Elastic Beanstalk 服务角色 - AWS Elastic Beanstalk

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

Elastic Beanstalk 服务角色

服务角色是 Elastic Beanstalk 在代表您调用其他服务时代入的 IAM 角色。例如,Elastic Beanstalk 在调用 Amazon Elastic Compute Cloud(Amazon EC2)、Elastic Load Balancing 和 Amazon EC2 Auto Scaling API 来收集信息时,将会使用一个服务角色。Elastic Beanstalk 使用的服务角色是您在创建 Elastic Beanstalk 环境时指定的角色。

有两个托管策略附加到服务角色。这些策略提供的权限允许 Elastic Beanstalk 访问创建和管理环境所需的 AWS 资源。一个托管策略提供增强的运行状况监控和工作线程层 Amazon SQS 支持的权限,另一个策略提供托管平台更新所需的其他权限。

此策略授予 Elastic Beanstalk 监控环境运行状况所需的所有权限。它还包括 Amazon SQS 操作,以允许 Elastic Beanstalk 监控工作线程环境的队列活动。

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetHealth", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:GetConsoleOutput", "ec2:AssociateAddress", "ec2:DescribeAddresses", "ec2:DescribeSecurityGroups", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeNotificationConfigurations", "sns:Publish" ], "Resource": [ "*" ] } ] }

此策略向 Elastic Beanstalk 授予权限,以代表您更新环境以执行托管平台更新。

服务级别权限分组

此策略根据提供的权限集分为多个语句。

  • ElasticBeanstalkPermissions – 这一组权限用于调用 Elastic Beanstalk 服务操作(Elastic Beanstalk API)。

  • AllowPassRoleToElasticBeanstalkAndDownstreamServices – 这一组权限允许将任何角色传递给 Elastic Beanstalk 及其他下游服务,例如 AWS CloudFormation。

  • ReadOnlyPermissions – 这一组权限用于收集有关运行环境的信息。

  • *OperationPermissions – 采用此命名模式的组用于调用执行平台更新必需的操作。

  • *BroadOperationPermissions – 采用此命名模式的组用于调用执行平台更新必需的操作。它们还包括支持旧环境的广泛权限。

  • *TagResource – 采用这种命名模式的组适用于使用 tag-on-create API 为在 Elastic Beanstalk 环境中创建的资源附加标签的调用。

{ "Version": "2012-10-17", "Statement": [ { "Sid": "ElasticBeanstalkPermissions", "Effect": "Allow", "Action": [ "elasticbeanstalk:*" ], "Resource": "*" }, { "Sid": "AllowPassRoleToElasticBeanstalkAndDownstreamServices", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": [ "elasticbeanstalk.amazonaws.com", "ec2.amazonaws.com", "ec2.amazonaws.com.cn", "autoscaling.amazonaws.com", "elasticloadbalancing.amazonaws.com", "ecs.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "ReadOnlyPermissions", "Effect": "Allow", "Action": [ "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeLoadBalancers", "autoscaling:DescribeNotificationConfigurations", "autoscaling:DescribeScalingActivities", "autoscaling:DescribeScheduledActions", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeImages", "ec2:DescribeInstanceAttribute", "ec2:DescribeInstances", "ec2:DescribeKeyPairs", "ec2:DescribeLaunchTemplates", "ec2:DescribeLaunchTemplateVersions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSubnets", "ec2:DescribeVpcClassicLink", "ec2:DescribeVpcs", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "logs:DescribeLogGroups", "rds:DescribeDBEngineVersions", "rds:DescribeDBInstances", "rds:DescribeOrderableDBInstanceOptions", "sns:ListSubscriptionsByTopic" ], "Resource": [ "*" ] }, { "Sid": "EC2BroadOperationPermissions", "Effect": "Allow", "Action": [ "ec2:AllocateAddress", "ec2:AssociateAddress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateLaunchTemplate", "ec2:CreateLaunchTemplateVersion", "ec2:CreateSecurityGroup", "ec2:DeleteLaunchTemplate", "ec2:DeleteLaunchTemplateVersions", "ec2:DeleteSecurityGroup", "ec2:DisassociateAddress", "ec2:ReleaseAddress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress" ], "Resource": "*" }, { "Sid": "EC2RunInstancesOperationPermissions", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "*", "Condition": { "ArnLike": { "ec2:LaunchTemplate": "arn:aws:ec2:*:*:launch-template/*" } } }, { "Sid": "EC2TerminateInstancesOperationPermissions", "Effect": "Allow", "Action": [ "ec2:TerminateInstances" ], "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "ec2:ResourceTag/aws:cloudformation:stack-id": [ "arn:aws:cloudformation:*:*:stack/awseb-e-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] } } }, { "Sid": "ECSBroadOperationPermissions", "Effect": "Allow", "Action": [ "ecs:CreateCluster", "ecs:DescribeClusters", "ecs:RegisterTaskDefinition" ], "Resource": "*" }, { "Sid": "ECSDeleteClusterOperationPermissions", "Effect": "Allow", "Action": "ecs:DeleteCluster", "Resource": "arn:aws:ecs:*:*:cluster/awseb-*" }, { "Sid": "ASGOperationPermissions", "Effect": "Allow", "Action": [ "autoscaling:AttachInstances", "autoscaling:CreateAutoScalingGroup", "autoscaling:CreateLaunchConfiguration", "autoscaling:CreateOrUpdateTags", "autoscaling:DeleteLaunchConfiguration", "autoscaling:DeleteAutoScalingGroup", "autoscaling:DeleteScheduledAction", "autoscaling:DetachInstances", "autoscaling:DeletePolicy", "autoscaling:PutScalingPolicy", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:PutNotificationConfiguration", "autoscaling:ResumeProcesses", "autoscaling:SetDesiredCapacity", "autoscaling:SuspendProcesses", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup" ], "Resource": [ "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/awseb-e-*", "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/eb-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/awseb-e-*", "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/eb-*" ] }, { "Sid": "CFNOperationPermissions", "Effect": "Allow", "Action": [ "cloudformation:*" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/awseb-*", "arn:aws:cloudformation:*:*:stack/eb-*" ] }, { "Sid": "ELBOperationPermissions", "Effect": "Allow", "Action": [ "elasticloadbalancing:AddTags", "elasticloadbalancing:ApplySecurityGroupsToLoadBalancer", "elasticloadbalancing:ConfigureHealthCheck", "elasticloadbalancing:CreateLoadBalancer", "elasticloadbalancing:DeleteLoadBalancer", "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", "elasticloadbalancing:DeregisterTargets", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets" ], "Resource": [ "arn:aws:elasticloadbalancing:*:*:targetgroup/awseb-*", "arn:aws:elasticloadbalancing:*:*:targetgroup/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/awseb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/eb-*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/awseb-*/*", "arn:aws:elasticloadbalancing:*:*:loadbalancer/*/eb-*/*" ] }, { "Sid": "CWLogsOperationPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk/*" }, { "Sid": "S3ObjectOperationPermissions", "Effect": "Allow", "Action": [ "s3:DeleteObject", "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectVersion", "s3:GetObjectVersionAcl", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectVersionAcl" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*/*" }, { "Sid": "S3BucketOperationPermissions", "Effect": "Allow", "Action": [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket", "s3:PutBucketPolicy" ], "Resource": "arn:aws:s3:::elasticbeanstalk-*" }, { "Sid": "SNSOperationPermissions", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:Subscribe" ], "Resource": "arn:aws:sns:*:*:ElasticBeanstalkNotifications-*" }, { "Sid": "SQSOperationPermissions", "Effect": "Allow", "Action": [ "sqs:GetQueueAttributes", "sqs:GetQueueUrl" ], "Resource": [ "arn:aws:sqs:*:*:awseb-e-*", "arn:aws:sqs:*:*:eb-*" ] }, { "Sid": "CWPutMetricAlarmOperationPermissions", "Effect": "Allow", "Action": [ "cloudwatch:PutMetricAlarm" ], "Resource": [ "arn:aws:cloudwatch:*:*:alarm:awseb-*", "arn:aws:cloudwatch:*:*:alarm:eb-*" ] }, { "Sid": "AllowECSTagResource", "Effect": "Allow", "Action": [ "ecs:TagResource" ], "Resource": "*", "Condition": { "StringEquals": { "ecs:CreateAction": [ "CreateCluster", "RegisterTaskDefinition" ] } } } ] }

您可以使用以下任一方法创建 Elastic Beanstalk 环境。每个部分都描述了该方法如何处理服务角色。

Elastic Beanstalk 控制台

使用 Elastic Beanstalk 控制台创建环境时,Elastic Beanstalk 将提示您创建一个名为 aws-elasticbeanstalk-service-role 的服务角色。当通过 Elastic Beanstalk 创建时,此角色包括一个信任策略,允许 Elastic Beanstalk 代入服务角色。本主题前面描述的两个托管策略也会附加到该角色。

Elastic Beanstalk 命令行界面 (EB CLI)

您可以使用 Elastic Beanstalk 命令行界面(EB CLI)的 eb create 命令创建环境。如果您未通过 --service-role 选项指定服务角色。Elastic Beanstalk 将创建相同的默认服务角色 aws-elasticbeanstalk-service-role。如果默认服务角色已存在,Elastic Beanstalk 会将其用于新环境。当通过 Elastic Beanstalk 创建时,此角色包括一个信任策略,允许 Elastic Beanstalk 代入服务角色。本主题前面描述的两个托管策略也会附加到该角色。

Elastic Beanstalk API

您可以使用 Elastic Beanstalk API 的 CreateEnvironment 操作创建环境。如果您未指定服务角色,Elastic Beanstalk 将创建一个监控服务相关角色。这是独特类型的服务角色,由 Elastic Beanstalk 预定义,它具有服务代表您调用其他 AWS 服务所需的所有权限。服务相关角色与您的账户关联。Elastic Beanstalk 仅会创建此角色一次,然后在创建其他环境时重复使用此角色。您也可以使用 IAM 提前为账户创建此监控服务相关角色。在您的账户具有监控服务相关角色时,您可以通过 Elastic Beanstalk 控制台、Elastic Beanstalk API 或 EB CLI 使用该角色创建环境。有关如何将服务相关角色与 Elastic Beanstalk 环境结合使用的说明,请参阅将服务相关角色用于 Elastic Beanstalk

有关服务角色的更多信息,请参阅管理 Elastic Beanstalk 服务角色