本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
AWSThinkboxAWSPortalAdminPolicy
描述：此政策會授予 AWS Thinkbox 的截止日期軟體對 AWS Portal 管理所需的多項 AWS 服務的完整存取權。這包括在數種 EC2 資源類型上建立任意標籤的存取權。
AWSThinkboxAWSPortalAdminPolicy 是AWS 受管政策。
使用此政策
您可以AWSThinkboxAWSPortalAdminPolicy連接至您的使用者、群組和角色。
政策詳細資訊
-
類型： AWS 受管政策
-
建立時間：2020 年 5 月 27 日 19：41 UTC
-
編輯時間：2024 年 11 月 12 日 19：22 UTC
-
ARN:
arn:aws:iam::aws:policy/AWSThinkboxAWSPortalAdminPolicy
政策版本
政策版本：v9 (預設值)
政策的預設版本是定義政策許可的版本。當具有 政策的使用者或角色提出存取 AWS 資源的請求時， 會 AWS 檢查政策的預設版本，以決定是否允許請求。
JSON 政策文件
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AWSThinkboxAWSPortal1", "Effect" : "Allow", "Action" : [ "ec2:AttachInternetGateway", "ec2:AssociateAddress", "ec2:AssociateRouteTable", "ec2:AllocateAddress", "ec2:AuthorizeSecurityGroupIngress", "ec2:CreateFleet", "ec2:CreateLaunchTemplate", "ec2:CreateInternetGateway", "ec2:CreateNatGateway", "ec2:CreatePlacementGroup", "ec2:CreateRoute", "ec2:CreateRouteTable", "ec2:CreateSecurityGroup", "ec2:CreateSubnet", "ec2:CreateVpc", "ec2:CreateVpcEndpoint", "ec2:DescribeAvailabilityZones", "ec2:DescribeAddresses", "ec2:DescribeFleets", "ec2:DescribeFleetHistory", "ec2:DescribeFleetInstances", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeLaunchTemplates", "ec2:DescribeRouteTables", "ec2:DescribeNatGateways", "ec2:DescribeTags", "ec2:DescribeKeyPairs", "ec2:DescribePlacementGroups", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeRegions", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeSecurityGroups", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:DescribeVpcEndpoints", "ec2:GetConsoleOutput", "ec2:ImportKeyPair", "ec2:ReleaseAddress", "ec2:RequestSpotFleet", "ec2:CancelSpotFleetRequests", "ec2:DisassociateAddress", "ec2:DeleteFleets", "ec2:DeleteLaunchTemplate", "ec2:DeleteVpc", "ec2:DeletePlacementGroup", "ec2:DeleteVpcEndpoints", "ec2:DeleteInternetGateway", "ec2:DeleteSecurityGroup", "ec2:RevokeSecurityGroupIngress", "ec2:DeleteRoute", "ec2:DeleteRouteTable", "ec2:DisassociateRouteTable", "ec2:DeleteSubnet", "ec2:DeleteNatGateway", "ec2:DetachInternetGateway", "ec2:ModifyInstanceAttribute", "ec2:ModifyFleet", "ec2:ModifySpotFleetRequest", "ec2:ModifyVpcAttribute" ], "Resource" : "*" }, { "Sid" : "AWSThinkboxAWSPortal2", "Effect" : "Allow", "Action" : "ec2:RunInstances", "Resource" : [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*::image/*" ] }, { "Sid" : "AWSThinkboxAWSPortal3", "Effect" : "Allow", "Action" : "ec2:RunInstances", "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "ArnLike" : { "ec2:InstanceProfile" : "arn:aws:iam::*:instance-profile/AWSPortal*" } } }, { "Sid" : "AWSThinkboxAWSPortal4", "Effect" : "Allow", "Action" : "ec2:TerminateInstances", "Resource" : "*", "Condition" : { "StringEquals" : { "ec2:ResourceTag/aws:cloudformation:logical-id" : "ReverseForwarder" } } }, { "Sid" : "AWSThinkboxAWSPortal5", "Effect" : "Allow", "Action" : "ec2:TerminateInstances", "Resource" : "*", "Condition" : { "Null" : { "ec2:ResourceTag/aws:ec2spot:fleet-request-id" : false } } }, { "Sid" : "AWSThinkboxAWSPortal6", "Effect" : "Allow", "Action" : "ec2:TerminateInstances", "Resource" : "*", "Condition" : { "ArnLike" : { "ec2:PlacementGroup" : "arn:aws:ec2:*:*:placement-group/*DeadlinePlacementGroup*" } } }, { "Sid" : "AWSThinkboxAWSPortal7", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "ArnLike" : { "ec2:PlacementGroup" : "arn:aws:ec2:*:*:placement-group/*DeadlinePlacementGroup*" } } }, { "Sid" : "AWSThinkboxAWSPortal8", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "*", "Condition" : { "StringLike" : { "ec2:CreateAction" : "RunInstances" } } }, { "Sid" : "AWSThinkboxAWSPortal9", "Effect" : "Allow", "Action" : [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource" : [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:natgateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ] }, { "Sid" : "AWSThinkboxAWSPortal10", "Effect" : "Allow", "Action" : [ "iam:GetUser" ], "Resource" : "*" }, { "Sid" : "AWSThinkboxAWSPortal11", "Effect" : "Allow", "Action" : [ "iam:GetInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/AWSPortal*" ] }, { "Sid" : "AWSThinkboxAWSPortal12", "Effect" : "Allow", "Action" : [ "iam:GetPolicy", "iam:ListEntitiesForPolicy", "iam:ListPolicyVersions" ], "Resource" : [ "arn:aws:iam::*:policy/AWSPortal*" ] }, { "Sid" : "AWSThinkboxAWSPortal13", "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:GetRolePolicy" ], "Resource" : [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ] }, { "Sid" : "AWSThinkboxAWSPortal14", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AWSPortal*", "arn:aws:iam::*:role/DeadlineSpot*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com", "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AWSThinkboxAWSPortal15", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/*", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "ec2fleet.amazonaws.com", "spot.amazonaws.com", "spotfleet.amazonaws.com" ] } } }, { "Sid" : "AWSThinkboxAWSPortal16", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketVersioning", "s3:PutBucketAcl", "s3:PutBucketCORS", "s3:PutBucketVersioning", "s3:GetBucketAcl", "s3:GetObject", "s3:PutBucketLogging", "s3:PutBucketTagging", "s3:PutObject", "s3:ListBucket", "s3:ListBucketVersions", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:DeleteBucket", "s3:DeleteObject", "s3:DeleteBucketPolicy", "s3:DeleteObjectVersion" ], "Resource" : [ "arn:aws:s3::*:awsportal*", "arn:aws:s3::*:stack*", "arn:aws:s3::*:aws-portal-cache*", "arn:aws:s3::*:logs-for-aws-portal-cache*", "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid" : "AWSThinkboxAWSPortal17", "Effect" : "Allow", "Action" : [ "s3:PutBucketPolicy" ], "Resource" : [ "arn:aws:s3::*:logs-for-aws-portal-cache*" ] }, { "Sid" : "AWSThinkboxAWSPortal18", "Effect" : "Allow", "Action" : [ "s3:PutBucketOwnershipControls" ], "Resource" : [ "arn:aws:s3::*:logs-for-stack*" ] }, { "Sid" : "AWSThinkboxAWSPortal19", "Effect" : "Allow", "Action" : [ "s3:ListAllMyBuckets" ], "Resource" : "*" }, { "Sid" : "AWSThinkboxAWSPortal20", "Effect" : "Allow", "Action" : [ "dynamodb:Scan" ], "Resource" : "arn:aws:dynamodb:*:*:table/DeadlineFleetHealth*" }, { "Sid" : "AWSThinkboxAWSPortal21", "Effect" : "Allow", "Action" : [ "cloudformation:CreateStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResources", "cloudformation:DeleteStack", "cloudformation:DeleteChangeSet", "cloudformation:ListStackResources", "cloudformation:CreateChangeSet", "cloudformation:DescribeChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:UpdateTerminationProtection", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource" : [ "arn:aws:cloudformation:*:*:stack/stack*/*", "arn:aws:cloudformation:*:*:stack/Deadline*/*" ] }, { "Sid" : "AWSThinkboxAWSPortal22", "Effect" : "Allow", "Action" : [ "cloudformation:EstimateTemplateCost", "cloudformation:DescribeStacks", "cloudformation:ListStacks" ], "Resource" : "*" }, { "Sid" : "AWSThinkboxAWSPortal23", "Effect" : "Allow", "Action" : [ "logs:DescribeLogStreams", "logs:GetLogEvents", "logs:PutRetentionPolicy", "logs:DeleteRetentionPolicy" ], "Resource" : "arn:aws:logs:*:*:log-group:/thinkbox*" }, { "Sid" : "AWSThinkboxAWSPortal24", "Effect" : "Allow", "Action" : [ "logs:DescribeLogGroups", "logs:CreateLogGroup" ], "Resource" : "*" }, { "Sid" : "AWSThinkboxAWSPortal25", "Effect" : "Allow", "Action" : [ "kms:Encrypt", "kms:GenerateDataKey" ], "Resource" : [ "*" ], "Condition" : { "StringLike" : { "kms:ViaService" : [ "s3.*.amazonaws.com", "secretsmanager.*.amazonaws.com" ] } } }, { "Sid" : "AWSThinkboxAWSPortal26", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret" ], "Resource" : "*", "Condition" : { "StringLike" : { "secretsmanager:Name" : [ "rcs-tls-pw*" ] } } }, { "Sid" : "AWSThinkboxAWSPortal27", "Effect" : "Allow", "Action" : [ "secretsmanager:DeleteSecret", "secretsmanager:UpdateSecret", "secretsmanager:DescribeSecret", "secretsmanager:TagResource" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:rcs-tls-pw*" } ] }
進一步了解
