本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。
AWSMigrationHubRefactorSpacesFullAccess
描述:授予对 AWS MigrationHub Refactor Spaces、AWS MigrationHub Refactor Spaces 控制台功能和其他相关 AWS 服务的完全访问权限,但 AWS Lambda 和 AWS Resource Access Manager 所需的权限除外,因为可以根据标签来缩小它们的范围。
AWSMigrationHubRefactorSpacesFullAccess
是一项 AWS 托管式策略。
使用此策略
您可以将 AWSMigrationHubRefactorSpacesFullAccess
附加到您的用户、组和角色。
策略详细信息
-
类型:AWS 托管策略
-
创建时间:2021 年 11 月 29 日 07:12 UTC
-
编辑时间:2024 年 4 月 11 日 17:45 UTC
-
ARN:
arn:aws:iam::aws:policy/AWSMigrationHubRefactorSpacesFullAccess
策略版本
策略版本:v6(默认)
此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时,AWS 会检查策略的默认版本以确定是否允许该请求。
JSON 策略文档
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "RefactorSpaces",
"Effect" : "Allow",
"Action" : [
"refactor-spaces:*"
],
"Resource" : "*"
},
{
"Sid" : "EC2Describe",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeRouteTables",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcEndpointServiceConfigurations",
"ec2:DescribeVpcs",
"ec2:DescribeTransitGatewayVpcAttachments",
"ec2:DescribeTransitGateways",
"ec2:DescribeTags",
"ec2:DescribeAccountAttributes",
"ec2:DescribeInternetGateways"
],
"Resource" : "*"
},
{
"Sid" : "RequestTagTransitGatewayCreate",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTransitGateway",
"ec2:CreateSecurityGroup",
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:RequestTag/refactor-spaces:environment-id" : "false"
}
}
},
{
"Sid" : "ResourceTagTransitGatewayCreate",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTransitGateway",
"ec2:CreateSecurityGroup",
"ec2:CreateTransitGatewayVpcAttachment"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/refactor-spaces:environment-id" : "false"
}
}
},
{
"Sid" : "VpcEndpointServiceConfigurationCreate",
"Effect" : "Allow",
"Action" : [
"ec2:CreateVpcEndpointServiceConfiguration"
],
"Resource" : "*"
},
{
"Sid" : "EC2NetworkingModify",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteTransitGateway",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:RevokeSecurityGroupIngress",
"ec2:DeleteSecurityGroup",
"ec2:DeleteTransitGatewayVpcAttachment",
"ec2:CreateRoute",
"ec2:DeleteRoute",
"ec2:DeleteTags"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/refactor-spaces:environment-id" : "false"
}
}
},
{
"Sid" : "VpcEndpointServiceConfigurationDelete",
"Effect" : "Allow",
"Action" : "ec2:DeleteVpcEndpointServiceConfigurations",
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/refactor-spaces:application-id" : "false"
}
}
},
{
"Sid" : "ELBLoadBalancerCreate",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateLoadBalancer"
],
"Resource" : "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*",
"Condition" : {
"Null" : {
"aws:RequestTag/refactor-spaces:application-id" : "false"
}
}
},
{
"Sid" : "ELBDescribe",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTags",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeListeners"
],
"Resource" : "*"
},
{
"Sid" : "ELBModify",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:CreateLoadBalancerListeners",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DeleteTargetGroup"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"aws:ResourceTag/refactor-spaces:route-id" : [
"*"
]
}
}
},
{
"Sid" : "ELBLoadBalancerDelete",
"Effect" : "Allow",
"Action" : "elasticloadbalancing:DeleteLoadBalancer",
"Resource" : "arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*"
},
{
"Sid" : "ELBListenerCreate",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateListener"
],
"Resource" : [
"arn:*:elasticloadbalancing:*:*:loadbalancer/net/refactor-spaces-nlb-*",
"arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*"
],
"Condition" : {
"Null" : {
"aws:RequestTag/refactor-spaces:route-id" : "false"
}
}
},
{
"Sid" : "ELBListenerDelete",
"Effect" : "Allow",
"Action" : "elasticloadbalancing:DeleteListener",
"Resource" : "arn:*:elasticloadbalancing:*:*:listener/net/refactor-spaces-nlb-*"
},
{
"Sid" : "ELBTargetGroupModify",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:RegisterTargets"
],
"Resource" : "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*"
},
{
"Sid" : "ELBTargetGroupCreate",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:CreateTargetGroup"
],
"Resource" : "arn:*:elasticloadbalancing:*:*:targetgroup/refactor-spaces-tg-*",
"Condition" : {
"Null" : {
"aws:RequestTag/refactor-spaces:route-id" : "false"
}
}
},
{
"Sid" : "APIGatewayModify",
"Effect" : "Allow",
"Action" : [
"apigateway:GET",
"apigateway:DELETE",
"apigateway:PATCH",
"apigateway:POST",
"apigateway:PUT",
"apigateway:UpdateRestApiPolicy"
],
"Resource" : [
"arn:aws:apigateway:*::/restapis",
"arn:aws:apigateway:*::/restapis/*",
"arn:aws:apigateway:*::/vpclinks",
"arn:aws:apigateway:*::/vpclinks/*",
"arn:aws:apigateway:*::/tags",
"arn:aws:apigateway:*::/tags/*"
],
"Condition" : {
"Null" : {
"aws:ResourceTag/refactor-spaces:application-id" : "false"
}
}
},
{
"Sid" : "APIGatewayVpcLinksGet",
"Effect" : "Allow",
"Action" : "apigateway:GET",
"Resource" : [
"arn:aws:apigateway:*::/vpclinks",
"arn:aws:apigateway:*::/vpclinks/*"
]
},
{
"Sid" : "OrganizationDescribe",
"Effect" : "Allow",
"Action" : [
"organizations:DescribeOrganization"
],
"Resource" : "*"
},
{
"Sid" : "CloudformationStackCreate",
"Effect" : "Allow",
"Action" : [
"cloudformation:CreateStack"
],
"Resource" : "*"
},
{
"Sid" : "CloudformationStackTag",
"Effect" : "Allow",
"Action" : [
"cloudformation:TagResource"
],
"Resource" : "arn:aws:cloudformation:*:*:stack/*"
},
{
"Sid" : "CreateRefactorSpacesSLR",
"Effect" : "Allow",
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "refactor-spaces.amazonaws.com"
}
}
},
{
"Sid" : "CreateELBSLR",
"Effect" : "Allow",
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "elasticloadbalancing.amazonaws.com"
}
}
}
]
}