户。这 用户组应该能够监控和部署到只有那个 弹性beantalk环境，以及重新启动或终止 应用实例。他们不应该改变 应用程序或环境配置，或删除环境。 用户不应影响其他应用程序或 AWS 服务，但他们可以看到其他领域的详细信息。 我们假设用户将使用 AWS 控制台。

我已在此处重新发布 IAM 政策以供参考。

他的方法的好处是它通过引用实例 EG Environment=testing 上的 EC2 标记来考虑应用程序环境，这是您在用例中需要的。

  
   "Version":"2012-10-17",
   "Statement":[  
        
         "Sid":"ElasticBeanstalkEnvironmentPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:DescribeEnvironmentResources",
            "elasticbeanstalk:DescribeEnvironments",
            "elasticbeanstalk:DescribeEvents",
            "elasticbeanstalk:RestartAppServer",
            "elasticbeanstalk:RetrieveEnvironmentInfo",
            "elasticbeanstalk:SwapEnvironmentCNAMEs",
            "elasticbeanstalk:UpdateEnvironment",
            "elasticbeanstalk:RequestEnvironmentInfo"
         ],
         "Resource":[  
            "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:environment/ApplicationName/*"
         ]
      ,
        
         "Sid":"ElasticBeanstalkGlobalPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:DescribeConfigurationOptions",
            "elasticbeanstalk:DescribeConfigurationSettings",
            "elasticbeanstalk:ListAvailableSolutionStacks",
            "elasticbeanstalk:ValidateConfigurationSettings",
            "elasticbeanstalk:CheckDNSAvailability",
            "elasticbeanstalk:CreateStorageLocation"
         ],
         "Resource":[  
            "*"
         ]
      ,
        
         "Sid":"ElasticBeanstalkApplicationVersionPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:CreateApplicationVersion",
            "elasticbeanstalk:DescribeApplicationVersions",
            "elasticbeanstalk:UpdateApplicationVersion"
         ],
         "Resource":[  
            "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:applicationversion/ApplicationName/*"
         ]
      ,
        
         "Sid":"ElasticBeanstalkApplicationPermissions",
         "Effect":"Allow",
         "Action":[  
            "elasticbeanstalk:DescribeApplications",
            "elasticbeanstalk:UpdateApplication"
         ],
         "Resource":[  
            "arn:aws:elasticbeanstalk:eu-west-1:123xxxxxxxxx:application/ApplicationName"
         ]
      ,
        
         "Sid":"Autoscaling",
         "Effect":"Allow",
         "Action":[  
            "autoscaling:SuspendProcesses",
            "autoscaling:Describe*",
            "autoscaling:ResumeProcesses"
         ],
         "Resource":"*"
      ,
        
         "Sid":"Cloudwatch",
         "Effect":"Allow",
         "Action":[  
            "cloudwatch:Describe*",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:ListMetrics"
         ],
         "Resource":"*"
      ,
        
         "Sid":"Cloudformation",
         "Effect":"Allow",
         "Action":[  
            "cloudformation:GetTemplate",
            "cloudformation:Describe*"
         ],
         "Resource":"*"
      ,
        
         "Sid":"IAM",
         "Effect":"Allow",
         "Action":[  
            "iam:ListServerCertificates",
            "iam:ListInstanceProfiles"
         ],
         "Resource":"*"
      ,
        
         "Sid":"S3ElasticBeanstalkBucket",
         "Action":[  
            "s3:AbortMultipartUpload",
            "s3:GetBucketAcl",
            "s3:GetBucketCORS",
            "s3:GetBucketLocation",
            "s3:GetBucketLogging",
            "s3:GetBucketNotification",
            "s3:GetBucketPolicy",
            "s3:GetBucketRequestPayment",
            "s3:GetBucketTagging",
            "s3:GetBucketVersioning",
            "s3:GetBucketWebsite",
            "s3:GetLifecycleConfiguration",
            "s3:GetObject",
            "s3:GetObjectAcl",
            "s3:GetObjectTorrent",
            "s3:GetObjectVersion",
            "s3:GetObjectVersionAcl",
            "s3:GetObjectVersionTorrent",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:ListBucket",
            "s3:GetObject",
            "s3:DeleteObject"
         ],
         "Effect":"Allow",
         "Resource":[  
            "arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx",
            "arn:aws:s3:::elasticbeanstalk-eu-west-1-123xxxxxxxxx/*"
         ]
      ,
        
         "Sid":"S3Global",
         "Effect":"Allow",
         "Action":"s3:ListAllMyBuckets",
         "Resource":"arn:aws:s3:::*"
      ,
        
         "Sid":"S3ElasticBeanstalkShared",
         "Effect":"Allow",
         "Action":"s3:*",
         "Resource":[  
            "arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1",
            "arn:aws:s3:::elasticbeanstalk-env-resources-eu-west-1/*"
         ]
      ,
        
         "Sid":"EC2Global",
         "Effect":"Allow",
         "Action":[  
            "ec2:Describe*"
         ],
         "Resource":[  
            "*"
         ]
      
   ]

第二个 IAM 策略处理给定环境的 EC2 实例：

  
   "Version":"2012-10-17",
   "Statement":[  
        
         "Sid":"EC2EnvironmentInstances",
         "Effect":"Allow",
         "Action":[  
            "ec2:MonitorInstances",
            "ec2:UnmonitorInstances",
            "ec2:RebootInstances",
            "ec2:StopInstances"
         ],
         "Resource":[  
            "arn:aws:ec2:eu-west-1:123xxxxxxxxx:instance/*"
         ],
         "Condition":  
            "StringEquals":  
               "ec2:ResourceTag/elasticbeanstalk:environment-name":"EnvironmentName"
            
         
      
   ]