Skip to content

Commit 306183b

Browse files
panlmpanlm
committed
add cfn-service-role guide
1 parent d2d42a6 commit 306183b

1 file changed

Lines changed: 256 additions & 0 deletions

File tree

‎docs/others/cfn-service-role-for-fis-experiment-setup-guide.md‎

Lines changed: 256 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,256 @@
1+
---
2+
title: cfn-service-role-for-fis-experiment-setup-guide
3+
description: 使用cloudformation服务角色实现最小化权限
4+
type: note
5+
permalink: git-mkdocs/others/cfn-service-role-for-fis-experiment-setup-guide
6+
share_link: https://notes-share.aws.panlm.click/3qvt83ae
7+
share_updated: 2026-04-02T20:04:26+08:00
8+
---
9+
10+
# FIS 实验环境权限配置指南
11+
12+
> **目的：** 为 EC2 实例配置最小权限，使其能通过 CloudFormation 部署 FIS 实验相关资源（IAM Role、FIS 实验模板、CloudWatch Dashboard），而 EC2 自身无需拥有 IAM/FIS/CloudWatch 写入权限。
13+
>
14+
> **原理：** 采用 [CloudFormation Service Role](https://docs.aws.amazon.com/prescriptive-guidance/latest/least-privilege-cloudformation/service-roles-for-cloudformation.html) 模式，将资源创建权限委托给 CFN Service Role，EC2 只需 `iam:PassRole` 将该角色传递给 CloudFormation。
15+
16+
---
17+
18+
## 架构说明
19+
20+
```
21+
EC2 Instance Profile CFN Service Role
22+
┌─────────────────────┐ ┌──────────────────────────────┐
23+
│ - cloudformation:* │ --PassRole--> │ Trust: cloudformation.amazonaws.com │
24+
│ - iam:PassRole │ │ - iam:CreateRole/DeleteRole │
25+
│ - 只读权限 (已有) │ │ - fis:Create/DeleteTemplate │
26+
│ │ │ - cloudwatch:Put/Delete │
27+
└─────────────────────┘ └──────────────────────────────┘
28+
```
29+
30+
---
31+
32+
## 一、CFN Service Role（需管理员创建，一次性）
33+
34+
### 1.1 信任策略（Trust Policy）
35+
36+
只允许 CloudFormation 服务 assume 此角色：
37+
38+
```json
39+
{
40+
"Version": "2012-10-17",
41+
"Statement": [
42+
{
43+
"Effect": "Allow",
44+
"Principal": {
45+
"Service": "cloudformation.amazonaws.com"
46+
},
47+
"Action": "sts:AssumeRole"
48+
}
49+
]
50+
}
51+
```
52+
53+
### 1.2 权限策略（Permissions Policy）
54+
55+
此策略授予 CloudFormation 创建 FIS 实验所需的所有资源权限，通过资源名称前缀限制作用范围：
56+
57+
```json
58+
{
59+
"Version": "2012-10-17",
60+
"Statement": [
61+
{
62+
"Sid": "IAMRoleManagement",
63+
"Effect": "Allow",
64+
"Action": [
65+
"iam:CreateRole",
66+
"iam:DeleteRole",
67+
"iam:GetRole",
68+
"iam:PutRolePolicy",
69+
"iam:DeleteRolePolicy",
70+
"iam:GetRolePolicy",
71+
"iam:TagRole",
72+
"iam:UntagRole"
73+
],
74+
"Resource": "arn:aws:iam::123456789012:role/*"
75+
},
76+
{
77+
"Sid": "IAMPassRoleToFIS",
78+
"Effect": "Allow",
79+
"Action": "iam:PassRole",
80+
"Resource": "arn:aws:iam::123456789012:role/*",
81+
"Condition": {
82+
"StringEquals": {
83+
"iam:PassedToService": "fis.amazonaws.com"
84+
}
85+
}
86+
},
87+
{
88+
"Sid": "FISFullAccess",
89+
"Effect": "Allow",
90+
"Action": "fis:*",
91+
"Resource": "*"
92+
},
93+
{
94+
"Sid": "CloudWatchFullAccess",
95+
"Effect": "Allow",
96+
"Action": "cloudwatch:*",
97+
"Resource": "*"
98+
}
99+
]
100+
}
101+
```
102+
103+
### 1.3 创建命令
104+
105+
```bash
106+
# 1. 创建角色
107+
aws iam create-role \
108+
--role-name CFN-ServiceRole-FIS \
109+
--assume-role-policy-document '{
110+
"Version": "2012-10-17",
111+
"Statement": [{
112+
"Effect": "Allow",
113+
"Principal": {"Service": "cloudformation.amazonaws.com"},
114+
"Action": "sts:AssumeRole"
115+
}]
116+
}' \
117+
--description "CloudFormation Service Role for FIS experiment deployment"
118+
119+
# 2. 附加权限策略（将上面 1.2 的 JSON 保存为 cfn-service-role-policy.json）
120+
aws iam put-role-policy \
121+
--role-name CFN-ServiceRole-FIS \
122+
--policy-name FISDeploymentPolicy \
123+
--policy-document file://cfn-service-role-policy.json
124+
```
125+
126+
---
127+
128+
## 二、EC2 Instance Profile 附加策略
129+
130+
以下策略需要附加到 EC2 实例的 Instance Profile 角色上。EC2 已有的只读权限保持不变，仅需**额外添加**此策略：
131+
132+
> **注意：** `cloudformation:RoleArn` 条件键仅对 `CreateStack`/`UpdateStack`/`DeleteStack` 有效，
133+
> `CreateChangeSet`/`ExecuteChangeSet` 等操作不支持此条件键，因此需要拆分为两个 Statement。
134+
> `CreateStack`/`UpdateStack`/`DeleteStack` 通过条件键强制必须使用指定的 Service Role，
135+
> 而 ChangeSet 操作本身不会直接创建资源（资源创建由关联的 Stack 操作完成，受条件键约束）。
136+
137+
```json
138+
{
139+
"Version": "2012-10-17",
140+
"Statement": [
141+
{
142+
"Sid": "CloudFormationWithRoleCondition",
143+
"Effect": "Allow",
144+
"Action": [
145+
"cloudformation:CreateStack",
146+
"cloudformation:UpdateStack",
147+
"cloudformation:DeleteStack"
148+
],
149+
"Resource": "arn:aws:cloudformation:us-west-2:123456789012:stack/*/*",
150+
"Condition": {
151+
"StringEquals": {
152+
"cloudformation:RoleArn": "arn:aws:iam::123456789012:role/CFN-ServiceRole-FIS"
153+
}
154+
}
155+
},
156+
{
157+
"Sid": "CloudFormationChangeSetAndDescribe",
158+
"Effect": "Allow",
159+
"Action": [
160+
"cloudformation:CreateChangeSet",
161+
"cloudformation:ExecuteChangeSet",
162+
"cloudformation:DeleteChangeSet",
163+
"cloudformation:DescribeStacks",
164+
"cloudformation:DescribeStackEvents",
165+
"cloudformation:DescribeChangeSet",
166+
"cloudformation:GetTemplate",
167+
"cloudformation:ListStacks"
168+
],
169+
"Resource": "arn:aws:cloudformation:us-west-2:123456789012:stack/*/*"
170+
},
171+
{
172+
"Sid": "CloudFormationValidateAny",
173+
"Effect": "Allow",
174+
"Action": "cloudformation:ValidateTemplate",
175+
"Resource": "*"
176+
},
177+
{
178+
"Sid": "PassCFNServiceRole",
179+
"Effect": "Allow",
180+
"Action": "iam:PassRole",
181+
"Resource": "arn:aws:iam::123456789012:role/CFN-ServiceRole-FIS",
182+
"Condition": {
183+
"StringEquals": {
184+
"iam:PassedToService": "cloudformation.amazonaws.com"
185+
}
186+
}
187+
},
188+
{
189+
"Sid": "FISExperimentExecution",
190+
"Effect": "Allow",
191+
"Action": [
192+
"fis:StartExperiment",
193+
"fis:StopExperiment",
194+
"fis:GetExperiment",
195+
"fis:ListExperiments"
196+
],
197+
"Resource": "*"
198+
}
199+
]
200+
}
201+
```
202+
203+
### 附加命令
204+
205+
```bash
206+
# 将上面的 JSON 保存为 ec2-fis-cfn-policy.json，然后附加到 EC2 Instance Profile 的角色上
207+
# 替换 <EC2_ROLE_NAME> 为实际的 EC2 Instance Profile 角色名
208+
209+
aws iam put-role-policy \
210+
--role-name <EC2_ROLE_NAME> \
211+
--policy-name FIS-CloudFormation-Access \
212+
--policy-document file://ec2-fis-cfn-policy.json
213+
```
214+
215+
---
216+
217+
## 三、使用方式
218+
219+
管理员完成上述配置后，EC2 上部署 FIS 实验时需在 `aws cloudformation deploy` 命令中指定 `--role-arn`：
220+
221+
```bash
222+
aws cloudformation deploy \
223+
--template-file cfn-template.yaml \
224+
--stack-name fis-rds-reboot-demo-mysql-xxxxx \
225+
--role-arn arn:aws:iam::123456789012:role/CFN-ServiceRole-FIS \
226+
--capabilities CAPABILITY_NAMED_IAM \
227+
--region us-west-2
228+
```
229+
230+
---
231+
232+
## 四、安全约束总结
233+
234+
| 约束项 | 实现方式 |
235+
|-------|---------|
236+
| EC2 无 IAM/CloudWatch 写入权限 | 所有 IAM/CW 操作由 CFN Service Role 执行 |
237+
| EC2 可直接执行 FIS 实验 | `fis:StartExperiment`/`StopExperiment` 等执行权限 |
238+
| EC2 只能用指定的 Service Role 部署 | `cloudformation:RoleArn` 条件键限制 |
239+
| CFN Service Role 只能创建 FIS 相关角色 | IAM 资源 ARN 限定 `*` |
240+
| CFN Service Role 只能被 CloudFormation 使用 | 信任策略仅允许 `cloudformation.amazonaws.com` |
241+
| CloudWatch 完全访问 | CFN Service Role 附加 `cloudwatch:*` |
242+
243+
---
244+
245+
## 五、清理
246+
247+
如需撤销此配置：
248+
249+
```bash
250+
# 1. 删除 EC2 上的附加策略
251+
aws iam delete-role-policy --role-name <EC2_ROLE_NAME> --policy-name FIS-CloudFormation-Access
252+
253+
# 2. 删除 CFN Service Role
254+
aws iam delete-role-policy --role-name CFN-ServiceRole-FIS --policy-name FISDeploymentPolicy
255+
aws iam delete-role --role-name CFN-ServiceRole-FIS
256+
```

0 commit comments

Comments
 (0)