设置 AWS IoT Events 警报权限

当您使用 AWS IoT Events 警报模型监控 AWS IoT SiteWise 资产属性时，您必须拥有以下 IAM 权限：

• 允许 AWS IoT Events 向发送数据的 AWS IoT Events 服务角色 AWS IoT SiteWise。有关更多信息，请参阅 AWS IoT Events 开发人员指南中的适用于 AWS IoT Events的 身份和访问管理。

• 您必须拥有以下 AWS IoT SiteWise 操作权限：iotsitewise:DescribeAssetModel和iotsitewise:UpdateAssetModelPropertyRouting。这些权限允许 AWS IoT SiteWise 向 AWS IoT Events 警报模型发送资产属性值。

有关更多信息，请参阅 IAM 用户指南的基于资源的策略。

所需的操作权限

管理员可以使用 AWS JSON 策略来指定谁有权访问什么。也就是说，哪个主体可以对什么资源执行操作，以及在什么条件下执行。JSON 策略的 Action 元素描述可用于在策略中允许或拒绝访问的操作。

在定义 AWS IoT Events 警报模型之前，必须授予以下权限，允许 AWS IoT SiteWise 向警报模型发送资产属性值。

• iotsitewise:DescribeAssetModel— AWS IoT Events 允许检查资产属性是否存在。

• iotsitewise:UpdateAssetModelPropertyRouting— AWS IoT SiteWise 允许自动创建允许 AWS IoT SiteWise 向其发送数据的订阅 AWS IoT Events。

有关 AWS IoT SiteWise 支持的操作的更多信息，请参阅《服务授权参考》 AWS IoT SiteWise中定义的操作。

例 权限策略示例 1

以下策略允许 AWS IoT SiteWise 向任何 AWS IoT Events 警报模型发送资产属性值。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:CreateAlarmModel",
                "iotevents:UpdateAlarmModel"
            ],
            "Resource": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:DescribeAssetModel",
                "iotsitewise:UpdateAssetModelPropertyRouting"
            ],
            "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*"
        }
    ]
}

例 权限策略示例 2

以下策略 AWS IoT SiteWise 允许将指定资产属性的值发送到指定的 AWS IoT Events 警报模型。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:CreateAlarmModel",
                "iotevents:UpdateAlarmModel"
            ],
            "Resource": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:DescribeAssetModel"
            ],
            "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:UpdateAssetModelPropertyRouting"
            ],
            "Resource": [
                "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/12345678-90ab-cdef-1234-567890abcdef"
            ],
            "Condition": {
                "StringLike": {
                    "iotsitewise:propertyId": "abcdef12-3456-7890-abcd-ef1234567890",
                    "iotevents:alarmModelArn": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/MyAlarmModel"
                }
            }
        }
    ]
}

（可选） ListInputRoutings 权限

更新或删除资产模型时， AWS IoT SiteWise 可以检查中的警报模型是否 AWS IoT Events 正在监视与该资产模型关联的资产属性。这可以防止您删除 AWS IoT Events 警报当前正在使用的资产属性。要在中启用此功能 AWS IoT SiteWise，您必须拥有iotevents:ListInputRoutings权限。此权限 AWS IoT SiteWise 允许调用所支持ListInputRoutings的 API 操作 AWS IoT Events。

注意

强烈建议您添加 ListInputRoutings 权限。

例 权限策略示例

以下政策允许您更新和删除资产模型，并使用中的 ListInputRoutings API AWS IoT SiteWise。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:UpdateAssetModel",
                "iotsitewise:DeleteAssetModel",
                "iotevents:ListInputRoutings"
            ],
            "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*"
        }
    ]
}

SiteWise 监控器所需的权限

如果要在 SiteWise 监控门户中使用警报功能，则必须使用以下策略更新SiteWise 监控服务角色：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:DescribePortal",
                "iotsitewise:CreateProject",
                "iotsitewise:DescribeProject",
                "iotsitewise:UpdateProject",
                "iotsitewise:DeleteProject",
                "iotsitewise:ListProjects",
                "iotsitewise:BatchAssociateProjectAssets",
                "iotsitewise:BatchDisassociateProjectAssets",
                "iotsitewise:ListProjectAssets",
                "iotsitewise:CreateDashboard",
                "iotsitewise:DescribeDashboard",
                "iotsitewise:UpdateDashboard",
                "iotsitewise:DeleteDashboard",
                "iotsitewise:ListDashboards",
                "iotsitewise:CreateAccessPolicy",
                "iotsitewise:DescribeAccessPolicy",
                "iotsitewise:UpdateAccessPolicy",
                "iotsitewise:DeleteAccessPolicy",
                "iotsitewise:ListAccessPolicies",
                "iotsitewise:DescribeAsset",
                "iotsitewise:ListAssets",
                "iotsitewise:ListAssociatedAssets",
                "iotsitewise:DescribeAssetProperty",
                "iotsitewise:GetAssetPropertyValue",
                "iotsitewise:GetAssetPropertyValueHistory",
                "iotsitewise:GetAssetPropertyAggregates",
                "iotsitewise:BatchPutAssetPropertyValue",
                "iotsitewise:ListAssetRelationships",
                "iotsitewise:DescribeAssetModel",
                "iotsitewise:ListAssetModels",
                "iotsitewise:UpdateAssetModel",
                "iotsitewise:UpdateAssetModelPropertyRouting",
                "sso-directory:DescribeUsers",
                "sso-directory:DescribeUser",
                "iotevents:DescribeAlarmModel",
                "iotevents:ListTagsForResource"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:BatchAcknowledgeAlarm",
                "iotevents:BatchSnoozeAlarm",
                "iotevents:BatchEnableAlarm",
                "iotevents:BatchDisableAlarm"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "iotevents:keyValue": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:CreateAlarmModel",
                "iotevents:TagResource"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:RequestTag/iotsitewisemonitor": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:UpdateAlarmModel",
                "iotevents:DeleteAlarmModel"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:ResourceTag/iotsitewisemonitor": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "iotevents.amazonaws.com"
                    ]
                }
            }
        }
    ]
}