本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# CodeDeploy 权限参考
<a name="auth-and-access-control-permissions-reference"></a>

在设置访问权限以及编写可附加到 IAM 身份的权限策略（基于身份的策略）时，请使用下表。该表列出了每个 CodeDeploy API 操作、您可以授予执行该操作的权限的操作以及用于授予权限的资源 ARN 的格式。请在策略的 `Action` 字段中指定这些操作。您可以在策略的 `Resource` 字段中指定带或不带通配符（\*）的 ARN 作为资源值。

您可以在 CodeDeploy 策略中使用 AWS-wide 条件键来表达条件。有关 AWS范围密钥的完整列表，请参阅 *IAM 用户指南*中的[可用密钥](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#AvailableKeys)。

要指定操作，请在 API 操作名称之前使用 `codedeploy:` 前缀（例如，`codedeploy:GetApplication` 和 `codedeploy:CreateApplication`）。要在单个语句中指定多项操作，请使用逗号将它们隔开（例如，`"Action": ["codedeploy:action1", "codedeploy:action2"]`）。

**使用通配符**

您可以在 ARN 使用通配符（\*）以指定多个操作或资源。例如，`codedeploy:*`指定所有 CodeDeploy 动作并`codedeploy:Get*`指定以单词开头的所有 CodeDeploy 动作`Get`。以下示例授予对名称以 `West` 开头且与名称以 `Test` 开头的应用程序关联的所有部署组的访问权限。

```
arn:aws:codedeploy:us-west-2:444455556666:deploymentgroup:Test*/West*
```

您可以将通配符与表中列出的以下资源一起使用：
+ {{application-name}}
+ {{deployment-group-name}}
+ {{deployment-configuration-name}}
+ {{instance-ID}}

通配符不能与{{region}}或{{account-id}}一起使用。有关通配符的更多信息，请参阅 *IAM 用户指南*中的 [IAM 标识符](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)。

**注意**  
 在每个操作的 ARN 中，资源后跟一个冒号（:）。您还可以让资源后跟正斜杠（/）。有关更多信息，请参阅 [ARN CodeDeploy 示例](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-codedeploy)。

使用滚动条查看表的其余部分。


**CodeDeploy API 操作和操作所需的权限**  

<table>
<thead>
  <tr><th>CodeDeploy API 操作</th><th>所需权限（API 操作）</th><th>资源</th></tr>
</thead>
<tbody>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_AddTagsToOnPremisesInstances.html">AddTagsToOnPremisesInstances</a></td><td><code>codedeploy:AddTagsToOnPremisesInstances</code><br />向一个或多个本地实例添加标签所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/BatchGetApplicationRevisions.html">BatchGetApplicationRevisions</a></td><td><code>codedeploy:BatchGetApplicationRevisions</code><br />获取有关与 用户关联的多个应用程序版本的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetApplications.html">BatchGetApplications</a></td><td><code>codedeploy:BatchGetApplications</code><br />获取有关与 用户关联的多个应用程序的信息所必需的。</td><td>arn: aws: codedeploy::: 应用程序:* {{region}} {{account-id}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentGroups.html">BatchGetDeploymentGroups</a></td><td><code>codedeploy:BatchGetDeploymentGroups</code><br />获取有关与 用户关联的多个部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentInstances.html">BatchGetDeploymentInstances</a></td><td><code>codedeploy:BatchGetDeploymentInstances</code>获取有关部署组中的一个或多个实例的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeployments.html">BatchGetDeployments</a></td><td><code>codedeploy:BatchGetDeployments</code><br />获取有关与 用户关联的多个部署的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetOnPremisesInstances.html">BatchGetOnPremisesInstances</a></td><td><code>codedeploy:BatchGetOnPremisesInstances</code><br />获取有关一个或多个本地实例的信息所必需的。</td><td>arn: aws: codedeploy::: * {{region}} {{account-id}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ContinueDeployment.html">ContinueDeployment</a></td><td><code>codedeploy:ContinueDeployment</code><br />在 blue/green 部署期间，需要启动使用 Elastic Load Balancing 负载均衡器在替代环境中注册实例的过程。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateApplication.html">CreateApplication</a></td><td><code>codedeploy:CreateApplication</code><br />创建与 用户关联的应用程序所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeployment.html">CreateDeployment</a>¹</td><td><code>codedeploy:CreateDeployment</code><br />为与 用户关联的应用程序创建部署所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentConfig.html">CreateDeploymentConfig</a></td><td><code>codedeploy:CreateDeploymentConfig</code><br />创建与 用户关联的自定义部署配置所必需的。</td><td>arn: aws: codedeploy::: 部署配置:{{region}}{{account-id}}{{deployment-configuration-name}} </td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentGroup.html">CreateDeploymentGroup</a></td><td><code>codedeploy:CreateDeploymentGroup</code><br />为与 用户关联的应用程序创建部署组所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteApplication.html">DeleteApplication</a></td><td><code>codedeploy:DeleteApplication</code><br />删除与 用户关联的应用程序所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentConfig.html">DeleteDeploymentConfig</a></td><td><code>codedeploy:DeleteDeploymentConfig</code><br />删除与 用户关联的自定义部署配置所必需的。</td><td>arn: aws: codedeploy::: 部署配置:{{region}}{{account-id}}{{deployment-configuration-name}} </td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentGroup.html">DeleteDeploymentGroup</a></td><td><code>codedeploy:DeleteDeploymentGroup</code><br />为与 用户关联的应用程序删除部署组所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeregisterOnPremisesInstance.html">DeregisterOnPremisesInstance</a></td><td><code>codedeploy:DeregisterOnPremisesInstance</code><br />取消注册本地实例所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplication.html">GetApplication</a></td><td><code>codedeploy:GetApplication</code><br />获取有关与 用户关联的单个应用程序的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplicationRevision.html">GetApplicationRevision</a></td><td><code>codedeploy:GetApplicationRevision</code><br />获取有关与 用户关联的应用程序的单个应用程序修订的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeployment.html">GetDeployment</a></td><td><code>codedeploy:GetDeployment</code><br />获取针对与 用户关联的应用程序的部署组的单个部署的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentConfig.html">GetDeploymentConfig</a></td><td><code>codedeploy:GetDeploymentConfig</code><br />获取有关与 用户关联的单个部署配置的信息所必需的。</td><td>arn: aws: codedeploy::: 部署配置:{{region}}{{account-id}}{{deployment-configuration-name}} </td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentGroup.html">GetDeploymentGroup</a></td><td><code>codedeploy:GetDeploymentGroup</code><br />获取有关与 用户关联的应用程序的单个部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentInstance.html">GetDeploymentInstance</a></td><td><code>codedeploy:GetDeploymentInstance</code><br />获取有关部署中与 用户关联的单个实例的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentTarget.html">GetDeploymentTarget</a></td><td><code>codedeploy:GetDeploymentTarget</code><br />获取有关部署中与 用户关联的目标的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetOnPremisesInstance.html">GetOnPremisesInstance</a></td><td><code>codedeploy:GetOnPremisesInstance</code><br />获取有关单个本地实例的信息所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplicationRevisions.html">ListApplicationRevisions</a></td><td><code>codedeploy:ListApplicationRevisions</code><br />获取有关与 用户关联的应用程序的所有应用程序修订的信息所必需的。</td><td>arn: aws: codedeploy::: 应用程序:* {{region}} {{account-id}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplications.html">ListApplications</a></td><td><code>codedeploy:ListApplications</code><br />获取有关与 用户关联的所有应用程序的信息所必需的。</td><td>arn: aws: codedeploy::: 应用程序:* {{region}} {{account-id}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentConfigs.html">ListDeploymentConfigs</a></td><td><code>codedeploy:ListDeploymentConfigs</code><br />获取有关与 用户关联的所有部署配置的信息所必需的。</td><td>arn: aws: codedeploy::: 部署配置:* {{region}} {{account-id}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentGroups.html">ListDeploymentGroups</a></td><td><code>codedeploy:ListDeploymentGroups</code><br />获取有关与 用户关联的应用程序的所有部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/* {{region}} {{account-id}} {{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentInstances.html">ListDeploymentInstances</a></td><td><code>codedeploy:ListDeploymentInstances</code><br />需要获取有关部署中与用户或 AWS 账户关联的所有实例的信息。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeployments.html">ListDeployments</a></td><td><code>codedeploy:ListDeployments</code><br />获取有关针对与用户关联的部署组的所有部署的信息所必需的，或获取与用户的所有部署所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentTargets.html">ListDeploymentTargets</a></td><td><code>codedeploy:ListDeploymentTargets</code><br />获取有关部署中与用户关联的所有目标的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListGitHubAccountTokenNames.html">ListGitHubAccountTokenNames</a></td><td><code>codedeploy:ListGitHubAccountTokenNames</code><br />需要获取已存储的 GitHub 账户连接的名称列表。</td><td>arn: aws: codedeploy::: * {{region}} {{account-id}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListOnPremisesInstances.html">ListOnPremisesInstances</a></td><td><code>codedeploy:ListOnPremisesInstances</code><br />获取一个或更多本地实例名称的列表所必需的。</td><td>arn: aws: codedeploy::: * {{region}} {{account-id}}</td></tr>
  <tr><td>PutLifecycleEventHookExecutionStatus</td><td><code>codedeploy:PutLifecycleEventHookExecutionStatus</code><br />对于提供生命周期挂钩事件的执行状态通知是必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterApplicationRevision.html">RegisterApplicationRevision</a></td><td><code>codedeploy:RegisterApplicationRevision</code><br />注册有关与 用户关联的应用程序的一个应用程序修订的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterOnPremisesInstance.html">RegisterOnPremisesInstance</a></td><td><code>codedeploy:RegisterOnPremisesInstance</code><br />向 CodeDeploy 注册本地实例所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RemoveTagsFromOnPremisesInstances.html">RemoveTagsFromOnPremisesInstances</a></td><td><code>codedeploy:RemoveTagsFromOnPremisesInstances</code><br />从一个或多个本地实例中删除标签所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_SkipWaitTimeForInstanceTermination.html">SkipWaitTimeForInstanceTermination</a></td><td><code>codedeploy:SkipWaitTimeForInstanceTermination</code><br />在 blue/green 部署中需要覆盖指定的等待时间并立即开始终止原始环境中的实例。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_StopDeployment.html">StopDeployment</a></td><td><code>codedeploy:StopDeployment</code><br />停止正在进行的部署到与 用户关联的应用程序的部署组所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateApplication.html">UpdateApplication</a>³</td><td><code>codedeploy:UpdateApplication</code><br />更改有关与 用户关联的应用程序的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateDeploymentGroup.html">UpdateDeploymentGroup</a>³</td><td><code>codedeploy:UpdateDeploymentGroup</code><br />更改有关与 用户关联的应用程序的单个部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td colspan="3">¹ 当您指定 <code>GetDeploymentConfig</code> 权限时，还必须为部署配置指定 <code>GetApplicationRevision</code> 权限，并且为应用程序修订指定 <code>CreateDeployment</code> 或 <code>RegisterApplicationRevision</code> 权限。此外，如果您在 <code>CreateDeployment</code> API 调用中包含 <code>overrideAlarmConfiguration</code> 参数，则必须指定 <code>UpdateDeploymentGroup</code> 权限。<br />² 在提供特定部署组时对 <code>ListDeployments</code> 有效，但在列出所有与用户关联的部署时无效。<br />³ 对于 <code>UpdateApplication</code>，您必须同时对旧应用程序名称和新应用程序名称具有 <code>UpdateApplication</code> 权限。对于涉及更改部署组名称的 <code>UpdateDeploymentGroup</code> 操作，您必须同时具有对旧的和新的部署组名称的 <code>UpdateDeploymentGroup</code> 权限。</td></tr>
</tbody>
</table>