本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# CodeDeploy 权限参考
<a name="auth-and-access-control-permissions-reference"></a>

在设置访问权限以及编写可附加到 IAM 身份的权限策略（基于身份的策略）时，请使用下表。该表列出了每个 CodeDeploy API 操作、您可以授予执行该操作的权限的操作以及用于授予权限的资源 ARN 的格式。请在策略的 `Action` 字段中指定这些操作。您可以在策略的 `Resource` 字段中指定带或不带通配符（\*）的 ARN 作为资源值。

您可以在 CodeDeploy 策略中使用 AWS-wide 条件键来表达条件。有关 AWS范围密钥的完整列表，请参阅 *IAM 用户指南*中的[可用密钥](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#AvailableKeys)。

要指定操作，请在 API 操作名称之前使用 `codedeploy:` 前缀（例如，`codedeploy:GetApplication` 和 `codedeploy:CreateApplication`）。要在单个语句中指定多项操作，请使用逗号将它们隔开（例如，`"Action": ["codedeploy:action1", "codedeploy:action2"]`）。

**使用通配符**

您可以在 ARN 使用通配符（\*）以指定多个操作或资源。例如，`codedeploy:*`指定所有 CodeDeploy 动作并`codedeploy:Get*`指定以单词开头的所有 CodeDeploy 动作`Get`。以下示例授予对名称以 `West` 开头且与名称以 `Test` 开头的应用程序关联的所有部署组的访问权限。

```
arn:aws:codedeploy:us-west-2:444455556666:deploymentgroup:Test*/West*
```

您可以将通配符与表中列出的以下资源一起使用：
+ {{application-name}}
+ {{deployment-group-name}}
+ {{deployment-configuration-name}}
+ {{instance-ID}}

通配符不能与{{region}}或{{account-id}}一起使用。有关通配符的更多信息，请参阅 *IAM 用户指南*中的 [IAM 标识符](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)。

**注意**  
 在每个操作的 ARN 中，资源后跟一个冒号（:）。您还可以让资源后跟正斜杠（/）。有关更多信息，请参阅 [ARN CodeDeploy 示例](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-codedeploy)。

使用滚动条查看表的其余部分。


**CodeDeploy API 操作和操作所需的权限**  

<table>
<thead>
  <tr><th>CodeDeploy API 操作</th><th>所需权限（API 操作）</th><th>资源</th></tr>
</thead>
<tbody>
  <tr><td>[AddTagsToOnPremisesInstances](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_AddTagsToOnPremisesInstances.html)</td><td>`codedeploy:AddTagsToOnPremisesInstances`<br />向一个或多个本地实例添加标签所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td>[BatchGetApplicationRevisions](https://docs.aws.amazon.com/codedeploy/latest/APIReference/BatchGetApplicationRevisions.html)</td><td>`codedeploy:BatchGetApplicationRevisions`<br />获取有关与 用户关联的多个应用程序版本的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td>[BatchGetApplications](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetApplications.html)</td><td>`codedeploy:BatchGetApplications`<br />获取有关与 用户关联的多个应用程序的信息所必需的。</td><td>arn: aws: codedeploy::: 应用程序:\* {{region}} {{account-id}}</td></tr>
  <tr><td>[BatchGetDeploymentGroups](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentGroups.html)</td><td>`codedeploy:BatchGetDeploymentGroups`<br />获取有关与 用户关联的多个部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[BatchGetDeploymentInstances](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentInstances.html)</td><td>codedeploy:BatchGetDeploymentInstances获取有关部署组中的一个或多个实例的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[BatchGetDeployments](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeployments.html)</td><td>`codedeploy:BatchGetDeployments`<br />获取有关与 用户关联的多个部署的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[BatchGetOnPremisesInstances](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetOnPremisesInstances.html)</td><td>`codedeploy:BatchGetOnPremisesInstances`<br />获取有关一个或多个本地实例的信息所必需的。</td><td>arn: aws: codedeploy::: \* {{region}} {{account-id}}</td></tr>
  <tr><td>[ContinueDeployment](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ContinueDeployment.html)</td><td>`codedeploy:ContinueDeployment`<br />在 blue/green 部署期间，需要启动使用 Elastic Load Balancing 负载均衡器在替代环境中注册实例的过程。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[CreateApplication](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateApplication.html)</td><td>`codedeploy:CreateApplication`<br />创建与 用户关联的应用程序所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td>[CreateDeployment](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeployment.html)¹</td><td>`codedeploy:CreateDeployment`<br />为与 用户关联的应用程序创建部署所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[CreateDeploymentConfig](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentConfig.html)</td><td>`codedeploy:CreateDeploymentConfig`<br />创建与 用户关联的自定义部署配置所必需的。</td><td>arn: aws: codedeploy::: 部署配置:{{region}}{{account-id}}{{deployment-configuration-name}} </td></tr>
  <tr><td>[CreateDeploymentGroup](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentGroup.html)</td><td>`codedeploy:CreateDeploymentGroup`<br />为与 用户关联的应用程序创建部署组所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[DeleteApplication](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteApplication.html)</td><td>`codedeploy:DeleteApplication`<br />删除与 用户关联的应用程序所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td>[DeleteDeploymentConfig](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentConfig.html)</td><td>`codedeploy:DeleteDeploymentConfig`<br />删除与 用户关联的自定义部署配置所必需的。</td><td>arn: aws: codedeploy::: 部署配置:{{region}}{{account-id}}{{deployment-configuration-name}} </td></tr>
  <tr><td>[DeleteDeploymentGroup](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentGroup.html)</td><td>`codedeploy:DeleteDeploymentGroup`<br />为与 用户关联的应用程序删除部署组所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[DeregisterOnPremisesInstance](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeregisterOnPremisesInstance.html)</td><td>`codedeploy:DeregisterOnPremisesInstance`<br />取消注册本地实例所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td>[GetApplication](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplication.html)</td><td>`codedeploy:GetApplication`<br />获取有关与 用户关联的单个应用程序的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td>[GetApplicationRevision](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplicationRevision.html)</td><td>`codedeploy:GetApplicationRevision`<br />获取有关与 用户关联的应用程序的单个应用程序修订的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td>[GetDeployment](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeployment.html)</td><td>`codedeploy:GetDeployment`<br />获取针对与 用户关联的应用程序的部署组的单个部署的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[GetDeploymentConfig](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentConfig.html)</td><td>`codedeploy:GetDeploymentConfig`<br />获取有关与 用户关联的单个部署配置的信息所必需的。</td><td>arn: aws: codedeploy::: 部署配置:{{region}}{{account-id}}{{deployment-configuration-name}} </td></tr>
  <tr><td>[GetDeploymentGroup](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentGroup.html)</td><td>`codedeploy:GetDeploymentGroup`<br />获取有关与 用户关联的应用程序的单个部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[GetDeploymentInstance](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentInstance.html)</td><td>`codedeploy:GetDeploymentInstance`<br />获取有关部署中与 用户关联的单个实例的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[GetDeploymentTarget](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentTarget.html)</td><td>`codedeploy:GetDeploymentTarget`<br />获取有关部署中与 用户关联的目标的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[GetOnPremisesInstance](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetOnPremisesInstance.html)</td><td>`codedeploy:GetOnPremisesInstance`<br />获取有关单个本地实例的信息所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td>[ListApplicationRevisions](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplicationRevisions.html)</td><td>`codedeploy:ListApplicationRevisions`<br />获取有关与 用户关联的应用程序的所有应用程序修订的信息所必需的。</td><td>arn: aws: codedeploy::: 应用程序:\* {{region}} {{account-id}}</td></tr>
  <tr><td>[ListApplications](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplications.html)</td><td>`codedeploy:ListApplications`<br />获取有关与 用户关联的所有应用程序的信息所必需的。</td><td>arn: aws: codedeploy::: 应用程序:\* {{region}} {{account-id}}</td></tr>
  <tr><td>[ListDeploymentConfigs](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentConfigs.html)</td><td>`codedeploy:ListDeploymentConfigs`<br />获取有关与 用户关联的所有部署配置的信息所必需的。</td><td>arn: aws: codedeploy::: 部署配置:\* {{region}} {{account-id}}</td></tr>
  <tr><td>[ListDeploymentGroups](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentGroups.html)</td><td>`codedeploy:ListDeploymentGroups`<br />获取有关与 用户关联的应用程序的所有部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/\* {{region}} {{account-id}} {{application-name}}</td></tr>
  <tr><td>[ListDeploymentInstances](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentInstances.html)</td><td>`codedeploy:ListDeploymentInstances`<br />需要获取有关部署中与用户或 AWS 账户关联的所有实例的信息。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[ListDeployments](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeployments.html)</td><td>`codedeploy:ListDeployments`<br />获取有关针对与用户关联的部署组的所有部署的信息所必需的，或获取与用户的所有部署所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[ListDeploymentTargets](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentTargets.html)</td><td>`codedeploy:ListDeploymentTargets`<br />获取有关部署中与用户关联的所有目标的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[ListGitHubAccountTokenNames](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListGitHubAccountTokenNames.html)</td><td>`codedeploy:ListGitHubAccountTokenNames`<br />需要获取已存储的 GitHub 账户连接的名称列表。</td><td>arn: aws: codedeploy::: \* {{region}} {{account-id}}</td></tr>
  <tr><td>[ListOnPremisesInstances](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListOnPremisesInstances.html)</td><td>`codedeploy:ListOnPremisesInstances`<br />获取一个或更多本地实例名称的列表所必需的。</td><td>arn: aws: codedeploy::: \* {{region}} {{account-id}}</td></tr>
  <tr><td>PutLifecycleEventHookExecutionStatus</td><td>`codedeploy:PutLifecycleEventHookExecutionStatus`<br />对于提供生命周期挂钩事件的执行状态通知是必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[RegisterApplicationRevision](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterApplicationRevision.html)</td><td>`codedeploy:RegisterApplicationRevision`<br />注册有关与 用户关联的应用程序的一个应用程序修订的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td>[RegisterOnPremisesInstance](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterOnPremisesInstance.html)</td><td>`codedeploy:RegisterOnPremisesInstance`<br />向 CodeDeploy 注册本地实例所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td>[RemoveTagsFromOnPremisesInstances](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RemoveTagsFromOnPremisesInstances.html)</td><td>`codedeploy:RemoveTagsFromOnPremisesInstances`<br />从一个或多个本地实例中删除标签所必需的。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td>[SkipWaitTimeForInstanceTermination](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_SkipWaitTimeForInstanceTermination.html)</td><td>`codedeploy:SkipWaitTimeForInstanceTermination`<br />在 blue/green 部署中需要覆盖指定的等待时间并立即开始终止原始环境中的实例。</td><td>arn: aws: codedeploy:: instance/ {{region}} {{account-id}} {{instance-ID}}</td></tr>
  <tr><td>[StopDeployment](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_StopDeployment.html)</td><td>`codedeploy:StopDeployment`<br />停止正在进行的部署到与 用户关联的应用程序的部署组所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td>[UpdateApplication](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateApplication.html)³</td><td>`codedeploy:UpdateApplication`<br />更改有关与 用户关联的应用程序的信息所必需的。</td><td>arn: aws: codeploy::: 应用程序:{{region}}{{account-id}}{{application-name}}</td></tr>
  <tr><td>[UpdateDeploymentGroup](https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateDeploymentGroup.html)³</td><td>`codedeploy:UpdateDeploymentGroup`<br />更改有关与 用户关联的应用程序的单个部署组的信息所必需的。</td><td>arn: aws: codedeploy::: 部署组:/{{region}}{{account-id}}{{application-name}}{{deployment-group-name}}</td></tr>
  <tr><td colspan="3">¹ 当您指定 `GetDeploymentConfig` 权限时，还必须为部署配置指定 `GetApplicationRevision` 权限，并且为应用程序修订指定 `CreateDeployment` 或 `RegisterApplicationRevision` 权限。此外，如果您在 `CreateDeployment` API 调用中包含 `overrideAlarmConfiguration` 参数，则必须指定 `UpdateDeploymentGroup` 权限。<br />² 在提供特定部署组时对 `ListDeployments` 有效，但在列出所有与用户关联的部署时无效。<br />³ 对于 `UpdateApplication`，您必须同时对旧应用程序名称和新应用程序名称具有 `UpdateApplication` 权限。对于涉及更改部署组名称的 `UpdateDeploymentGroup` 操作，您必须同时具有对旧的和新的部署组名称的 `UpdateDeploymentGroup` 权限。</td></tr>
</tbody>
</table>