本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
工作流程監控 IAM 政策
工作流程監視器與多個 AWS 服務進行交互,以創建信號映射,構建 CloudWatch 和 EventBridge 資源以及 AWS CloudFormation 模板。由於工作流程監視器會與各種服務互動,因此必須為這些服務指派特定 AWS Identity and Access Management (IAM) 政策。下列範例說明管理員和操作員 IAM 角色的必要 IAM 政策。
管理員 IAM 政策
下列範例政策適用於管理員層級工作流程監控 IAM 政策。此角色允許建立和管理工作流程監視器資源,以及與工作流程監視器互動的支援服務資源。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:PutAnomalyDetector", "cloudwatch:PutMetricData", "cloudwatch:PutMetricAlarm", "cloudwatch:PutCompositeAlarm", "cloudwatch:PutDashboard", "cloudwatch:DeleteAlarms", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DeleteDashboards", "cloudwatch:TagResource", "cloudwatch:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudfront:List*", "cloudfront:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:List*", "events:Describe*", "events:CreateEventBus", "events:PutRule", "events:PutTargets", "events:EnableRule", "events:DisableRule", "events:DeleteRule", "events:RemoveTargets", "events:TagResource", "events:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:TagLogGroup", "logs:TagResource", "logs:UntagLogGroup", "logs:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediaconnect:List*", "mediaconnect:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "medialive:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage:List*", "mediapackage:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackagev2:List*", "mediapackagev2:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage-vod:List*", "mediapackage-vod:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediatailor:List*", "mediatailor:Describe*", "mediatailor:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:GetGroupQuery", "resource-groups:GetGroupConfiguration", "resource-groups:CreateGroup", "resource-groups:UngroupResources", "resource-groups:GroupResources", "resource-groups:DeleteGroup", "resource-groups:UpdateGroupQuery", "resource-groups:UpdateGroup", "resource-groups:Tag", "resource-groups:Untag" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": "arn:aws:s3:::workflow-monitor-templates*" }, { "Effect": "Allow", "Action": [ "sns:TagResource", "sns:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tag:Get*", "tag:Describe*", "tag:TagResources", "tag:UntagResources" ], "Resource": "*" } ] }
操作員 IAM 政策
下列範例政策適用於操作員層級工作流程監控 IAM 政策。此角色允許對工作流程監視器資源以及與工作流程監視器互動的支援服務資源進行有限且唯讀的存取。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Describe*", "cloudwatch:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudfront:List*", "cloudfront:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:List*", "events:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediaconnect:List*", "mediaconnect:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "medialive:List*", "medialive:Get*", "medialive:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage:List*", "mediapackage:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackagev2:List*", "mediapackagev2:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage-vod:List*", "mediapackage-vod:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediatailor:List*", "mediatailor:Describe*", "mediatailor:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*" ], "Resource": "arn:aws:s3:::workflow-monitor-templates*" }, { "Effect": "Allow", "Action": [ "tag:Get*", "tag:Describe*" ], "Resource": "*" } ] }