使用读写权限自动配置 IAM | 启用（托管自动化）

要检查更改类型版本，请使用以下命令：

aws amscm list-change-type-version-summaries --filter Attribute=ChangeTypeId,Value=CT_ID

内联创建：

使用内联提供的执行参数（内联提供执行参数时使用转义引号）发出 create RFC 命令，然后提交返回的 RFC ID。例如，你可以用这样的东西替换内容：

aws amscm create-rfc --change-type-id "ct-1n9gfnog5x7fl" --change-type-version "1.0" --title "Create role or policy" --execution-parameters '{"DocumentName":"AWSManagedServices-HandleAutomatedIAMProvisioningCreate-Admin","Region":"us-east-1","Parameters":{"ValidateOnly":"No"},"RoleDetails":{"Roles":[{"RoleName":"RoleTest01","Description":"This is a test role","AssumeRolePolicyDocument":"{"Version": "2012-10-17", "Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]}","ManagedPolicyArns":["arn:aws:iam::123456789012:policy/policy01","arn:aws:iam::123456789012:policy/policy02"],"Path":"/","MaxSessionDuration":"7200","PermissionsBoundary":"arn:aws:iam::123456789012:policy/permission_boundary01","InstanceProfile":"No"}]},"ManagedPolicyDetails":{"Policies":[{"ManagedPolicyName":"TestPolicy01","Description":"This is customer policy","Path":"/test/","PolicyDocument":"{"Version":"2012-10-17","Statement":[{"Sid":"AllQueueActions","Effect":"Allow","Action":"sqs:ListQueues","Resource":"*","Condition":{"ForAllValues:StringEquals":{"aws:tagKeys":["temporary"]}}}]}"}]}}'

模板创建：

1. 将此更改类型的执行参数 JSON 架构输出到文件中；示例将其命名为 CreateIamResourceParams .json：

   aws amscm get-change-type-version --change-type-id "ct-1n9gfnog5x7fl" --query "ChangeTypeVersion.ExecutionInputSchema" --output text > CreateIamResourceParams.json

2. 修改并保存 CreateIamResourceParams 文件；示例创建一个 IAM 角色，其中策略文档以内联方式粘贴。

   {
     "DocumentName": "AWSManagedServices-HandleAutomatedIAMProvisioningCreate-Admin",
     "Region": "us-east-1",
     "Parameters": {
       "ValidateOnly": "No"
     },
     "RoleDetails": {
       "Roles": [
         {
           "RoleName": "RoleTest01",
           "Description": "This is a test role",
           "AssumeRolePolicyDocument": {
             "Version": "2012-10-17", 
             "Statement": [
               {
                 "Effect": "Allow",
                 "Principal": {
                   "AWS": "arn:aws:iam::123456789012:root"
                 },
                 "Action": "sts:AssumeRole"
               }
             ]
           },
           "ManagedPolicyArns": [
             "arn:aws:iam::123456789012:policy/policy01",
             "arn:aws:iam::123456789012:policy/policy02"
           ],
           "Path": "/",
           "MaxSessionDuration": "7200",
           "PermissionsBoundary": "arn:aws:iam::123456789012:policy/permission_boundary01",
           "InstanceProfile": "No"
         }
       ]
     },
     "ManagedPolicyDetails": {
       "Policies": [
         {
           "ManagedPolicyName": "TestPolicy01",
           "Description": "This is customer policy",
           "Path": "/test/",
           "PolicyDocument": {
             "Version": "2012-10-17", 
             "Statement": [
               {
                 "Sid": "AllQueueActions",
                 "Effect": "Allow",
                 "Action": "sqs:ListQueues",
                 "Resource": "*",
                 "Condition": {
                   "ForAllValues:StringEquals": {
                     "aws:tagKeys": [
                       "temporary"
                     ]
                   }
                 }
               }
             ]
           }
         }
       ]
     }
   }

3. 将 RFC 模板 JSON 文件输出到名为 CreateIamResourceRfc .json 的文件中：

   aws amscm create-rfc --generate-cli-skeleton > CreateIamResourceRfc.json

4. 修改并保存 CreateIamResourceRfc .json 文件。例如，你可以用这样的东西替换内容：

   {
     "ChangeTypeVersion": "1.0",
     "ChangeTypeId": "ct-1n9gfnog5x7fl",
     "Title": "Create entity or policy (read-write permissions)"
   }

5. 创建 RFC，指定 CreateIamResourceRfc 文件和 CreateIamResourceParams 文件：

   aws amscm create-rfc --cli-input-json file://CreateIamResourceRfc.json  --execution-parameters file://CreateIamResourceParams.json

   您在响应中收到新 RFC 的 ID，并可以使用它来提交和监控 RFC。在您提交之前，RFC 仍处于编辑状态且无法启动。