本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 用于 ARC 中区域切换的基于身份的策略示例
<a name="security_iam_id-based-policy-examples-region-switch"></a>

默认情况下，用户和角色没有创建或修改 ARC 资源的权限。要授予用户对所需资源执行操作的权限，IAM 管理员可以创建 IAM 策略。

要了解如何使用这些示例 JSON 策略文档创建基于 IAM 身份的策略，请参阅《IAM 用户指南》**中的[创建 IAM 策略（控制台）](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html)。

有关 ARC 定义的操作和资源类型（包括每种资源类型的格式）的详细信息，请参阅《 ARNs *服务授权参考*》中的 [Amazon Application Recovery Controller (ARC) 的操作、资源和条件密钥](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonroute53recoverycontrols.html)。

**Topics**
+ [策略最佳实践](#security_iam_service-with-iam-policy-best-practices-zonal)
+ [计划执行角色信任策略](security_iam_region_switch_trust_policy.md)
+ [完全访问权限](security_iam_region_switch_full_access.md)
+ [只读权限](security_iam_region_switch_read_only.md)
+ [执行块权限](security_iam_region_switch_execution_blocks.md)
+ [CloudWatch 应用程序运行状况权限警报](security_iam_region_switch_cloudwatch.md)
+ [自动计划执行报告权限](security_iam_region_switch_reports.md)
+ [跨账户资源权限](security_iam_region_switch_cross_account.md)
+ [完成计划执行角色权限](security_iam_region_switch_complete_policy.md)

## 策略最佳实践
<a name="security_iam_service-with-iam-policy-best-practices-zonal"></a>

基于身份的策略确定某个人是否可以创建、访问或删除您账户中的 ARC 资源。这些操作可能会使 AWS 账户产生成本。创建或编辑基于身份的策略时，请遵循以下指南和建议：
+ **开始使用 AWS 托管策略并转向最低权限权限** — 要开始向用户和工作负载授予权限，请使用为许多常见用例授予权限的*AWS 托管策略*。它们在你的版本中可用 AWS 账户。我们建议您通过定义针对您的用例的 AWS 客户托管策略来进一步减少权限。有关更多信息，请参阅《IAM 用户指南》**中的 [AWS 托管策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)或[工作职能的AWS 托管策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html)。
+ **应用最低权限**：在使用 IAM 策略设置权限时，请仅授予执行任务所需的权限。为此，您可以定义在特定条件下可以对特定资源执行的操作，也称为*最低权限许可*。有关使用 IAM 应用权限的更多信息，请参阅《IAM 用户指南》**中的 [IAM 中的策略和权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)。
+ **使用 IAM 策略中的条件进一步限制访问权限**：您可以向策略添加条件来限制对操作和资源的访问。例如，您可以编写策略条件来指定必须使用 SSL 发送所有请求。如果服务操作是通过特定的方式使用的，则也可以使用条件来授予对服务操作的访问权限 AWS 服务，例如 CloudFormation。有关更多信息，请参阅《IAM 用户指南》**中的 [IAM JSON 策略元素：条件](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)。
+ **使用 IAM Access Analyzer 验证您的 IAM 策略，以确保权限的安全性和功能性**：IAM Access Analyzer 会验证新策略和现有策略，以确保策略符合 IAM 策略语言（JSON）和 IAM 最佳实践。IAM Access Analyzer 提供 100 多项策略检查和可操作的建议，以帮助您制定安全且功能性强的策略。有关更多信息，请参阅《IAM 用户指南》**中的[使用 IAM Access Analyzer 验证策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html)。
+ **需要多重身份验证 (MFA**)-如果 AWS 账户您的场景需要 IAM 用户或根用户，请启用 MFA 以提高安全性。若要在调用 API 操作时需要 MFA，请将 MFA 条件添加到您的策略中。有关更多信息，请参阅《IAM 用户指南》**中的[使用 MFA 保护 API 访问](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html)。

有关 IAM 中的最佳实操的更多信息，请参阅《IAM 用户指南》**中的 [IAM 中的安全最佳实践](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)。

# 计划执行角色信任策略
<a name="security_iam_region_switch_trust_policy"></a>

 这是计划的执行角色所需的信任策略，以便 ARC 能够运行区域切换计划。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "arc-region-switch.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

------

# 完全访问权限
<a name="security_iam_region_switch_full_access"></a>

以下 IAM 策略授予所有区域切换的完全访问权限 APIs：

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "arc-region-switch.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "arc-region-switch:CreatePlan",
        "arc-region-switch:UpdatePlan",
        "arc-region-switch:GetPlan",
        "arc-region-switch:ListPlans",
        "arc-region-switch:DeletePlan",
        "arc-region-switch:GetPlanInRegion",
        "arc-region-switch:ListPlansInRegion",
        "arc-region-switch:ApprovePlanExecutionStep",
        "arc-region-switch:GetPlanEvaluationStatus",
        "arc-region-switch:GetPlanExecution",
        "arc-region-switch:StartPlanExecution",
        "arc-region-switch:CancelPlanExecution",
        "arc-region-switch:ListRoute53HealthChecks",
        "arc-region-switch:ListRoute53HealthChecksInRegion",
        "arc-region-switch:ListPlanExecutions",
        "arc-region-switch:ListPlanExecutionEvents",
        "arc-region-switch:ListTagsForResource", 
        "arc-region-switch:TagResource",
        "arc-region-switch:UntagResource",
        "arc-region-switch:UpdatePlanExecution",
        "arc-region-switch:UpdatePlanExecutionStep"
      ],
      "Resource": "*"
    }
  ]
}
```

------

# 只读权限
<a name="security_iam_region_switch_read_only"></a>

 以下 IAM 策略授予对区域切换的只读访问权限：

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "arc-region-switch:GetPlan",
        "arc-region-switch:ListPlans",
        "arc-region-switch:GetPlanInRegion",
        "arc-region-switch:ListPlansInRegion",
        "arc-region-switch:GetPlanEvaluationStatus",
        "arc-region-switch:GetPlanExecution",
        "arc-region-switch:ListRoute53HealthChecks",
        "arc-region-switch:ListRoute53HealthChecksInRegion",
        "arc-region-switch:ListPlanExecutions",
        "arc-region-switch:ListPlanExecutionEvents",
        "arc-region-switch:ListTagsForResource"
      ],
      "Resource": "*"
    }
  ]
}
```

------

# 执行块权限
<a name="security_iam_region_switch_execution_blocks"></a>

 以下各节提供示例 IAM 策略，这些策略为您添加到区域切换计划中的特定执行块提供所需的权限。

**Topics**
+ [EC2 Auto Scaling 执行区块示例策略](security_iam_region_switch_ec2_autoscaling.md)
+ [Amazon EKS 资源扩展执行块示例策略](security_iam_region_switch_eks.md)
+ [Amazon ECS 服务扩展执行块示例策略](security_iam_region_switch_ecs.md)
+ [ARC 路由控制执行块策略示例](security_iam_region_switch_arc_routing.md)
+ [Aurora Global Database 执行块示例策略](security_iam_region_switch_aurora.md)
+ [亚马逊 DocumentDB 全球集群执行区块策略示例](security_iam_region_switch_documentdb.md)
+ [Amazon RDS 执行区块策略示例](security_iam_region_switch_rds.md)
+ [手动审批执行块示例策略](security_iam_region_switch_manual_approval.md)
+ [自定义操作 Lambda 执行块示例策略](security_iam_region_switch_lambda.md)
+ [Route 53 运行状况检查执行块示例策略](security_iam_region_switch_route53.md)
+ [区域切换计划执行块示例策略](security_iam_region_switch_plan_execution.md)

# EC2 Auto Scaling 执行区块示例策略
<a name="security_iam_region_switch_ec2_autoscaling"></a>

 以下是在 EC2 Auto Scaling 群组的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "autoscaling:DescribeAutoScalingGroups"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "autoscaling:UpdateAutoScalingGroup"
      ],
      "Resource": [
        "arn:aws:autoscaling:us-east-1:123456789012:autoScalingGroup:123d456e-123e-1111-abcd-EXAMPLE22222:autoScalingGroupName/app-asg-primary",
        "arn:aws:autoscaling:us-west-2:123456789012:autoScalingGroup:1234a321-123e-1234-aabb-EXAMPLE33333:autoScalingGroupName/app-asg-secondary" 
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    }
  ]
}
```

------

# Amazon EKS 资源扩展执行块示例策略
<a name="security_iam_region_switch_eks"></a>

 以下是在 Amazon EKS 资源扩展的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "eks:DescribeCluster"
      ],
      "Resource": [
        "arn:aws:eks:us-east-1:123456789012:cluster/app-eks-primary",
        "arn:aws:eks:us-west-2:123456789012:cluster/app-eks-secondary"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "eks:ListAssociatedAccessPolicies"
      ],
      "Resource": [
        "arn:aws:eks:us-east-1:123456789012:access-entry/app-eks-primary/*",
        "arn:aws:eks:us-west-2:123456789012:access-entry/app-eks-secondary/*"
      ]
    }
  ]
}
```

------

 注意：除了此 IAM 策略外，还需要使用 `AmazonArcRegionSwitchScalingPolicy` 访问策略将计划执行角色添加到 Amazon EKS 集群的访问条目中。有关更多信息，请参阅 [配置 EKS 访问条目权限](eks-resource-scaling-block.md#eks-resource-scaling-block-permissions)。

# Amazon ECS 服务扩展执行块示例策略
<a name="security_iam_region_switch_ecs"></a>

 以下是在 Amazon ECS 资源扩展的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeServices",
        "ecs:UpdateService"
      ],
      "Resource": [
        "arn:aws:ecs:us-east-1:123456789012:service/app-cluster-primary/app-service",
        "arn:aws:ecs:us-west-2:123456789012:service/app-cluster-secondary/app-service"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeClusters"
      ],
      "Resource": [
        "arn:aws:ecs:us-east-1:123456789012:cluster/app-cluster-primary",
        "arn:aws:ecs:us-west-2:123456789012:cluster/app-cluster-secondary"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:ListServices"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:RegisterScalableTarget"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:GetMetricStatistics"
      ],
      "Resource": "*"
    }
  ]
}
```

------

# ARC 路由控制执行块策略示例
<a name="security_iam_region_switch_arc_routing"></a>

 注意：Amazon ARC 路由控制执行区块要求应用于计划执行角色的任何服务控制策略 (SCPs) 都允许这些服务访问以下区域：
+ `route53-recovery-control-config: us-west-2`
+ `route53-recovery-cluster: us-west-2, us-east-1, eu-west-1, ap-southeast-2, ap-northeast-1`

以下是在 ARC 路由控制的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "route53-recovery-control-config:DescribeControlPanel",
        "route53-recovery-control-config:DescribeCluster"
      ],
      "Resource": [
        "arn:aws:route53-recovery-control::123456789012:controlpanel/abcd1234abcd1234abcd1234abcd1234",
        "arn:aws:route53-recovery-control::123456789012:cluster/4b325d3b-0e28-4dcf-ba4a-EXAMPLE11111"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "route53-recovery-cluster:GetRoutingControlState",
        "route53-recovery-cluster:UpdateRoutingControlStates"
      ],
      "Resource": [
        "arn:aws:route53-recovery-control::123456789012:controlpanel/1234567890abcdef1234567890abcdef/routingcontrol/abcdef1234567890", 
        "arn:aws:route53-recovery-control::123456789012:controlpanel/1234567890abcdef1234567890abcdef/routingcontrol/1234567890abcdef" 
      ]
    }
  ]
}
```

------

您可以使用 CLI 检索路由控制面板 ID 和集群 ID。有关更多信息，请参阅 [设置路由控制组件](getting-started-cli-routing-config.md)。

# Aurora Global Database 执行块示例策略
<a name="security_iam_region_switch_aurora"></a>

 以下是在 Aurora 数据库的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeGlobalClusters",
        "rds:DescribeDBClusters"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "rds:FailoverGlobalCluster",
        "rds:SwitchoverGlobalCluster"
      ],
      "Resource": [
        "arn:aws:rds::123456789012:global-cluster:app-global-db",
	      "arn:aws:rds:us-east-1:123456789012:cluster:app-db-primary", 
        "arn:aws:rds:us-west-2:123456789012:cluster:app-db-secondary"  
      ]
    }
  ]
}
```

------

# 亚马逊 DocumentDB 全球集群执行区块策略示例
<a name="security_iam_region_switch_documentdb"></a>

 如果您向 Amazon DocumentDB 全球集群的区域切换计划添加执行块，则需要附加以下示例策略。

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeGlobalClusters",
        "rds:DescribeDBClusters",
        "rds:FailoverGlobalCluster",
        "rds:SwitchoverGlobalCluster"
      ],
      "Resource": "*"
    }
  ]
}
```

# Amazon RDS 执行区块策略示例
<a name="security_iam_region_switch_rds"></a>

 以下是在 Amazon RDS 只读副本促销或跨区域副本创建的区域切换计划中添加执行块时要附加的示例策略。

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:PromoteReadReplica",
        "rds:CreateDBInstanceReadReplica",
        "rds:ModifyDBInstance"
      ],
      "Resource": "*"
    }
  ]
}
```

# 手动审批执行块示例策略
<a name="security_iam_region_switch_manual_approval"></a>

以下是在手动审批的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "arc-region-switch:ApprovePlanExecutionStep"
      ],
      "Resource": "arn:aws:arc-region-switch::123456789012:plan/sample-plan:0123abc"
    }
  ]
}
```

------

# 自定义操作 Lambda 执行块示例策略
<a name="security_iam_region_switch_lambda"></a>

 以下是在 Lambda 函数的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:GetFunction",
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "arn:aws:lambda:us-east-1:123456789012:function:app-recovery-primary",
        "arn:aws:lambda:us-west-2:123456789012:function:app-recovery-secondary"
      ]
    }
  ]
}
```

------

# Route 53 运行状况检查执行块示例策略
<a name="security_iam_region_switch_route53"></a>

 以下是在 Route 53 运行状况检查的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "route53:ListResourceRecordSets"
      ],
      "Resource": [
        "arn:aws:route53:::hostedzone/Z1234567890ABCDEFGHIJ"
      ]
    }
  ]
}
```

------

# 区域切换计划执行块示例策略
<a name="security_iam_region_switch_plan_execution"></a>

 以下是在运行子计划的区域切换计划中添加执行块时要附加的示例策略。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "arc-region-switch:StartPlanExecution",
        "arc-region-switch:GetPlanExecution",
        "arc-region-switch:CancelPlanExecution",
        "arc-region-switch:UpdatePlanExecution",
        "arc-region-switch:ListPlanExecutions"
      ],
      "Resource": [
        "arn:aws:arc-region-switch::123456789012:plan/child-plan-1/abcde1",
        "arn:aws:arc-region-switch::123456789012:plan/child-plan-2/fghij2"
      ]
    }
  ]
}
```

------

# CloudWatch 应用程序运行状况权限警报
<a name="security_iam_region_switch_cloudwatch"></a>

 以下是附加到应用程序运行状况访问 CloudWatch 警报的示例策略，这些警报用于帮助确定实际恢复时间。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:DescribeAlarmHistory",
        "cloudwatch:DescribeAlarms"
      ],
      "Resource": [
        "arn:aws:cloudwatch:us-east-1:123456789012:alarm:app-health-primary",
        "arn:aws:cloudwatch:us-west-2:123456789012:alarm:app-health-secondary"
      ]
    }
  ]
}
```

------

# 自动计划执行报告权限
<a name="security_iam_region_switch_reports"></a>

 以下是您为区域切换计划配置自动生成报告时要附加的示例策略。此政策包括向 Amazon S3 撰写报告、访问 CloudWatch 警报数据以及检索家长计划的子计划信息的权限。

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::your-bucket-name/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudwatch:DescribeAlarms",
        "cloudwatch:DescribeAlarmHistory"
      ],
      "Resource": [
        "arn:aws:cloudwatch:us-east-1:123456789012:alarm:app-health-primary"
        "arn:aws:cloudwatch:us-west-2:123456789012:alarm:app-health-secondary"
      ],
    },
    {
      "Effect": "Allow",
      "Action": [
        "arc-region-switch:GetPlanExecution",
        "arc-region-switch:ListPlanExecutionEvents"
      ],
      "Resource": [
        "arn:aws:arc-region-switch:us-east-1:123456789012:plan/child-plan-1/abcde1",
        "arn:aws:arc-region-switch:us-west-2:123456789012:plan/child-plan-2/fghij2"
      ],
    }
  ]
}
```

 注意：如果您为 Amazon S3 存储桶加密配置客户托管密 AWS KMS 钥，则还必须为该密钥添加`kms:GenerateDataKey`和`kms:Encrypt`权限。

# 跨账户资源权限
<a name="security_iam_region_switch_cross_account"></a>

 如果资源位于不同的账户中，则需要跨账户角色。以下是跨账户角色的信任策略示例。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/RegionSwitchExecutionRole"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "UniqueExternalId123"
        }
      }
    }
  ]
}
```

------

 以下是计划执行角色代入此跨账户角色所需的权限：

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "arn:aws:iam::987654321098:role/RegionSwitchCrossAccountRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "UniqueExternalId123"
        }
      }
    }
  ]
}
```

------

# 完成计划执行角色权限
<a name="security_iam_region_switch_complete_policy"></a>

 要创建包含所有执行块权限的全面策略，则需要一个相当大的策略。实际上，您只应包括您在特定计划中使用的执行块的权限。

以下是您可用作计划执行角色策略起点的示例策略。请务必添加计划中包含的特定执行块所需的其他策略。仅包含您在计划中使用的特定执行块所需的权限，以遵循最低权限原则

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "iam:SimulatePrincipalPolicy",
            "Resource": "arn:aws:iam::123456789012:role/RegionSwitchExecutionRole"
        },
        {
            "Effect": "Allow",
            "Action": [
                "arc-region-switch:GetPlan",
                "arc-region-switch:GetPlanExecution",
                "arc-region-switch:ListPlanExecutions"
            ],
            "Resource": "*"
        }
    ]
}
```

------