本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # AWSSupplyChainFederationAdminAccess **描述**： AWSSupplyChainFederationAdminAccess 为 AWS 供应链联合用户提供对 AWS 供应链应用程序的访问权限，包括在 AWS 供应链应用程序中执行操作所需的权限。该策略提供对 IAM Identity Center 用户和群组的管理权限，并附加到 Su AWS pply Chain 代表您创建的角色。您不应将 AWSSupplyChainFederationAdminAccess 策略附加到任何其他 IAM 实体。 `AWSSupplyChainFederationAdminAccess` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 您可以将 `AWSSupplyChainFederationAdminAccess` 附加到您的用户、组和角色。 ## 策略详细信息 + **类型**：服务角色策略 + **创建时间**：2023 年 3 月 1 日 18:54 UTC + **编辑时间：世界标准时间** 2026 年 2 月 12 日 18:02 + **ARN**: `arn:aws:iam::aws:policy/service-role/AWSSupplyChainFederationAdminAccess` ## 策略版本 **策略版本：**v9（默认） 此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AWSSupplyChain", "Effect" : "Allow", "Action" : [ "scn:*" ], "Resource" : [ "arn:aws:scn:*:*:instance/*" ] }, { "Sid" : "ChimeAppInstance", "Effect" : "Allow", "Action" : [ "chime:BatchCreateChannelMembership", "chime:CreateAppInstanceUser", "chime:CreateChannel", "chime:CreateChannelMembership", "chime:CreateChannelModerator", "chime:Connect", "chime:DeleteChannelMembership", "chime:DeleteChannelModerator", "chime:DescribeChannelMembershipForAppInstanceUser", "chime:GetChannelMembershipPreferences", "chime:ListChannelMemberships", "chime:ListChannelMembershipsForAppInstanceUser", "chime:ListChannelMessages", "chime:ListChannelModerators", "chime:TagResource", "chime:PutChannelMembershipPreferences", "chime:SendChannelMessage", "chime:UpdateChannelReadMarker", "chime:UpdateAppInstanceUser" ], "Resource" : [ "arn:aws:chime:*:*:app-instance/*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/SCNInstanceId" : "*" } } }, { "Sid" : "ChimeChannel", "Effect" : "Allow", "Action" : [ "chime:DescribeChannel" ], "Resource" : [ "arn:aws:chime:*:*:app-instance/*" ] }, { "Sid" : "ChimeMessaging", "Effect" : "Allow", "Action" : [ "chime:GetMessagingSessionEndpoint" ], "Resource" : "*" }, { "Sid" : "IAMIdentityCenter", "Effect" : "Allow", "Action" : [ "sso:GetManagedApplicationInstance", "sso:ListDirectoryAssociations", "sso:AssociateProfile", "sso:DisassociateProfile", "sso:ListProfiles", "sso:GetProfile", "sso:ListProfileAssociations", "sso:ListApplicationAssignments", "sso:DescribeApplication", "sso:DescribeInstance", "sso:GetApplicationAssignmentConfiguration" ], "Resource" : "*" }, { "Sid" : "AppflowConnectorProfile", "Effect" : "Allow", "Action" : [ "appflow:CreateConnectorProfile", "appflow:UseConnectorProfile", "appflow:DeleteConnectorProfile", "appflow:UpdateConnectorProfile" ], "Resource" : [ "arn:aws:appflow:*:*:connectorprofile/scn-*" ] }, { "Sid" : "AppflowFlow", "Effect" : "Allow", "Action" : [ "appflow:CreateFlow", "appflow:DeleteFlow", "appflow:DescribeFlow", "appflow:DescribeFlowExecutionRecords", "appflow:ListFlows", "appflow:StartFlow", "appflow:StopFlow", "appflow:UpdateFlow", "appflow:TagResource", "appflow:UntagResource" ], "Resource" : [ "arn:aws:appflow:*:*:flow/scn-*" ] }, { "Sid" : "S3ListAllBuckets", "Effect" : "Allow", "Action" : [ "s3:ListAllMyBuckets" ], "Resource" : "*" }, { "Sid" : "S3ListSupplyChainBucket", "Effect" : "Allow", "Action" : [ "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:ListBucket" ], "Resource" : [ "arn:aws:s3:::aws-supply-chain-data-*" ] }, { "Sid" : "S3ReadWriteObject", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:PutObject" ], "Resource" : [ "arn:aws:s3:::aws-supply-chain-data-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "SecretsManagerCreateSecret", "Effect" : "Allow", "Action" : "secretsmanager:CreateSecret", "Resource" : "arn:aws:secretsmanager:*:*:secret:*", "Condition" : { "StringLike" : { "secretsmanager:Name" : "appflow!*" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "appflow.amazonaws.com" ] } } }, { "Sid" : "SecretsManagerPutResourcePolicy", "Effect" : "Allow", "Action" : [ "secretsmanager:PutResourcePolicy" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "appflow.amazonaws.com" ] }, "StringEqualsIgnoreCase" : { "secretsmanager:ResourceTag/aws:secretsmanager:owningService" : "appflow" } } }, { "Sid" : "KMSListKeys", "Effect" : "Allow", "Action" : [ "kms:ListKeys", "kms:ListAliases" ], "Resource" : "arn:aws:kms:*:*:key/*" }, { "Sid" : "KMSListGrants", "Effect" : "Allow", "Action" : [ "kms:DescribeKey", "kms:ListGrants" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringLike" : { "kms:ViaService" : "appflow.*.amazonaws.com" }, "StringEquals" : { "aws:ResourceTag/aws-supply-chain-access" : "true" } } }, { "Sid" : "KMSCreateGrant", "Effect" : "Allow", "Action" : [ "kms:CreateGrant" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringLike" : { "kms:ViaService" : "appflow.*.amazonaws.com" }, "Bool" : { "kms:GrantIsForAWSResource" : "true" }, "StringEquals" : { "aws:ResourceTag/aws-supply-chain-access" : "true" } } }, { "Sid" : "AllowKmsAccessViaIdentityCenter", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : "*", "Condition" : { "ArnLike" : { "kms:EncryptionContext:aws:sso:instance-arn" : "arn:*:sso:::instance/*" }, "StringLike" : { "kms:ViaService" : "sso.*.amazonaws.com" } } }, { "Sid" : "AllowKmsAccessViaIdentityStore", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : "*", "Condition" : { "ArnLike" : { "kms:EncryptionContext:aws:identitystore:identitystore-arn" : "arn:*:identitystore::*:identitystore/*" }, "StringLike" : { "kms:ViaService" : "identitystore.*.amazonaws.com" } } } ] } ``` ## 了解详情 + [在 IAM 身份中心使用 AWS 托管策略创建权限集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [添加和删除 IAM 身份权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM policy 版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略，转向最低权限权限](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)