本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
使用条件键
您可以指定决定 IAM 策略如何生效的条件。在中 ElastiCache，您可以使用 JSON 策略的Condition元素将请求上下文中的密钥与您在策略中指定的密钥值进行比较。有关更多信息，请参阅 IAM JSON 策略元素：条件。
要查看 ElastiCache 条件密钥列表，请参阅《服务授权参考》 ElastiCache中的 Amazon 条件密钥。
有关全局条件键的列表，请参阅 AWS 全局条件上下文键。
ElastiCache 与 AWS 全局条件键一起使用
当使用需要 ElastiCache的 “主体” 的AWS 全局条件键时，请使用同时包含主体:elasticache.amazonaws.com和ec.amazonaws.com的OR条件。
如果您不同时为其添加两个委托人 ElastiCache，则无法对策略中列出的任何资源正确执行预期的 “允许” 或 “拒绝” 操作。
带有aws:CalledVia全局条件密钥的策略示例：
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*",
"Condition": {
"ForAnyValue:StringLike": {
"aws:CalledVia": [
"ec.amazonaws.com",
"elasticache.amazonaws.com"
]
}
}
}
]
}
指定条件：使用条件键
要实现精细控制，您需要编写 IAM 权限策略，用于指定控制某些请求上单独参数集的条件。然后，将该策略应用于您使用 IAM 控制台创建的 IAM 用户、组或角色。
要应用条件，请将条件信息添加到 IAM policy 语句。在以下示例中，您指定了条件，为创建的所有自行设计缓存群集使用节点类型 cache.r5.large。
Condition要使用String类型的条件键构造元素，请使用不区分大小写的条件运算符StringEqualsIgnoreCase或StringNotEqualsIgnoreCase将键与字符串值进行比较。
ElastiCache 以不区分大小写的方式处理CacheNodeType和CacheParameterGroupName的输入参数。因此，StringNotEqualsIgnoreCase应在引用字符串条件运算符StringEqualsIgnoreCase和的权限策略中使用这些运算符。
下面展示了使用 Valkey 或 Redis OSS 时的权限策略示例。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"StringEquals": {
"elasticache:CacheNodeType": [
"cache.r5.large"
]
}
}
}
]
}
下面展示了使用 Memcached 时的权限策略示例。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*"
],
"Condition": {
"StringEquals": {
"elasticache:CacheNodeType": [
"cache.r5.large"
]
}
}
}
]
}
有关更多信息，请参阅 标记您的资源 ElastiCache 。
有关使用策略条件运算符的更多信息，请参阅 ElastiCache API 权限：操作、资源和条件参考。
策略示例：使用条件实现精细参数控制
本节显示了对前面列出的 ElastiCache 参数实施细粒度访问控制的策略示例。
elasticacheMaximumDataStorage:: 指定无服务器缓存的最大数据存储空间。使用提供的条件，客户不能创建存储超过特定数量数据的缓存。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDependentResources",
"Effect": "Allow",
"Action": [
"elasticache:CreateServerlessCache"
],
"Resource": [
"arn:aws:elasticache:*:*:serverlesscachesnapshot:*",
"arn:aws:elasticache:*:*:snapshot:*",
"arn:aws:elasticache:*:*:usergroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateServerlessCache"
],
"Resource": [
"arn:aws:elasticache:*:*:serverlesscache:*"
],
"Condition": {
"NumericLessThanEquals": {
"elasticache:MaximumDataStorage": "30"
},
"StringEquals": {
"elasticache:DataStorageUnit": "GB"
}
}
}
]
}
ElastiCache: 最大ECPUPer秒数：指定无服务器缓存每秒的最大 ECPU 值。根据提供的条件，客户无法创建 ECPUs 每秒执行次数超过特定次数的缓存。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDependentResources",
"Effect": "Allow",
"Action": [
"elasticache:CreateServerlessCache"
],
"Resource": [
"arn:aws:elasticache:*:*:serverlesscachesnapshot:*",
"arn:aws:elasticache:*:*:snapshot:*",
"arn:aws:elasticache:*:*:usergroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateServerlessCache"
],
"Resource": [
"arn:aws:elasticache:*:*:serverlesscache:*"
],
"Condition": {
"NumericLessThanEquals": {
"elasticache:MaximumECPUPerSecond": "100000"
}
}
}
]
}
elasticacheCacheNodeType:: 指定用户可以创建哪 NodeType些。使用提供的条件，客户可以为节点类型指定单个值或范围值。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"StringEquals": {
"elasticache:CacheNodeType": [
"cache.t2.micro",
"cache.t2.medium"
]
}
}
}
]
}
elasticacheCacheNodeType:: 使用 Memcached，指定用户可以创建哪 NodeType些。使用提供的条件，客户可以为节点类型指定单个值或范围值。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*"
],
"Condition": {
"StringEquals": {
"elasticache:CacheNodeType": [
"cache.t2.micro",
"cache.t2.medium"
]
}
}
}
]
}
elasticacheNumNodeGroups:: 创建节点组少于 20 个的复制组。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"NumericLessThanEquals": {
"elasticache:NumNodeGroups": "20"
}
}
}
]
}
elasticacheReplicasPerNodeGroup:: 指定每个节点的副本数在 5 到 10 之间。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"NumericGreaterThanEquals": {
"elasticache:ReplicasPerNodeGroup": "5"
},
"NumericLessThanEquals": {
"elasticache:ReplicasPerNodeGroup": "10"
}
}
}
]
}
elasticache:EngineVersion: 指定引擎版本 5.0.6 的用法。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"StringEquals": {
"elasticache:EngineVersion": "5.0.6"
}
}
}
]
}
elasticache:EngineVersion: 指定 Memcached 引擎版本 1.6.6 的用法
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*"
],
"Condition": {
"StringEquals": {
"elasticache:EngineVersion": "1.6.6"
}
}
}
]
}
elasticache:EngineType: 仅使用 Valkey 或 Redis OSS 引擎进行指定。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"StringEquals": {
"elasticache:EngineType": "redis"
}
}
}
]
}
elasticacheAtRestEncryptionEnabled:: 指定只有在启用加密的情况下才能创建复制组。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"Bool": {
"elasticache:AtRestEncryptionEnabled": "true"
}
}
}
]
}
-
弹性疼痛:TransitEncryptionEnabled
-
将CreateReplicationGroup操作的elasticache:TransitEncryptionEnabled条件键设置为，以指定只有在不使用 TLS 时才能创建复制组：false
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"Bool": {
"elasticache:TransitEncryptionEnabled": "false"
}
}
}
]
}
在CreateReplicationGroup操作策略false中将elasticache:TransitEncryptionEnabled条件键设置为时，只有在未使用 TLS 的情况下（也就是说，请求中不包含设置为的TransitEncryptionEnabled参数true或设置为的TransitEncryptionMode参数），才允许请求required。CreateReplicationGroup
-
将CreateReplicationGroup操作elasticache:TransitEncryptionEnabled的条件键设置为，以指定只有在使用 TLS 时才能创建复制组：true
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"Bool": {
"elasticache:TransitEncryptionEnabled": "true"
}
}
}
]
}
在CreateReplicationGroup操作策略true中将elasticache:TransitEncryptionEnabled条件键设置为时，只有在CreateReplicationGroup请求中包含设置为的参数true和设置为的TransitEncryptionEnabled参数时，TransitEncryptionMode才允许请求required。
-
针对 ModifyReplicationGroup 操作将 elasticache:TransitEncryptionEnabled 设置为 true，以指定只有在使用 TLS 时才能修改复制组：
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:ModifyReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"BoolIfExists": {
"elasticache:TransitEncryptionEnabled": "true"
}
}
}
]
}
在ModifyReplicationGroup操作策略true中将elasticache:TransitEncryptionEnabled条件键设置为时，只有当ModifyReplicationGroup请求包含设置为的TransitEncryptionMode参数时，才允许请求required。也可以选择包含设置为 true 的 TransitEncryptionEnabled 参数，但在这种情况下，该设置并不是启用 TLS 所必需的。
-
elasticacheAutomaticFailoverEnabled:: 指定只有在启用自动故障转移的情况下才能创建复制组。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"Bool": {
"elasticache:AutomaticFailoverEnabled": "true"
}
}
}
]
}
ElastiCache: Multi AZEnabled：指定在禁用多可用区的情况下无法创建复制组。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Deny",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"Bool": {
"elasticache:MultiAZEnabled": "false"
}
}
}
]
}
elasticacheClusterModeEnabled:: 指定只有在启用集群模式的情况下才能创建复制组。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"Bool": {
"elasticache:ClusterModeEnabled": "true"
}
}
}
]
}
elasticacheAuthTokenEnabled:: 指定只有在启用身份验证令牌的情况下才能创建复制组。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"Bool": {
"elasticache:AuthTokenEnabled": "true"
}
}
}
]
}
elasticacheSnapshotRetentionLimit:: 指定保存快照的天数（或最小/最大）。以下策略强制将备份存储至少 30 天。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup",
"elasticache:CreateServerlessCache"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*",
"arn:aws:elasticache:*:*:serverlesscache:*"
],
"Condition": {
"NumericGreaterThanEquals": {
"elasticache:SnapshotRetentionLimit": "30"
}
}
}
]
}
elasticache:KmsKeyId: 指定客户托管的 AWS KMS 密钥的使用情况。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowDependentResources",
"Effect": "Allow",
"Action": [
"elasticache:CreateServerlessCache"
],
"Resource": [
"arn:aws:elasticache:*:*:serverlesscachesnapshot:*",
"arn:aws:elasticache:*:*:snapshot:*",
"arn:aws:elasticache:*:*:usergroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateServerlessCache"
],
"Resource": [
"arn:aws:elasticache:*:*:serverlesscache:*"
],
"Condition": {
"StringEquals": {
"elasticache:KmsKeyId": "my-key"
}
}
}
]
}
elasticacheCacheParameterGroupName:: 指定一个非默认参数组，其中包含来自集群上某个组织的特定参数。您还可以为参数组指定命名模式，或阻止删除特定参数组名称。以下是限制仅使用 “my-org-param-group” 的示例。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
],
"Condition": {
"StringEquals": {
"elasticache:CacheParameterGroupName": "my-org-param-group"
}
}
}
]
}
elasticacheCacheParameterGroupName:: 使用 Memcached，使用集群上来自组织的特定参数来指定一个非默认参数组。您还可以为参数组指定命名模式，或阻止删除特定参数组名称。以下是限制仅使用 “my-org-param-group” 的示例。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*"
],
"Condition": {
"StringEquals": {
"elasticache:CacheParameterGroupName": "my-org-param-group"
}
}
}
]
}
-
elasticacheCreateCacheCluster:: 如果请求标签Project缺失或不等于Dev、QA或，则拒绝CreateCacheCluster执行操作。Prod
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*",
"arn:aws:elasticache:*:*:securitygroup:*",
"arn:aws:elasticache:*:*:replicationgroup:*"
]
},
{
"Effect": "Deny",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*"
],
"Condition": {
"Null": {
"aws:RequestTag/Project": "true"
}
}
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:AddTagsToResource"
],
"Resource": "arn:aws:elasticache:*:*:cluster:*",
"Condition": {
"StringEquals": {
"aws:RequestTag/Project": [
"Dev",
"Prod",
"QA"
]
}
}
}
]
}
elasticache:CacheNodeType: 允许CreateCacheCluster使用 cache .r5.large 或 cacheNodeType cache.r6g.4xlarge 和 tag。Project=XYZ
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster",
"elasticache:CreateReplicationGroup"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*"
],
"Condition": {
"StringEqualsIfExists": {
"elasticache:CacheNodeType": [
"cache.r5.large",
"cache.r6g.4xlarge"
]
},
"StringEquals": {
"aws:RequestTag/Project": "XYZ"
}
}
}
]
}
elasticache:CacheNodeType: 允许CreateCacheCluster使用 cache .r5.large 或 cacheNodeType cache.r6g.4xlarge 和 tag。Project=XYZ
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:parametergroup:*",
"arn:aws:elasticache:*:*:subnetgroup:*"
]
},
{
"Effect": "Allow",
"Action": [
"elasticache:CreateCacheCluster"
],
"Resource": [
"arn:aws:elasticache:*:*:cluster:*"
],
"Condition": {
"StringEqualsIfExists": {
"elasticache:CacheNodeType": [
"cache.r5.large",
"cache.r6g.4xlarge"
]
},
"StringEquals": {
"aws:RequestTag/Project": "XYZ"
}
}
}
]
}
在创建策略以将标签和其他条件键一起强制执行时，由于使用 --tags 参数创建请求的额外 elasticache:AddTagsToResource 策略要求，条件键元素可能需要条件 IfExists。
