本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
AWSServiceRoleForAmazonEKSNodegroup
描述：管理客戶帳戶中節點群組所需的許可。這些政策與下列資源的管理相關： AutoscalingGroups、 SecurityGroups、 LaunchTemplates 和 InstanceProfiles。
AWSServiceRoleForAmazonEKSNodegroup 是AWS 受管政策。
使用此政策
此政策會連接至服務連結角色，讓服務代表您執行動作。您無法將此政策連接至使用者、群組或角色。
政策詳細資訊
-
類型：服務連結角色政策
-
建立時間：2019 年 11 月 7 日 01：34 UTC
-
編輯時間：2024 年 11 月 21 日 00：07 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup
政策版本
政策版本：v10 (預設值)
政策的預設版本是定義政策許可的版本。當具有 政策的使用者或角色提出存取 AWS 資源的請求時， 會 AWS 檢查政策的預設版本，以決定是否允許請求。
JSON 政策文件
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "SharedSecurityGroupRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DescribeInstances",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks" : "*"
}
}
},
{
"Sid" : "EKSCreatedSecurityGroupRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:RevokeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:DescribeInstances",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks:nodegroup-name" : "*"
}
}
},
{
"Sid" : "LaunchTemplateRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteLaunchTemplate",
"ec2:CreateLaunchTemplateVersion"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks:nodegroup-name" : "*"
}
}
},
{
"Sid" : "AutoscalingRelatedPermissions",
"Effect" : "Allow",
"Action" : [
"autoscaling:UpdateAutoScalingGroup",
"autoscaling:DeleteAutoScalingGroup",
"autoscaling:TerminateInstanceInAutoScalingGroup",
"autoscaling:CompleteLifecycleAction",
"autoscaling:PutLifecycleHook",
"autoscaling:PutNotificationConfiguration",
"autoscaling:EnableMetricsCollection",
"autoscaling:PutScheduledUpdateGroupAction",
"autoscaling:ResumeProcesses",
"autoscaling:SuspendProcesses"
],
"Resource" : "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*"
},
{
"Sid" : "AllowAutoscalingToCreateSLR",
"Effect" : "Allow",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "autoscaling.amazonaws.com"
}
},
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : "*"
},
{
"Sid" : "AllowASGCreationByEKS",
"Effect" : "Allow",
"Action" : [
"autoscaling:CreateOrUpdateTags",
"autoscaling:CreateAutoScalingGroup"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name"
]
}
}
},
{
"Sid" : "AllowPassRoleToAutoscaling",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "autoscaling.amazonaws.com"
}
}
},
{
"Sid" : "AllowPassRoleToEC2",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : "*",
"Condition" : {
"StringEqualsIfExists" : {
"iam:PassedToService" : [
"ec2.amazonaws.com"
]
}
}
},
{
"Sid" : "PermissionsToManageResourcesForNodegroups",
"Effect" : "Allow",
"Action" : [
"iam:GetRole",
"ec2:CreateLaunchTemplate",
"ec2:DescribeInstances",
"iam:GetInstanceProfile",
"ec2:DescribeLaunchTemplates",
"autoscaling:DescribeAutoScalingGroups",
"ec2:CreateSecurityGroup",
"ec2:DescribeLaunchTemplateVersions",
"ec2:RunInstances",
"ec2:DescribeSecurityGroups",
"ec2:GetConsoleOutput",
"ec2:DescribeRouteTables",
"ec2:DescribeSubnets",
"ec2:DescribeCapacityReservations"
],
"Resource" : "*"
},
{
"Sid" : "PermissionsToCreateAndManageInstanceProfiles",
"Effect" : "Allow",
"Action" : [
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:AddRoleToInstanceProfile"
],
"Resource" : "arn:aws:iam::*:instance-profile/eks-*"
},
{
"Sid" : "PermissionsToDeleteEKSAndKubernetesTags",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteTags"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name",
"kubernetes.io/cluster/*"
]
}
}
},
{
"Sid" : "PermissionsForManagedNodegroupsAutoRepair",
"Effect" : "Allow",
"Action" : [
"ec2:RebootInstances"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/eks:nodegroup-name" : "*"
}
}
},
{
"Sid" : "PermissionsToCreateEKSAndKubernetesTags",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:*:ec2:*:*:security-group/*",
"arn:*:ec2:*:*:launch-template/*"
],
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name",
"kubernetes.io/cluster/*"
]
}
}
},
{
"Sid" : "AllowTaggingEC2ResourcesOnlyDuringInstanceCreation",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : [
"arn:*:ec2:*:*:instance/*",
"arn:*:ec2:*:*:volume/*",
"arn:*:ec2:*:*:network-interface/*"
],
"Condition" : {
"StringEquals" : {
"ec2:CreateAction" : [
"RunInstances"
]
},
"ForAnyValue:StringLike" : {
"aws:TagKeys" : [
"eks",
"eks:cluster-name",
"eks:nodegroup-name",
"kubernetes.io/cluster/*"
]
}
}
}
]
}進一步了解
