本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# CloudWatch Canary 的必要角色和許可
建立和管理 Canary 的使用者以及 Canary 本身都必須具有特定許可。
# 管理 CloudWatch Canary 的使用者的必要角色和許可
若要檢視 Canary 詳細資訊和 Canary 執行的結果，您必須以已連接 `CloudWatchSyntheticsFullAccess` 或 ` CloudWatchSyntheticsReadOnlyAccess` 政策的使用者身分登入。若要讀取主控台中的所有 Synthetics 資料，您還需要 `AmazonS3ReadOnlyAccess` 和 ` CloudWatchReadOnlyAccess` 政策。若要檢視 Canary 使用的原始程式碼，您也需要 `AWSLambda_ReadOnlyAccess` 政策。
若要建立 Canary，您必須以具有 ` CloudWatchSyntheticsFullAccess` 政策或類似許可集合的使用者身分登入。若要為 Canary 建立 IAM 角色，您還需要下列內嵌政策陳述式：
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:CreateRole",
"iam:CreatePolicy",
"iam:AttachRolePolicy"
],
"Resource": [
"arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*",
"arn:aws:iam::*:policy/service-role/CloudWatchSyntheticsPolicy*"
]
}
]
}
```
------
**重要**
將 `iam:CreateRole`、`iam:CreatePolicy` 和 ` iam:AttachRolePolicy` 許可授與使用者，可給予該使用者對您 AWS 帳戶的完整管理存取權。例如，擁有這些許可的使用者，可以建立具有所有資源完整許可的政策，並可將該政策連接至任何角色。對於您授與這些許可的對象，請務必謹慎。
如需連接政策和授與許可給使用者的資訊，請參閱[變更 IAM 使用者的許可](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console)和[嵌入使用者或角色的內嵌政策](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#embed-inline-policy-console)。
# Canary 的必要角色和許可
每個 Canary 必須與連接特定許可的 IAM 角色相關聯。當您使用 CloudWatch 主控台建立 Canary 時，您可以選擇讓 CloudWatch Synthetics 為 Canary 建立 IAM 角色。若您這樣做，則角色將具備所需要的許可。
如果您想要自己建立 IAM 角色，或者建立在使用 AWS CLI 或 API 建立 Canary 時可以使用的 IAM 角色，該角色必須包含本節中列出的許可。
Canary 的所有 IAM 角色必須包含以下信任政策陳述式。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
```
------
此外，Canary 的 IAM 角色需要以下陳述式之一。
**不使用 AWS KMS 或需要 Amazon VPC 存取的基本 Canary**
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::path/to/your/s3/bucket/canary/results/folder"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::name/of/the/s3/bucket/that/contains/canary/results"
]
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:CreateLogGroup"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"xray:PutTraceSegments"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Resource": "*",
"Action": "cloudwatch:PutMetricData",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": "CloudWatchSynthetics"
}
}
}
]
}
```
------
**使用 AWS KMS 加密 Canary 成品，但不需要 Amazon VPC 存取的 Canary**
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results"
]
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:CreateLogGroup"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"xray:PutTraceSegments"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Resource": "*",
"Action": "cloudwatch:PutMetricData",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": "CloudWatchSynthetics"
}
}
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:us-east-1:111122223333:key/KMS_key_id",
"Condition": {
"StringEquals": {
"kms:ViaService": [
"s3.us-east-1.amazonaws.com"
]
}
}
}
]
}
```
------
**不使用 AWS KMS 但需要 Amazon VPC 存取的 Canary**
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results"
]
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:CreateLogGroup"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"xray:PutTraceSegments"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Resource": "*",
"Action": "cloudwatch:PutMetricData",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": "CloudWatchSynthetics"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:DescribeNetworkInterfaces",
"ec2:DeleteNetworkInterface"
],
"Resource": [
"*"
]
}
]
}
```
------
**Canary 使用 AWS KMS 加密 Canary 成品，也需要 Amazon VPC 存取**
如果您更新非 VPC Canary 以開始使用 VPC，則需要更新 Canary 的角色以包含以下政策中列出的網路介面許可。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation"
],
"Resource": [
"arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results"
]
},
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:CreateLogGroup"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets",
"xray:PutTraceSegments"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Resource": "*",
"Action": "cloudwatch:PutMetricData",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": "CloudWatchSynthetics"
}
}
},
{
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:DescribeNetworkInterfaces",
"ec2:DeleteNetworkInterface"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:us-east-1:111122223333:key/KMS_key_id",
"Condition": {
"StringEquals": {
"kms:ViaService": [
"s3.us-east-1.amazonaws.com"
]
}
}
}
]
}
```
------
## AWS CloudWatch Synthetics 的 受管政策
若要新增許可給使用者、群組和角色，使用 AWS 受管政策比自行撰寫政策更容易。建立 IAM 客戶受管政策需要時間和專業知識，而受管政策可為您的團隊提供其所需的許可。若要快速開始使用，您可以使用我們的 AWS 受管政策。這些政策涵蓋常見的使用案例，可在您的帳戶中使用 AWS 。如需 AWS 受管政策的詳細資訊，請參閱《IAM 使用者指南》中的[AWS 受管政策](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) AWS 受管政策。
AWS 服務會維護和更新 AWS 受管政策。您無法變更 AWS 受管政策中的許可。服務偶爾會變更 AWS 受管政策中的許可。此類型的更新會影響已連接政策的所有身分識別 (使用者、群組和角色)。
### AWS 受管政策的 CloudWatch Synthetics 更新
檢視自 CloudWatch Synthetics 開始追蹤這些變更以來， AWS 受管政策更新的詳細資訊。如需有關此頁面變更的自動提醒，請訂閱 CloudWatch 文件歷史記錄頁面上的 RSS 摘要。
| 變更 | 描述 | Date |
| --- | --- | --- |
| 已從 **CloudWatchSyntheticsFullAccess** 中移除冗餘動作 | CloudWatch Synthetics 從 ** CloudWatchSyntheticsFullAccess** 政策中移除 `s3:PutBucketEncryption`和 ` lambda:GetLayerVersionByArn`動作，因為這些動作與政策中的其他許可重複。移除的動作並未提供任何許可，而且政策授予的許可沒有網路變更。 | 2021 年 3 月 12 日 |
| CloudWatch Synthetics 開始追蹤變更 | CloudWatch Synthetics 開始追蹤其 AWS 受管政策的變更。 | 2021 年 3 月 10 日 |
**CloudWatchSyntheticsFullAccess**
以下是 `CloudWatchSyntheticsFullAccess` 政策的內容：
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"synthetics:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:CreateBucket",
"s3:PutEncryptionConfiguration"
],
"Resource": [
"arn:aws:s3:::cw-syn-results-*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"s3:ListAllMyBuckets",
"xray:GetTraceSummaries",
"xray:BatchGetTraces",
"apigateway:GET"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation"
],
"Resource": "arn:aws:s3:::*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:ListBucket"
],
"Resource": "arn:aws:s3:::cw-syn-*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObjectVersion"
],
"Resource": "arn:aws:s3:::aws-synthetics-library-*"
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": [
"lambda.amazonaws.com",
"synthetics.amazonaws.com"
]
}
}
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:ListAttachedRolePolicies"
],
"Resource": [
"arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:PutMetricAlarm",
"cloudwatch:DeleteAlarms"
],
"Resource": [
"arn:aws:cloudwatch:*:*:alarm:Synthetics-*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:DescribeAlarms"
],
"Resource": [
"arn:aws:cloudwatch:*:*:alarm:*"
]
},
{
"Effect": "Allow",
"Action": [
"logs:GetLogRecord",
"logs:DescribeLogStreams",
"logs:StartQuery",
"logs:GetLogEvents",
"logs:FilterLogEvents",
"logs:GetLogGroupFields"
],
"Resource": [
"arn:aws:logs:*:*:log-group:/aws/lambda/cwsyn-*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Effect": "Allow",
"Action": [
"lambda:CreateFunction",
"lambda:AddPermission",
"lambda:PublishVersion",
"lambda:UpdateFunctionCode",
"lambda:UpdateFunctionConfiguration",
"lambda:GetFunctionConfiguration",
"lambda:GetFunction",
"lambda:DeleteFunction",
"lambda:ListTags",
"lambda:TagResource",
"lambda:UntagResource"
],
"Resource": [
"arn:aws:lambda:*:*:function:cwsyn-*"
]
},
{
"Effect": "Allow",
"Action": [
"lambda:GetLayerVersion",
"lambda:PublishLayerVersion",
"lambda:DeleteLayerVersion"
],
"Resource": [
"arn:aws:lambda:*:*:layer:cwsyn-*",
"arn:aws:lambda:*:*:layer:Synthetics:*",
"arn:aws:lambda:*:*:layer:Synthetics_Selenium:*",
"arn:aws:lambda:*:*:layer:AWS-CW-Synthetics*:*"
]
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"sns:ListTopics"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"sns:CreateTopic",
"sns:Subscribe",
"sns:ListSubscriptionsByTopic"
],
"Resource": [
"arn:*:sns:*:*:Synthetics-*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:ListAliases"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:DescribeKey"
],
"Resource": "arn:aws:kms:*:*:key/*"
},
{
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringLike": {
"kms:ViaService": [
"s3.*.amazonaws.com"
]
}
}
}
]
}
```
------
**CloudWatchSyntheticsReadOnlyAccess**
以下是 `CloudWatchSyntheticsReadOnlyAccess` 政策的內容：
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"synthetics:Describe*",
"synthetics:Get*",
"synthetics:List*"
],
"Resource": "*"
}
]
}
```
------
# 限制使用者檢視特定的 canary
您可限制使用者檢視有關 canary 資訊的能力，讓他們只能查看您指定的 canary相關資訊。如要執行此作業，請使用具有類似下列內容之 ` Condition` 陳述式的 IAM 政策，並將此政策連接至使用者或 IAM 角色。
下列範例限制使用者僅可查看 ` name-of-allowed-canary-1` 和 `name-of-allowed-canary-2` 的相關資訊。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "synthetics:DescribeCanaries",
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"synthetics:Names": [
"name-of-allowed-canary-1",
"name-of-allowed-canary-2"
]
}
}
}
]
}
```
------
CloudWatch Synthetics 支援 `synthetics:Names` 陣列中列出的最多五個項目。
您還可建立於允許的 canary 名稱中使用 \$1** 作為萬用字元的政策，如下列範例所示：
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "synthetics:DescribeCanaries",
"Resource": "*",
"Condition": {
"ForAnyValue:StringLike": {
"synthetics:Names": [
"my-team-canary-*"
]
}
}
}
]
}
```
------
使用連結的其中一個政策登入的任何使用者皆不可使用 CloudWatch 主控台檢視任何 canary 的資訊。他們只能檢視政策所授權之 canary 的 canary 資訊，且只能透過使用 [DescribeCanaries](https://docs.aws.amazon.com/AmazonSynthetics/latest/APIReference/API_DescribeCanaries.html) API 或 [describe-canaries](https://docs.aws.amazon.com/cli/latest/reference/synthetics/describe-canaries.html) AWS CLI 命令。