当使用ssh密钥访问多个用户来访问EC2实例时,有没有办法避免共享密钥。这可以通过以下任何方法来实现吗?IAM资源对此有帮助吗?
以下是我到目前为止实现的terraform代码:
provider "aws" {
access_key = ""
secret_key = ""
region = "eu-north-1"
}
resource "aws_instance" "new" {
# ...instance configuration...
ami = "ami-4bd45f35"
availability_zone = "eu-north-1b"
ebs_optimized = true
instance_type = "t3.medium"
monitoring = false
key_name = "new"
subnet_id = "subnet-5af3f122"
vpc_security_group_ids = ["sg-0a4f03bc2ee1fda8b"]
associate_public_ip_address = true
private_ip = "172.16.1.101"
source_dest_check = true
root_block_device {
volume_type = "gp2"
volume_size = 8
delete_on_termination = true
}
}
resource "aws_iam_user" "lb" {
name = "loadbalancer"
path = "/system/"
tags = {
tag-key = "tag-value"
}
}
resource "aws_iam_access_key" "lb" {
user = "${aws_iam_user.lb.name}"
}
resource "aws_iam_user_policy" "lb_ro" {
name = "test"
user = "${aws_iam_user.lb.name}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:Describe*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
}
发布于 2019-07-10 11:11:17
我建议使用EC2 Instance Connect来简化对实例的访问。
引用自文档:
通过EC2实例连接,您可以使用亚马逊网络服务身份和访问管理(IAM)策略控制对实例的EC2访问,以及使用亚马逊网络服务CloudTrail事件审核连接请求。此外,您可以利用现有的SSH密钥,或通过在每次授权用户连接时生成一次性使用SSH密钥来进一步增强您的安全状态。实例连接适用于任何SSH客户端,或者您可以在EC2控制台中通过新的基于浏览器的SSH体验轻松连接到您的实例。
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Connect-using-EC2-Instance-Connect.html
https://stackoverflow.com/questions/56969125
复制