安裝程序配置資源的最低 IAM 策略 - AWS IoT Greengrass

本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。

安裝程序配置資源的最低 IAM 策略

當您安裝AWS IoT Greengrass核心軟件,您可以預配所需AWS資源,例如AWS IoT事物以及設備的 IAM 角色。您還可以將本地開發工具部署到設備。安裝程序需要AWS憑據,以便可以在您的AWS 帳戶。如需詳細資訊,請參閱 安裝 AWS IoT Greengrass 核心軟體

以下範例政策包含安裝程序置備這些資源所需的最少動作組合。如果您指定--provision參數。Replaceaccount-id與您的AWS 帳戶ID,並替換綠草 V2 代幣交換中指定的令牌交換角色的名稱,該角色使用--tes-role-name 安裝程序參數

注意

所以此DeployDevTools策略語句只有在指定--deploy-dev-tools參數。

Greengrass nucleus v2.5.0 and later
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTokenExchangeRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreateRole", "iam:GetPolicy", "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::account-id:role/GreengrassV2TokenExchangeRole", "arn:aws:iam::account-id:policy/GreengrassV2TokenExchangeRoleAccess" ] }, { "Sid": "CreateIoTResources", "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachThingPrincipal", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreateRoleAlias", "iot:CreateThing", "iot:CreateThingGroup", "iot:DescribeEndpoint", "iot:DescribeRoleAlias", "iot:DescribeThingGroup", "iot:GetPolicy" ], "Resource": "*" }, { "Sid": "DeployDevTools", "Effect": "Allow", "Action": [ "greengrass:CreateDeployment", "iot:CancelJob", "iot:CreateJob", "iot:DeleteThingShadow", "iot:DescribeJob", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:GetThingShadow", "iot:UpdateJob", "iot:UpdateThingShadow" ], "Resource": "*" } ] }
Earlier than v2.5.0
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTokenExchangeRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreateRole", "iam:GetPolicy", "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::account-id:role/GreengrassV2TokenExchangeRole", "arn:aws:iam::account-id:policy/GreengrassV2TokenExchangeRoleAccess", "arn:aws:iam::aws:policy/GreengrassV2TokenExchangeRoleAccess" ] }, { "Sid": "CreateIoTResources", "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachThingPrincipal", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreateRoleAlias", "iot:CreateThing", "iot:CreateThingGroup", "iot:DescribeEndpoint", "iot:DescribeRoleAlias", "iot:DescribeThingGroup", "iot:GetPolicy" ], "Resource": "*" }, { "Sid": "DeployDevTools", "Effect": "Allow", "Action": [ "greengrass:CreateDeployment", "iot:CancelJob", "iot:CreateJob", "iot:DeleteThingShadow", "iot:DescribeJob", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:GetThingShadow", "iot:UpdateJob", "iot:UpdateThingShadow" ], "Resource": "*" } ] }