Menyiapkan just-in-time akses dengan Systems Manager
Menyiapkan akses just-in-time node dengan Systems Manager melibatkan beberapa langkah. Pertama, Anda memilih target di mana Anda ingin mengatur akses just-in-time node. Target terdiri dari unit AWS Organizations organisasi (OUs) dan Wilayah AWS. Secara default, target yang sama yang Anda pilih saat menyiapkan konsol Systems Manager terpadu dipilih untuk akses just-in-time node. Anda dapat memilih untuk mengatur akses just-in-time node untuk semua target yang sama, atau subset target yang Anda tentukan saat menyiapkan konsol Systems Manager terpadu. Menambahkan target baru yang tidak dipilih saat Anda menyiapkan konsol Systems Manager terpadu tidak didukung.
Selanjutnya Anda akan membuat kebijakan persetujuan untuk menentukan kapan koneksi node memerlukan persetujuan manual dan secara otomatis disetujui. Kebijakan persetujuan dikelola oleh setiap akun di organisasi Anda. Anda juga dapat membagikan kebijakan dari akun administrator terdelgasi untuk secara eksplisit menolak persetujuan otomatis koneksi ke node tertentu.
catatan
Menyiapkan akses just-in-time node tidak memengaruhi kebijakan atau preferensi IAM yang ada yang telah Anda konfigurasikan Session Manager. Anda harus menghapus izin untuk Session Manager tindakan seperti StartSession dari kebijakan IAM Anda untuk memastikan bahwa hanya akses just-in-time node yang digunakan ketika pengguna mencoba untuk terhubung ke node Anda. Setelah Anda mengatur akses just-in-time node, sebaiknya uji kebijakan persetujuan Anda dengan subset pengguna dan node untuk memverifikasi kebijakan Anda berfungsi sesuai keinginan sebelum menghapus izin Session Manager.
Kebijakan IAM berikut menguraikan izin yang diperlukan untuk mengelola dan memungkinkan pengguna membuat permintaan akses just-in-time node ke node dengan Systems Manager. Setelah memverifikasi bahwa Anda memiliki izin yang diperlukan untuk menggunakan akses just-in-time node dengan Systems Manager, Anda dapat melanjutkan proses pengaturan. Ganti masing-masing example resource
placeholder dengan informasi Anda sendiri.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "QuickSetupConfigurationManagers", "Effect": "Allow", "Action": [ "ssm-quicksetup:CreateConfigurationManager", "ssm-quicksetup:DeleteConfigurationManager", "ssm-quicksetup:GetConfiguration", "ssm-quicksetup:GetConfigurationManager", "ssm-quicksetup:GetServiceSettings", "ssm-quicksetup:ListConfigurationManagers", "ssm-quicksetup:ListConfigurations", "ssm-quicksetup:ListQuickSetupTypes", "ssm-quicksetup:ListTagsForResource", "ssm-quicksetup:TagResource", "ssm-quicksetup:UntagResource", "ssm-quicksetup:UpdateConfigurationDefinition", "ssm-quicksetup:UpdateConfigurationManager", "ssm-quicksetup:UpdateServiceSettings" ], "Resource": "*" }, { "Sid": "QuickSetupDeployments", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackSetOperation", "cloudformation:ListStacks", "cloudformation:DescribeStacks", "cloudformation:DescribeStackResources", "cloudformation:ListStackSetOperations", "cloudformation:ListStackInstances", "cloudformation:DescribeStackSet", "cloudformation:ListStackSets", "cloudformation:DescribeStackInstance", "cloudformation:DescribeOrganizationsAccess", "cloudformation:ActivateOrganizationsAccess", "cloudformation:GetTemplate", "cloudformation:ListStackSetOperationResults", "cloudformation:DescribeStackEvents", "cloudformation:UntagResource", "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "ssm:ListAssociations", "ssm:DescribeAssociation", "ssm:GetDocument", "ssm:ListDocuments", "ssm:DescribeDocument", "ssm:GetOpsSummary", "organizations:DeregisterDelegatedAdministrator", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:DescribeOrganizationalUnit", "organizations:ListAWSServiceAccessForOrganization", "iam:ListRoles", "iam:ListRolePolicies", "iam:GetRole", "iam:CreatePolicy", "cloudformation:TagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:RollbackStack", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-JITNA*", "arn:aws:cloudformation:*:*:stack/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:type/resource/*", "arn:aws:cloudformation:*:*:stack/StackSet-SSMQuickSetup" ] }, { "Sid": "StackSetOperations", "Effect": "Allow", "Action": [ "cloudformation:CreateStackSet", "cloudformation:UpdateStackSet", "cloudformation:DeleteStackSet", "cloudformation:DeleteStackInstances", "cloudformation:CreateStackInstances", "cloudformation:StopStackSetOperation" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-JITNA*", "arn:aws:cloudformation:*:*:type/resource/*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-JITNA*:*" ] }, { "Sid": "IamRolesMgmt", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:GetRole", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:DetachRolePolicy", "iam:GetRolePolicy", "iam:ListRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-JITNA*", "arn:aws:iam::*:role/service-role/AWS-QuickSetup-JITNA*" ] }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-JITNA*", "arn:aws:iam::*:role/service-role/AWS-QuickSetup-JITNA*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com", "ssm-quicksetup.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "SSMAutomationExecution", "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:region:account id:automation-definition/AWS-EnableExplorer:*" }, { "Sid": "SSMAssociationPermissions", "Effect": "Allow", "Action": [ "ssm:DeleteAssociation", "ssm:CreateAssociation", "ssm:StartAssociationsOnce" ], "Resource": "arn:aws:ssm:region:account id:association/*" }, { "Sid": "SSMResourceDataSync", "Effect": "Allow", "Action": [ "ssm:CreateResourceDataSync", "ssm:UpdateResourceDataSync" ], "Resource": "arn:aws:ssm:region:account-id:resource-data-sync/AWS-QuickSetup-*" }, { "Sid": "ListResourceDataSync", "Effect": "Allow", "Action": [ "ssm:ListResourceDataSync" ], "Resource": "*" }, { "Sid": "CreateServiceLinkedRoles", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Condition": { "StringEquals": { "iam:AWSServiceName": [ "accountdiscovery.ssm.amazonaws.com", "ssm.amazonaws.com", "ssm-quicksetup.amazonaws.com", "stacksets.cloudformation.amazonaws.com" ] } }, "Resource": "*" }, { "Sid": "CreateStackSetsServiceLinkedRole", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgAdmin" }, { "Sid": "AllowSsmJitnaPoliciesCrudOperations", "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:UpdateDocumentDefaultVersion", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:DeleteDocument" ], "Resource": [ "arn:aws:ssm:region:account id:document/SSM-JustInTimeAccessDenyAccessOrgPolicy" ], "Condition": { "StringEquals": { "ssm:DocumentType": [ "AutoApprovalPolicy" ] } } }, { "Sid": "AllowAccessRequestOpsItemOperations", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:DescribeOpsItems", "ssm:GetOpsSummary", "ssm:DeleteOpsItem", "ssm:ListOpsItemEvents" ], "Resource": "*" }, { "Sid": "IdentityCenterPermissions", "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "sso:ListDirectoryAssociations", "identitystore:GetUserId", "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroupMembershipsForMember" ], "Resource": "*" } ] }
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSsmJitnaPoliciesCrudOperations", "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:UpdateDocumentDefaultVersion", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:DeleteDocument" ], "Resource": [ "arn:aws:ssm:region:account id:document/*" ], "Condition": { "StringEquals": { "ssm:DocumentType": [ "ManualApprovalPolicy", "AutoApprovalPolicy" ] } } }, { "Sid": "AllowSsmJitnaPoliciesListOperations", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListDocumentVersions" ], "Resource": "*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::account id:role/SSM-JustInTimeAccessTokenRole", "Condition": { "StringEquals": { "iam:PassedToService": [ "justintimeaccess.ssm.amazonaws.com" ] } } }, { "Sid": "AllowAccessRequestOpsItemOperations", "Effect": "Allow", "Action": [ "ssm:GetOpsItem", "ssm:DescribeOpsItems", "ssm:GetOpsSummary", "ssm:DeleteOpsItem", "ssm:ListOpsItemEvents" ], "Resource": "*" }, { "Sid": "AllowSessionManagerPreferencesOperation", "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:GetDocument", "ssm:DescribeDocument", "ssm:UpdateDocument", "ssm:DeleteDocument" ], "Resource": "arn:aws:ssm:region:account id:document/SSM-SessionManagerRunShell", "Condition": { "StringEquals": { "ssm:DocumentType": "Session" } } }, { "Sid": "AllowSessionManagerOperations", "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus", "ssm:TerminateSession" ], "Resource": "*" }, { "Sid": "AllowRDPConnectionRecordingOperations", "Effect": "Allow", "Action": [ "ssm-guiconnect:UpdateConnectionRecordingPreferences", "ssm-guiconnect:GetConnectionRecordingPreferences", "ssm-guiconnect:DeleteConnectionRecordingPreferences" ], "Resource": "*" }, { "Sid": "AllowRDPConnectionRecordingKmsOperation", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "arn:aws:kms:region:account id:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerJustInTimeNodeAccessManaged": "true" }, "StringLike": { "kms:ViaService": "ssm-guiconnect.*.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowFleetManagerOperations", "Effect": "Allow", "Action": [ "ssm-guiconnect:GetConnection", "ssm-guiconnect:ListConnections" ], "Resource": "*" }, { "Sid": "SNSTopicManagement", "Effect": "Allow", "Action": [ "sns:CreateTopic", "sns:SetTopicAttributes" ], "Resource": [ "arn:aws:sns:region:account id:SSM-JITNA*" ] }, { "Sid": "SNSListTopics", "Effect": "Allow", "Action": [ "sns:ListTopics" ], "Resource": "*" }, { "Sid": "EventBridgeRuleManagement", "Effect": "Allow", "Action": [ "events:PutRule", "events:PutTargets" ], "Resource": [ "arn:aws:events:region:account id:rule/SSM-JITNA*" ] }, { "Sid": "ChatbotSlackManagement", "Effect": "Allow", "Action": [ "chatbot:CreateSlackChannelConfiguration", "chatbot:UpdateSlackChannelConfiguration", "chatbot:DescribeSlackChannelConfigurations", "chatbot:DescribeSlackWorkspaces", "chatbot:DeleteSlackChannelConfiguration", "chatbot:RedeemSlackOauthCode", "chatbot:DeleteSlackWorkspaceAuthorization", "chatbot:GetSlackOauthParameters" ], "Resource": "*" }, { "Sid": "ChatbotTeamsManagement", "Effect": "Allow", "Action": [ "chatbot:ListMicrosoftTeamsChannelConfigurations", "chatbot:CreateMicrosoftTeamsChannelConfiguration", "chatbot:UpdateMicrosoftTeamsChannelConfiguration", "chatbot:ListMicrosoftTeamsConfiguredTeams", "chatbot:DeleteMicrosoftTeamsChannelConfiguration", "chatbot:RedeemMicrosoftTeamsOauthCode", "chatbot:DeleteMicrosoftTeamsConfiguredTeam", "chatbot:GetMicrosoftTeamsOauthParameters", "chatbot:TagResource" ], "Resource": "*" }, { "Sid": "SSMEmailSettings", "Effect": "Allow", "Action": [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource": [ "arn:aws:ssm:region:account id:servicesetting/ssm/access-request/email-role-mapping", "arn:aws:ssm:region:account id:servicesetting/ssm/access-request/enabled-email-notifications" ] }, { "Sid": "AllowViewingJitnaCloudWatchMetrics", "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics" ], "Resource": "*", "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/SSM/JustInTimeAccess" } } }, { "Sid": "QuickSetupConfigurationManagers", "Effect": "Allow", "Action": [ "ssm-quicksetup:ListConfigurationManagers", "ssm-quicksetup:ListConfigurations", "ssm-quicksetup:ListQuickSetupTypes", "ssm-quicksetup:GetConfiguration", "ssm-quicksetup:GetConfigurationManager" ], "Resource": "*" }, { "Sid": "QuickSetupDeployments", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Sid": "ManualPolicy", "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "ssm:GetServiceSetting", "iam:ListRoles" ], "Resource": "*" }, { "Sid": "SessionPreference", "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets" ], "Resource": "*" }, { "Sid": "AllowIamListForKMS", "Effect": "Allow", "Action": [ "iam:ListUsers" ], "Resource": "arn:aws:iam::account id:user/*" }, { "Sid": "KMSPermission", "Effect": "Allow", "Action": [ "kms:TagResource", "kms:ListAliases", "kms:CreateAlias" ], "Resource": "*" }, { "Sid": "KMSCreateKey", "Effect": "Allow", "Action": [ "kms:CreateKey" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/SystemsManagerJustInTimeNodeAccessManaged": "true" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SystemsManagerJustInTimeNodeAccessManaged" ] } } }, { "Sid": "AllowIamRoleForChatbotAction", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::account id:role/role name", "Condition": { "StringEquals": { "iam:PassedToService": [ "chatbot.amazonaws.com" ] } } }, { "Sid": "AllowIamServiceRoleForChat", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::account id:role/aws-service-role/management.chatbot.amazonaws.com/AWSServiceRoleForAWSChatbot" }, { "Sid": "CloudWatchLogs", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups" ], "Resource": "arn:aws:logs:*:account id:log-group::log-stream:" }, { "Sid": "IdentityStorePermissions", "Effect": "Allow", "Action": [ "sso:ListDirectoryAssociations", "identitystore:GetUserId", "sso-directory:SearchUsers", "sso-directory:SearchGroups", "identitystore:DescribeGroup", "identitystore:DescribeUser" ], "Resource": "*" } ] }
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAccessRequestDescriptions", "Effect": "Allow", "Action": [ "ssm:DescribeOpsItems", "ssm:GetOpsSummary", "ssm:ListOpsItemEvents" ], "Resource": "*" }, { "Sid": "AllowGetSpecificAccessRequest", "Effect": "Allow", "Action": [ "ssm:GetOpsItem" ], "Resource": "arn:aws:ssm:region:account id:opsitem/*" }, { "Sid": "AllowApprovalRejectionSignal", "Effect": "Allow", "Action": [ "ssm:SendAutomationSignal" ], "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerJustInTimeNodeAccessManaged": "true" } } }, { "Sid": "QuickSetupConfigurationManagers", "Effect": "Allow", "Action": [ "ssm-quicksetup:ListConfigurationManagers", "ssm-quicksetup:ListConfigurations", "ssm-quicksetup:GetConfigurationManager", "ssm-quicksetup:ListQuickSetupTypes", "ssm-quicksetup:GetConfiguration" ], "Resource": "*" }, { "Sid": "QuickSetupDeployments", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Sid": "AllowSsmJitnaPoliciesCrudOperations", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": [ "arn:aws:ssm:region:account id:document/*" ], "Condition": { "StringEquals": { "ssm:DocumentType": [ "ManualApprovalPolicy", "AutoApprovalPolicy" ] } } }, { "Sid": "AllowSsmJitnaPoliciesListOperations", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListDocumentVersions" ], "Resource": "*" }, { "Sid": "IDCPermissions", "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "sso:ListDirectoryAssociations", "identitystore:GetUserId", "identitystore:DescribeUser", "identitystore:DescribeGroup", "identitystore:ListGroupMembershipsForMember" ], "Resource": "*" } ] }
{ "Version": "2012-10-17", "Statement": [{ "Sid": "AllowJITNAOperations", "Effect": "Allow", "Action": [ "ssm:StartAccessRequest", "ssm:GetAccessToken" ], "Resource": "*" }, { "Sid": "AllowOpsItemCreationAndRetrieval", "Effect": "Allow", "Action": [ "ssm:CreateOpsItem", "ssm:GetOpsItem" ], "Resource": "arn:aws:ssm:*:*:opsitem/*" }, { "Sid": "AllowListAccessRequests", "Effect": "Allow", "Action": [ "ssm:DescribeOpsItems", "ssm:GetOpsSummary", "ssm:ListOpsItemEvents", "ssm:DescribeSessions" ], "Resource": "*" }, { "Sid": "RequestManualApprovals", "Action": "ssm:StartAutomationExecution", "Effect": "Allow", "Resource": "arn:aws:ssm:*:*:document/*", "Condition": { "StringEquals": { "ssm:DocumentType": "ManualApprovalPolicy" } } }, { "Sid": "StartManualApprovalsAutomationExecution", "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-execution/*" }, { "Sid": "AllowManualApprovalAutomationExecutionTagging", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource" ], "Resource": [ "arn:aws:ssm:*:*:automation-execution/*" ], "Condition": { "StringEquals": { "aws:RequestTag/SystemsManagerJustInTimeNodeAccessManaged": "true" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "SystemsManagerJustInTimeNodeAccessManaged" ] } } }, { "Sid": "CancelAccessRequestManualApproval", "Effect": "Allow", "Action": "ssm:StopAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-execution/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerJustInTimeNodeAccessManaged": "true" } } }, { "Sid": "DescribeEC2Instances", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeTags", "ec2:GetPasswordData" ], "Resource": "*" }, { "Sid": "AllowListSSMManagedNodesAndTags", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceInformation", "ssm:ListTagsForResource" ], "Resource": "*" }, { "Sid": "QuickSetupConfigurationManagers", "Effect": "Allow", "Action": [ "ssm-quicksetup:ListConfigurationManagers", "ssm-quicksetup:GetConfigurationManager", "ssm-quicksetup:ListConfigurations", "ssm-quicksetup:ListQuickSetupTypes", "ssm-quicksetup:GetConfiguration" ], "Resource": "*" }, { "Sid": "AllowSessionManagerOperations", "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus" ], "Resource": "*" }, { "Sid": "AllowRDPOperations", "Effect": "Allow", "Action": [ "ssm-guiconnect:ListConnections", "ssm:GetConnectionStatus" ], "Resource": "*" }, { "Sid": "QuickSetupDeployments", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators" ], "Resource": "*" }, { "Sid": "AllowSsmJitnaPoliciesReadOnly", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": [ "arn:aws:ssm:*:account id:document/*" ], "Condition": { "StringEquals": { "ssm:DocumentType": [ "ManualApprovalPolicy", "AutoApprovalPolicy" ] } } }, { "Sid": "AllowSsmJitnaPoliciesListOperations", "Effect": "Allow", "Action": [ "ssm:ListDocuments", "ssm:ListDocumentVersions" ], "Resource": "*" }, { "Sid": "ExploreNodes", "Effect": "Allow", "Action": [ "ssm:ListNodesSummary", "ssm:ListNodes", "ssm:DescribeInstanceProperties" ], "Resource": "*" }, { "Sid": "IdentityStorePermissions", "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "sso:ListDirectoryAssociations", "identitystore:GetUserId", "identitystore:DescribeUser", "identitystore:DescribeGroup" ], "Resource": "*" } ] }
catatan
Untuk membatasi akses ke operasi API yang membuat, memperbarui, atau menghapus kebijakan persetujuan, gunakan kunci ssm:DocumentType kondisi untuk jenis AutoApprovalPolicy dan ManualApprovalPolicy dokumen. Operasi StartAccessRequest dan GetAccessToken API tidak mendukung kunci konteks global berikut:
-
aws: ViaAwsService
-
aws: MultiFactorAuthPresent
-
aws: SourceVpce
-
aws: UserAgent
Untuk informasi selengkapnya tentang kunci konteks kondisi untuk Systems Manager, lihat Kunci kondisi untuk AWS Systems Manager Referensi Otorisasi Layanan.
Prosedur berikut menjelaskan cara menyelesaikan langkah pengaturan pertama untuk akses just-in-time node.
Untuk mengatur akses just-in-time node
-
Masuk ke akun administrator yang didelegasikan Systems Manager untuk organisasi Anda.
Buka AWS Systems Manager konsol di https://console.aws.amazon.com/systems-manager/
. -
Pilih Kelola akses node di panel navigasi.
-
Pilih Aktifkan akses just-in-time node.
-
Pilih Wilayah tempat Anda ingin mengaktifkan akses just-in-time node. Secara default, Wilayah yang sama yang Anda pilih saat menyiapkan konsol Systems Manager terpadu dipilih untuk akses just-in-time node. Memilih Wilayah baru yang tidak dipilih saat Anda menyiapkan konsol Systems Manager terpadu tidak didukung.
-
Pilih Aktifkan akses just-in-time node.
Tidak ada biaya untuk menggunakan akses just-in-time node selama 30 hari setelah mengaktifkan fitur. Setelah masa percobaan 30 hari, ada biaya untuk menggunakan akses just-in-time node. Untuk informasi selengkapnya, lihat Harga AWS Systems Manager
