访问 AppStream 2.0 资源所需的 AWS 托管策略

要提供对 AppStream 2.0 的完全管理或只读访问权限，必须将以下一项 AWS 托管策略附加到需要这些权限的 IAM 用户或组。AWS 托管策略 是由 AWS 创建和管理的独立策略。有关更多信息，请参阅《IAM 用户指南》中的 AWS 托管策略。

AmazonAppStreamFullAccess

此托管策略提供对 AppStream 2.0 资源的完全管理访问权限。要通过 AWS 命令行界面 (AWS CLI)、AWS SDK 或 AWS 管理控制台管理 AppStream 2.0 资源和执行 API 操作，您必须具有此策略中定义的权限。

如果以 IAM 用户身份登录 AppStream 2.0 控制台，则必须将此策略附加到您的 AWS 账户。如果通过控制台联合身份验证登录，则必须将此策略附加到用于联合身份验证的 IAM 角色。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "appstream:"
            ],
            "Effect": "Allow",
            "Resource": ""
        },
        {
            "Action": [
                "application-autoscaling:DeleteScalingPolicy",
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingPolicies",
                "application-autoscaling:PutScalingPolicy",
                "application-autoscaling:RegisterScalableTarget",
                "application-autoscaling:DescribeScheduledActions",
                "application-autoscaling:PutScheduledAction",
                "application-autoscaling:DeleteScheduledAction"
            ],
            "Effect": "Allow",
            "Resource": ""
        },
        {
           "Action": [
                "cloudwatch:DeleteAlarms",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:PutMetricAlarm"
            ],
            "Effect": "Allow",
            "Resource": ""
        },
        {
            "Action": [
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpcEndpoints"
            ],
            "Effect": "Allow",
            "Resource": ""
        },
        {
            "Action": "iam:ListRoles",
            "Effect": "Allow",
            "Resource": ""
       },
        {
            "Action": "iam:PassRole",
            "Effect": "Allow",
            "Resource": "arn:aws:iam:::role/service-role/ApplicationAutoScalingForAmazonAppStreamAccess",
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": "application-autoscaling.amazonaws.com"
                }
            }
        },
        {
            "Action": "iam:CreateServiceLinkedRole",
            "Effect": "Allow",
            "Resource": "arn:aws:iam:::role/aws-service-role/appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet (http://appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet)",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "appstream.application-autoscaling.amazonaws.com"
                }
            }
        }
    ]
}

AmazonAppStreamReadOnlyAccess

此托管策略提供对 AppStream 2.0 资源的只读访问权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "appstream:Get*",
                "appstream:List*",
                "appstream:Describe*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}    

AppStream 2.0 控制台使用两个附加操作，这些操作提供了 AWS CLI 或 AWS SDK 无法提供的功能。AmazonAppStreamFullAccess 和 AmazonAppStreamReadOnlyAccess 策略都为这些操作提供权限。

操作	描述	访问级别
GetImageBuilders	授予权限以检索描述一个或多个指定映像生成器的列表（如果提供了映像生成器名称）。否则，将描述账户中的所有映像生成器。	Read
GetParametersForThemeAssetUpload	授予权限以上传自定义品牌化的主题资产。有关更多信息，请参阅将您的自定义品牌添加至 Amazon AppStream 2.0。	Write

AmazonAppStreamPCAAccess

此托管策略提供对 AWS 账户中 AWS Certifice Manager Private CA 资源的完全管理权限，以进行基于证书的身份验证。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acm-pca:IssueCertificate",
                "acm-pca:GetCertificate",
                "acm-pca:DescribeCertificateAuthority"
            ],
            "Resource": "arn:*:acm-pca:*:*:*",
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/euc-private-ca": "*"
                }
            }
        }
    ]
}

AmazonAppStreamServiceAccess

此托管策略是 AppStream 2.0 服务角色的默认策略。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeAvailabilityZones",
                "ec2:CreateNetworkInterface",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DeleteNetworkInterface",
                "ec2:DescribeSubnets",
                "ec2:AssociateAddress",
                "ec2:DisassociateAddress",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcEndpoints",
                "s3:ListAllMyBuckets",
                "ds:DescribeDirectories"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:ListBucket",
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:GetObjectVersion",
                "s3:DeleteObjectVersion",
                "s3:GetBucketPolicy",
                "s3:PutBucketPolicy",
                "s3:PutEncryptionConfiguration"
            ],
            "Resource": [
                "arn:aws:s3:::appstream2-36fb080bb8-*",
                "arn:aws:s3:::appstream-app-settings-*",
                "arn:aws:s3:::appstream-logs-*"
            ]
        }
    ]
}

ApplicationAutoScalingForAmazonAppStreamAccess

此托管策略为 AppStream 2.0 启用 Application Auto Scaling。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "appstream:UpdateFleet",
                "appstream:DescribeFleets"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:DescribeAlarms"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

AWSApplicationAutoscalingAppStreamFleetPolicy

此托管策略为 Application Auto Scaling 授予对 AppStream 2.0 和 CloudWatch 的访问权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "appstream:UpdateFleet",
                "appstream:DescribeFleets",
                "cloudwatch:PutMetricAlarm",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DeleteAlarms"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

AppStream 2.0 更新到 AWS 托管策略

查看有关 AppStream 2.0 的 AWS 托管策略更新详细信息（从该服务开始跟踪这些更改开始）。要获得有关此页面更改的自动提示，请订阅 亚马逊 AppStream 2.0 的文档历史记录 页面上的 RSS 源。

更改	描述	日期
AppStream 2.0 已开启跟踪更改	AppStream 2.0 为其 AWS 托管策略开启了跟踪更改。	2022 年 10 月 31 日