Question:
I can launch ec2-instance with iam-role in management console.
But I have no idea how to launch ec2-instance with iam-role from aws-ruby-sdk
|
1 2 3 4 5 |
iam-role " test"'s Policy is here "Effect": "Allow", "Action": "*", "Resource": "*" |
Here is the result:
|
1 2 3 4 |
/var/lib/gems/1.8/gems/aws-sdk-1.7.1/lib/aws/core/client.rb:318:in `return_or_raise': You are not authorized to perform iam:PassRole with arn:aws:iam::xxxxxxxxxxx:role/test (AWS::EC2::Errors::UnauthorizedOperation) |
Answer:
The credentials you are using from your Ruby script do not have permission to launch an instance using the ‘test’ IAM Role. You need to modify the policy for this user, and grant it the IAM:PassRole permission, e.g.:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 |
{ "Statement": [{ "Effect":"Allow", "Action":"ec2:RunInstances", "Resource":"*" }, { "Effect":"Allow", "Action":"iam:PassRole", "Resource":"arn:aws:iam::xxxxxxxxxxx:role/test" }] } |
This is a security feature – it is possible to misconfigure IAM to allow privilege escalations, so AWS uses a “secure by default” policy.
You could also use this policy to allow your users to launch instances using any IAM role – but you should consider the security implications before doing this:
|
1 2 3 4 5 6 |
{ "Effect":"Allow", "Action":"iam:PassRole", "Resource":"*" }] |
Ref: http://docs.amazonwebservices.com/IAM/latest/UserGuide/role-usecase-ec2app.html