AWS IAM策略。允许用户只删除他们创建的ec2实例

Question

如何更改策略以允许用户只删除他们创建的ec2实例？我从这里的文档中得到了一个例子。是创建标签，并将其标记到我的实例，唯一的方法来做到这一点？谢谢！

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
    { 
     "Action": [ 
     "ec2:StartInstances", 
     "ec2:StopInstances",  
     "ec2:RebootInstances", 
     "ec2:TerminateInstances" 
     ], 
     "Condition": { 
     "StringEquals": { 
      "ec2:ResourceTag/critical":"true" 
     } 
     }, 
     "Resource": [ 
     "arn:aws:ec2:your_region:your_account_ID:instance/*" 
     ], 
     "Effect": "Allow" 
    } 
    ] 
} 

Answer 1

只允许Action用于特定的EC2实例（资源）。

指向documentation。

实施例（ⅰ加入PUT_INSTANCE_ID_HERE）

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
     { 
      "Action": [ 
       "ec2:StartInstances", 
       "ec2:StopInstances", 
       "ec2:RebootInstances", 
       "ec2:TerminateInstances" 
      ], 
      "Condition": { 
       "StringEquals": { 
        "ec2:ResourceTag/critical": "true" 
       } 
      }, 
      "Resource": [ 
       "arn:aws:ec2:your_region:your_account_ID:instance/PUT_INSTANCE_ID_HERE" 
      ], 
      "Effect": "Allow" 
     } 
    ] 
}