View a markdown version of this page

将 Identity-Based 策略（IAM 策略）用于AWS Snowball Edge - AWS Snowball Edge开发人员指南
使用所需的权限AWS Snowball Edge控制台

AWS Snowball Edge不再向新客户提供。新客户应探索AWS DataSync在线传输、用于安全物理传输AWS的数据传输终端或AWS合作伙伴解决方案。对于边缘计算，请浏览 AWS Out posts。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

将 Identity-Based 策略（IAM 策略）用于AWS Snowball Edge

本主题提供了基于身份的策略的示例，这些示例演示了账户管理员如何向 IAM 身份（即，用户、组和角色）附加权限策略。因此，这些策略授予对中的AWS Snowball Edge资源执行操作的权限AWS Cloud。

重要

我们建议您首先阅读以下介绍性主题，这些主题讲解了管理AWS Snowball Edge资源访问的基本概念和选项。有关更多信息，请参阅 管理资源访问权限概述，请参阅AWS Cloud。

本主题的各个部分涵盖以下内容：

下面介绍权限策略示例。

JSON
{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::*"
    },
    {
       "Effect": "Allow",
       "Action": [
          "snowball:*",
          "importexport:*"
       ],
       "Resource": "*"
    }
  ]
}

该策略包含两条语句：

  • 第一个语句为使用 arn:aws:s3:::* 的 Amazon 资源名称（ARN）的所有 Amazon S3 存储桶授予执行三个 Amazon S3 操作（s3:GetBucketLocation、s3:GetObject 和 s3:ListBucket）的权限。ARN 使用了通配符（*），以便用户可以选择从任意或全部 Amazon S3 存储桶导出数据。

  • 第二条语句授予所有AWS Snowball Edge操作的权限。由于这些操作不支持资源级权限，该策略采用了通配符（*），且 Resource 值也采用了通配符。

该策略不指定 Principal 元素，因为在基于身份的策略中，您未指定获取权限的主体。附加了策略的用户是隐式主体。向 IAM 角色附加权限策略后，该角色的信任策略中标识的主体将获取权限。

有关显示所有AWS Snowball Edge任务管理 API 操作及其适用的资源的表格，请参阅AWS Snowball Edge API 权限：操作、资源和条件参考。

使用所需的权限AWS Snowball Edge控制台

权限参考表列出了AWS Snowball Edge任务管理 API 操作并显示了每个操作所需的权限。有关作业管理 API 操作的更多信息，请参阅 AWS Snowball Edge API 权限：操作、资源和条件参考。

要使用AWS Snow 系列管理控制台，您需要授予其他操作的权限，如以下权限策略所示：

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetBucketPolicy",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:GetFunction",
                "lambda:GetFunctionConfiguration"
            ],
            "Resource": "arn:aws:lambda:*::function:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:ListFunctions"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:CreateGrant",
                "kms:GenerateDataKey",
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:RetireGrant",
                "kms:ListKeys",
                "kms:DescribeKey",
                "kms:ListAliases"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:ListRoles",
                "iam:ListRolePolicies",
                "iam:PutRolePolicy"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/snowball*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "importexport.amazonaws.com"
                }
            }
        },
        {
           "Effect": "Allow",
           "Action": [
                "ec2:DescribeImages",
                "ec2:ModifyImageAttribute"
           ],
           "Resource": [
                "*"
           ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:CreateTopic",
                "sns:ListTopics",
                "sns:GetTopicAttributes",
                "sns:SetTopicAttributes",
                "sns:ListSubscriptionsByTopic",
                "sns:Subscribe"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "greengrass:getServiceRoleForAccount"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "snowball:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetBucketPolicy",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:ListAllMyBuckets"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:CreateBucket",
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:GetFunction",
                "lambda:GetFunctionConfiguration"
            ],
            "Resource": "arn:aws:lambda:*:*:function:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:ListFunctions"
            ],
            "Resource": "arn:aws:lambda:*:*:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:ListRoles",
                "iam:ListRolePolicies",
                "iam:PutRolePolicy"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/snowball*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "importexport.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeImages",
                "ec2:ModifyImageAttribute"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:CreateTopic",
                "sns:ListTopics",
                "sns:GetTopicAttributes",
                "sns:SetTopicAttributes",
                "sns:ListSubscriptionsByTopic",
                "sns:Subscribe"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "greengrass:getServiceRoleForAccount"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "snowball:*"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

出于以下原因，AWS Snowball Edge控制台需要这些额外权限：

  • ec2:— 这些允许用户描述 Amazon EC2-compatible 实例并修改其属性以用于本地计算。有关更多信息，请参阅 在 Snowball Edge 上使用亚马逊 EC2-compatible 计算实例。

  • kms:：有了这些权限，用户可以创建或选择可加密数据的 KMS 密钥。有关更多信息，请参阅 AWS Key Management Service in AWS Snowball Edge。

  • iam:— 它们允许用户创建或选择一个 IAM 角色 ARN，该角色AWS Snowball Edge将假定访问与创建和处理工作相关的AWS资源。

  • sns:：有了这些权限，用户可以为其创建的作业创建或选择 Amazon SNS 通知。有关更多信息，请参阅 Snowball Edge 的通知。