使用 設定 Amazon Neptune 的先決條件 AWS CloudFormation

使用 AWS CloudFormation 範本建立 Amazon Neptune 叢集之前，您需要具備下列項目：

• 一個 Amazon EC2 金鑰對。

• 使用 所需的許可 AWS CloudFormation。

建立用於使用 啟動 Neptune 叢集的 Amazon EC2 金鑰對 AWS CloudFormation

若要使用 AWS CloudFormation 範本啟動 Neptune 資料庫叢集，您必須在建立 AWS CloudFormation 堆疊的區域中有可用的 Amazon EC2key對 （及其相關聯的 PEM 檔案）。

如果您需要建立金鑰對，請參閱《Amazon EC2 使用者指南》中的使用 Amazon EC2 建立金鑰對，或《Amazon EC2 使用者指南》中的使用 Amazon EC2 建立金鑰對以取得指示。 Amazon EC2 Amazon EC2

新增 IAM 政策以授予使用 AWS CloudFormation 範本所需的許可

首先，您需要設定 IAM 使用者，讓其具有使用 Neptune 所需的許可，如 建立具有 Neptune 許可的 IAM 使用者 中所述。

然後，您需要將 AWS 受管政策 AWSCloudFormationReadOnlyAccess新增至該使用者。

最後，您需要建立下列客戶受管政策，並將其新增至該使用者：

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": "iam:PassRole",
			"Resource": "arn:aws:iam::0123456789012:role/*",
			"Condition": {
				"StringEquals": {
					"iam:passedToService": "rds.amazonaws.com"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": "iam:CreateServiceLinkedRole",
			"Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
			"Condition": {
				"StringLike": {
					"iam:AWSServiceName": "rds.amazonaws.com"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"sns:ListTopics",
				"sns:ListSubscriptions",
				"sns:Publish"
			],
			"Resource":  "arn:aws:sns:*:0123456789012:*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"kms:ListRetirableGrants",
				"kms:ListKeys",
				"kms:ListAliases",
				"kms:ListKeyPolicies"
			],
			"Resource": "arn:aws:kms:*:0123456789012:key/*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"cloudwatch:GetMetricStatistics",
				"cloudwatch:ListMetrics"
			],
			"Resource": "arn:aws:cloudwatch:*:0123456789012:service/*-*",
			"Condition": {
				"StringLike": {
                    "cloudwatch:namespace": "AWS/Neptune"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeAvailabilityZones",
				"ec2:DescribeVpcs",
				"ec2:DescribeAccountAttributes",
				"ec2:DescribeSubnets",
				"ec2:DescribeVpcAttribute"
			],
			"Resource": [
				"arn:aws:ec2:*:0123456789012:vpc/*",
				"arn:aws:ec2:*:0123456789012:subnet/*",
				"arn:aws:ec2:*:0123456789012:security-group/*"
			]
		},
		{
			"Effect": "Allow",
			"Action": [
				"rds:CreateDBCluster",
				"rds:CreateDBInstance",
				"rds:AddTagsToResource",
				"rds:ListTagsForResource",
				"rds:RemoveTagsFromResource",
				"rds:RemoveRoleFromDBCluster",
				"rds:ResetDBParameterGroup",
				"rds:CreateDBSubnetGroup",
				"rds:ModifyDBParameterGroup",
				"rds:DownloadDBLogFilePortion",
				"rds:CopyDBParameterGroup",
				"rds:AddRoleToDBCluster",
				"rds:ModifyDBInstance",
				"rds:ModifyDBClusterParameterGroup",
				"rds:ModifyDBClusterSnapshotAttribute",
				"rds:DeleteDBInstance",
				"rds:CopyDBClusterParameterGroup",
				"rds:CreateDBParameterGroup",
				"rds:DescribeDBSecurityGroups",
				"rds:DeleteDBSubnetGroup",
				"rds:DescribeValidDBInstanceModifications",
				"rds:ModifyDBCluster",
				"rds:CreateDBClusterSnapshot",
				"rds:DeleteDBParameterGroup",
				"rds:CreateDBClusterParameterGroup",
				"rds:RemoveTagsFromResource",
				"rds:PromoteReadReplicaDBCluster",
				"rds:RestoreDBClusterFromSnapshot",
				"rds:DescribeDBSubnetGroups",
				"rds:DescribePendingMaintenanceActions",
				"rds:DescribeDBParameterGroups",
				"rds:FailoverDBCluster",
				"rds:DescribeDBInstances",
				"rds:DescribeDBParameters",
				"rds:DeleteDBCluster",
				"rds:ResetDBClusterParameterGroup",
				"rds:RestoreDBClusterToPointInTime",
				"rds:DescribeDBClusterSnapshotAttributes",
				"rds:AddTagsToResource",
				"rds:DescribeDBClusterParameters",
				"rds:CopyDBClusterSnapshot",
				"rds:DescribeDBLogFiles",
				"rds:DeleteDBClusterSnapshot",
				"rds:ListTagsForResource",
				"rds:RebootDBInstance",
				"rds:DescribeDBClusterSnapshots",
				"rds:DeleteDBClusterParameterGroup",
				"rds:ApplyPendingMaintenanceAction",
				"rds:DescribeDBClusters",
				"rds:DescribeDBClusterParameterGroups",
				"rds:ModifyDBSubnetGroup"
			],
			"Resource": [
				"arn:aws:rds:*:0123456789012:cluster-snapshot:*",
				"arn:aws:rds:*:0123456789012:cluster:*",
				"arn:aws:rds:*:0123456789012:pg:*",
				"arn:aws:rds:*:0123456789012:cluster-pg:*",
				"arn:aws:rds:*:0123456789012:secgrp:*",
				"arn:aws:rds:*:0123456789012:db:*",
				"arn:aws:rds:*:0123456789012:subgrp:*"
			],
			"Condition": {
				"StringEquals": {
					"rds:DatabaseEngine": [
						"graphdb",
						"neptune"
					]
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"logs:GetLogEvents",
				"logs:DescribeLogStreams"
			],
			"Resource": [
				"arn:aws:logs:*:0123456789012:log-group:*:log-stream:*",
				"arn:aws:logs:*:0123456789012:log-group:*"
			]
		}
	]
}

注意

刪除堆疊僅需下列許可：iam:DeleteRole、iam:RemoveRoleFromInstanceProfile、iam:DeleteRolePolicy、iam:DeleteInstanceProfile、及 ec2:DeleteVpcEndpoints。

亦請注意 ec2:*Vpc授予 ec2:DeleteVpc 許可。