amazon-web-services - 如何限制访问特定的 ssm 文档只能在特定的 ec2 实例中运行？

Question

我需要创建将有权访问自定义创建的 ssm 文档的策略，该文档只能在指定的 EC2 实例中运行。

我已经尝试过类似这样的策略，但控制要在实例上运行的文档是不够的。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2messages:DeleteMessage",
                "ec2messages:GetEndpoint",
                "ec2messages:FailMessage",
                "ec2messages:AcknowledgeMessage",
                "ec2messages:SendReply",
                "ec2messages:GetMessages"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ssm:UpdateInstanceInformation",
                "ssm:UpdateAssociationStatus",
                "ssm:ListInstanceAssociations",
                "ssm:ListAssociations",
                "ssm:UpdateInstanceAssociationStatus"
            ],
            "Resource": [
                "arn:aws:ssm:us-east-1:xxxxxxxxxx:document/xxxxxxxxxx",
                "arn:aws:ec2:us-east-1:xxxxxxxxxx:instance/*"
            ]
        }
    ]
}

这是可行的吗？

非常感谢您的帮助。谢谢