AWS IAM策略。允許用戶只刪除他們創建的ec2實例

Question

如何更改策略以允許用戶只刪除他們創建的ec2實例？我從這裏的文檔中得到了一個例子。是創建標籤，並將其標記到我的實例，唯一的方法來做到這一點？謝謝！

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Action": [ 
     "ec2:StartInstances", 
     "ec2:StopInstances",  
     "ec2:RebootInstances", 
     "ec2:TerminateInstances" 
     ], 
     "Condition": { 
     "StringEquals": { 
      "ec2:ResourceTag/critical":"true" 
     } 
     }, 
     "Resource": [ 
     "arn:aws:ec2:your_region:your_account_ID:instance/*" 
     ], 
     "Effect": "Allow" 
    } 
    ] 
} 

Answer 1

只允許Action用於特定的EC2實例（資源）。

指向documentation。

實施例（ⅰ加入PUT_INSTANCE_ID_HERE）

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Action": [ 
       "ec2:StartInstances", 
       "ec2:StopInstances", 
       "ec2:RebootInstances", 
       "ec2:TerminateInstances" 
      ], 
      "Condition": { 
       "StringEquals": { 
        "ec2:ResourceTag/critical": "true" 
       } 
      }, 
      "Resource": [ 
       "arn:aws:ec2:your_region:your_account_ID:instance/PUT_INSTANCE_ID_HERE" 
      ], 
      "Effect": "Allow" 
     } 
    ] 
}