本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
安裝程序配置資源的最低 IAM 策略
當您安裝AWS IoT Greengrass核心軟件,您可以預配所需AWS資源,例如AWS IoT事物以及設備的 IAM 角色。您還可以將本地開發工具部署到設備。安裝程序需要AWS憑據,以便可以在您的AWS 帳戶。如需詳細資訊,請參閱 安裝 AWS IoT Greengrass 核心軟體。
以下範例政策包含安裝程序置備這些資源所需的最少動作組合。如果您指定--provision
參數。Replaceaccount-id
與您的AWS 帳戶ID,並替換綠草 V2 代幣交換
中指定的令牌交換角色的名稱,該角色使用--tes-role-name
安裝程序參數。
注意
所以此DeployDevTools
策略語句只有在指定--deploy-dev-tools
參數。
- Greengrass nucleus v2.5.0 and later
-
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTokenExchangeRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreateRole", "iam:GetPolicy", "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::
account-id
:role/GreengrassV2TokenExchangeRole
", "arn:aws:iam::account-id
:policy/GreengrassV2TokenExchangeRole
Access" ] }, { "Sid": "CreateIoTResources", "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachThingPrincipal", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreateRoleAlias", "iot:CreateThing", "iot:CreateThingGroup", "iot:DescribeEndpoint", "iot:DescribeRoleAlias", "iot:DescribeThingGroup", "iot:GetPolicy" ], "Resource": "*" }, { "Sid": "DeployDevTools", "Effect": "Allow", "Action": [ "greengrass:CreateDeployment", "iot:CancelJob", "iot:CreateJob", "iot:DeleteThingShadow", "iot:DescribeJob", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:GetThingShadow", "iot:UpdateJob", "iot:UpdateThingShadow" ], "Resource": "*" } ] } - Earlier than v2.5.0
-
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTokenExchangeRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreateRole", "iam:GetPolicy", "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::
account-id
:role/GreengrassV2TokenExchangeRole
", "arn:aws:iam::account-id
:policy/GreengrassV2TokenExchangeRole
Access", "arn:aws:iam::aws:policy/GreengrassV2TokenExchangeRole
Access" ] }, { "Sid": "CreateIoTResources", "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachThingPrincipal", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreateRoleAlias", "iot:CreateThing", "iot:CreateThingGroup", "iot:DescribeEndpoint", "iot:DescribeRoleAlias", "iot:DescribeThingGroup", "iot:GetPolicy" ], "Resource": "*" }, { "Sid": "DeployDevTools", "Effect": "Allow", "Action": [ "greengrass:CreateDeployment", "iot:CancelJob", "iot:CreateJob", "iot:DeleteThingShadow", "iot:DescribeJob", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:GetThingShadow", "iot:UpdateJob", "iot:UpdateThingShadow" ], "Resource": "*" } ] }
授權核心設備與AWS服務
Greengrass 服務角色