迁移到精细权限

AWS Artifact 现在允许客户使用精细权限。通过这些精细权限，客户将可以精细地控制对各种功能的访问权限，例如接受条款和下载报告等。

要通过精细权限访问报告，客户应使用 AWSArtifactReportsReadOnlyAccess 托管式策略或根据以下建议更新权限。然后，客户应使用控制台中提供的试用新 AWS 报告页面链接选择加入。

如果更新到新权限时出现问题，用户可以使用控制台中提供的旧报告页面链接，从使用旧权限访问报告。

迁移到新权限

迁移非资源特定权限

用户需要将包含旧权限的现有策略替换为包含精细权限的策略

旧策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "artifact:Get"
      ],
      "Resource": [
        "arn:aws:artifact:::report-package/*"
      ]
    }
  ]
}

具有精细权限的新策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "artifact:ListReports",
        "artifact:GetReportMetadata",
        "artifact:GetReport",
        "artifact:GetTermForReport"
      ],
      "Resource": "*"
    }
  ]
}

迁移资源特定权限

用户需要将其包含旧权限的现有策略替换为包含精细权限的策略。报告资源通配符权限已被条件键取代。

旧策略：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "artifact:Get"
      ],
      "Resource": [
        "arn:aws:artifact:::report-package/Certifications and Attestations/SOC/*",
        "arn:aws:artifact:::report-package/Certifications and Attestations/PCI/*",
        "arn:aws:artifact:::report-package/Certifications and Attestations/ISO/*"
      ]
    }
  ]
}

包含精细权限和条件键的新策略。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "artifact:ListReports"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "artifact:GetReportMetadata",
        "artifact:GetReport",
        "artifact:GetTermForReport"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "artifact:ReportSeries": [
            "SOC",
            "PCI",
            "ISO"
          ],
          "artifact:ReportCategory": [
            "Certifications and Attestations"
          ]
        }
      }
    }
  ]
}