本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # AWSTransformInfrastructureExecutorAccessEC2 **描述**：向执行角色授予执行 T AWS ransform 持续现代化所需的权限，使其 CLI/agent 能够 assessments/transformations 使用 EC2 运行，包括上传源代码、检索结果、监控任务状态、读取日志和管理转换计划。 `AWSTransformInfrastructureExecutorAccessEC2` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 您可以将 `AWSTransformInfrastructureExecutorAccessEC2` 附加到您的用户、组和角色。 ## 策略详细信息 + **类型**： AWS 托管策略 + **创建时间**：世界标准时间 2026 年 7 月 20 日 20:12 + **编辑时间：世界标准时间 2026 年 ** 7 月 28 日 15:42 + **ARN**: `arn:aws:iam::aws:policy/AWSTransformInfrastructureExecutorAccessEC2` ## 策略版本 **策略版本：**v2（默认） 此策略的默认版本是定义策略权限的版本。当具有该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "CFNRead", "Effect" : "Allow", "Action" : [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DescribeStackDriftDetectionStatus" ], "Resource" : [ "arn:aws:cloudformation:*:*:stack/atx-*/*", "arn:aws:cloudformation:*:*:stack/AtxSecurityAgentStack-*/*" ] }, { "Sid" : "CFNValidateTemplate", "Effect" : "Allow", "Action" : "cloudformation:ValidateTemplate", "Resource" : "*" }, { "Sid" : "EC2Desc", "Effect" : "Allow", "Action" : [ "ec2:DescribeInstances", "ec2:DescribeImages", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeInternetGateways" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "EC2PowerState", "Effect" : "Allow", "Action" : [ "ec2:StartInstances", "ec2:StopInstances" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringEquals" : { "ec2:ResourceTag/atx-remote-infra" : "true" } } }, { "Sid" : "SSMRead", "Effect" : "Allow", "Action" : [ "ssm:GetCommandInvocation", "ssm:ListCommands", "ssm:ListCommandInvocations", "ssm:DescribeInstanceInformation", "ssm:DescribeSessions" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "SSMTgt", "Effect" : "Allow", "Action" : [ "ssm:SendCommand", "ssm:StartSession" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringEquals" : { "ssm:resourceTag/atx-remote-infra" : "true" } } }, { "Sid" : "SSMDocs", "Effect" : "Allow", "Action" : "ssm:SendCommand", "Resource" : "arn:aws:ssm:*::document/AWS-RunShellScript" }, { "Sid" : "S3Data", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket" ], "Resource" : [ "arn:aws:s3:::atx-source-code-*", "arn:aws:s3:::atx-source-code-*/*", "arn:aws:s3:::atx-ct-output-*", "arn:aws:s3:::atx-ct-output-*/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "KMSEncryptDecrypt", "Effect" : "Allow", "Action" : [ "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAnyValue:StringLike" : { "kms:ResourceAliases" : [ "alias/atx-encryption-key", "alias/atx-encryption-key-*" ] } } }, { "Sid" : "SM", "Effect" : "Allow", "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:atx/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "SMList", "Effect" : "Allow", "Action" : "secretsmanager:ListSecrets", "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "SchedLifecycle", "Effect" : "Allow", "Action" : [ "scheduler:CreateSchedule", "scheduler:DeleteSchedule", "scheduler:GetSchedule", "scheduler:UpdateSchedule" ], "Resource" : [ "arn:aws:scheduler:*:*:schedule/atx-ct/*", "arn:aws:scheduler:*:*:schedule/atx-ct-*/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "SchedGroupRead", "Effect" : "Allow", "Action" : "scheduler:GetScheduleGroup", "Resource" : [ "arn:aws:scheduler:*:*:schedule-group/atx-ct", "arn:aws:scheduler:*:*:schedule-group/atx-ct-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "SchedList", "Effect" : "Allow", "Action" : [ "scheduler:ListSchedules", "scheduler:ListScheduleGroups" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "IAMPassEC2InstanceRole", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/atx-transform-role", "arn:aws:iam::*:role/atx-transform-role-*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : "ec2.amazonaws.com", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "IAMPassSchedulerRole", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/AtxSchedulerInvocationRole", "arn:aws:iam::*:role/AtxSchedulerInvocationRole-*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : "scheduler.amazonaws.com", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "IAMReadRoles", "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:GetRolePolicy" ], "Resource" : [ "arn:aws:iam::*:role/atx-*", "arn:aws:iam::*:role/Atx*", "arn:aws:iam::*:role/ATX*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "IAMReadInstanceProfile", "Effect" : "Allow", "Action" : "iam:GetInstanceProfile", "Resource" : [ "arn:aws:iam::*:instance-profile/atx-*", "arn:aws:iam::*:instance-profile/Atx*", "arn:aws:iam::*:instance-profile/ATX*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TagGetATXStacks", "Effect" : "Allow", "Action" : "tag:GetResources", "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "CFNListStacksForDetect", "Effect" : "Allow", "Action" : "cloudformation:ListStacks", "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] } ``` ## 了解详情 + [在 IAM 身份中心使用 AWS 托管策略创建权限集 ](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [添加和删除 IAM 身份权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM policy 版本控制](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略并转向最低权限权限 ](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)