本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # ViewOnlyAccess **描述**：此策略授予查看所有 AWS 服务的资源和基本元数据的权限。 `ViewOnlyAccess` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 您可以将 `ViewOnlyAccess` 附加到您的用户、组和角色。 ## 策略详细信息 + **类型**：工作职能策略 + **创建时间**：2016 年 11 月 10 日 17:20 UTC + **编辑时间：世界标准时间** 2026 年 2 月 12 日 18:02 + **ARN**: `arn:aws:iam::aws:policy/job-function/ViewOnlyAccess` ## 策略版本 **策略版本：**v43（默认） 此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "GeneralViewOnlyAccessStatement", "Effect" : "Allow", "Action" : [ "acm:ListCertificates", "aiops:GetInvestigation", "aiops:GetInvestigationGroup", "aiops:ListInvestigationEvents", "aiops:ListInvestigationGroups", "aiops:ListInvestigations", "athena:List*", "autoscaling:Describe*", "aws-marketplace:ViewSubscriptions", "backup:DescribeBackupJob", "backup:DescribeBackupVault", "backup:DescribeCopyJob", "backup:DescribeFramework", "backup:DescribeGlobalSettings", "backup:DescribeProtectedResource", "backup:DescribeRecoveryPoint", "backup:DescribeRegionSettings", "backup:DescribeReportJob", "backup:DescribeReportPlan", "backup:DescribeRestoreJob", "backup:GetSupportedResourceTypes", "backup:ListBackupJobs", "backup:ListBackupPlans", "backup:ListBackupPlanTemplates", "backup:ListBackupPlanVersions", "backup:ListBackupSelections", "backup:ListBackupVaults", "backup:ListCopyJobs", "backup:ListFrameworks", "backup:ListLegalHolds", "backup:ListProtectedResources", "backup:ListProtectedResourcesByBackupVault", "backup:ListRecoveryPointsByBackupVault", "backup:ListRecoveryPointsByLegalHold", "backup:ListRecoveryPointsByResource", "backup:ListReportJobs", "backup:ListReportPlans", "backup:ListRestoreJobs", "backup:ListTags", "batch:ListJobs", "bedrock:ListCustomModels", "bedrock:ListTagsForResource", "clouddirectory:ListAppliedSchemaArns", "clouddirectory:ListDevelopmentSchemaArns", "clouddirectory:ListDirectories", "clouddirectory:ListPublishedSchemaArns", "cloudformation:DescribeStacks", "cloudformation:List*", "cloudfront:List*", "cloudsearch:DescribeDomains", "cloudsearch:List*", "cloudtrail:DescribeTrails", "cloudtrail:ListTrails", "cloudtrail:LookupEvents", "cloudwatch:Get*", "cloudwatch:List*", "codebuild:ListBuilds*", "codebuild:ListProjects", "codecommit:List*", "codedeploy:BatchGetApplicationRevisions", "codedeploy:BatchGetApplications", "codedeploy:BatchGetDeploymentGroups", "codedeploy:BatchGetDeploymentInstances", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetDeploymentTargets", "codedeploy:BatchGetOnPremisesInstances", "codedeploy:Get*", "codedeploy:List*", "codepipeline:ListPipelines", "codestar:List*", "cognito-identity:ListIdentities", "cognito-identity:ListIdentityPools", "cognito-idp:List*", "cognito-sync:ListDatasets", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:List*", "connect:List*", "cost-optimization-hub:GetPreferences", "cost-optimization-hub:GetRecommendation", "cost-optimization-hub:ListEnrollmentStatuses", "cost-optimization-hub:ListRecommendations", "cost-optimization-hub:ListRecommendationSummaries", "databrew:ListJobs", "databrew:ListProjects", "datapipeline:DescribePipelines", "datapipeline:GetAccountLimits", "datapipeline:ListPipelines", "dax:DescribeClusters", "dax:DescribeDefaultParameters", "dax:DescribeEvents", "dax:DescribeParameterGroups", "dax:DescribeParameters", "dax:DescribeSubnetGroups", "dax:ListTags", "devicefarm:List*", "directconnect:Describe*", "discovery:List*", "dms:List*", "ds:DescribeDirectories", "dynamodb:DescribeBackup", "dynamodb:DescribeContinuousBackups", "dynamodb:DescribeGlobalTable", "dynamodb:DescribeGlobalTableSettings", "dynamodb:DescribeLimits", "dynamodb:DescribeReservedCapacity", "dynamodb:DescribeReservedCapacityOfferings", "dynamodb:DescribeStream", "dynamodb:DescribeTable", "dynamodb:DescribeTimeToLive", "dynamodb:ListBackups", "dynamodb:ListExports", "dynamodb:ListGlobalTables", "dynamodb:ListStreams", "dynamodb:ListTables", "dynamodb:ListTagsOfResource", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeBundleTasks", "ec2:DescribeCarrierGateways", "ec2:DescribeClassicLinkInstances", "ec2:DescribeConversionTasks", "ec2:DescribeCustomerGateways", "ec2:DescribeDhcpOptions", "ec2:DescribeExportTasks", "ec2:DescribeFlowLogs", "ec2:DescribeHost*", "ec2:DescribeIdentityIdFormat", "ec2:DescribeIdFormat", "ec2:DescribeImage*", "ec2:DescribeImport*", "ec2:DescribeInstance*", "ec2:DescribeInternetGateways", "ec2:DescribeKeyPairs", "ec2:DescribeLocalGatewayRouteTables", "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations", "ec2:DescribeLocalGatewayRouteTableVpcAssociations", "ec2:DescribeLocalGateways", "ec2:DescribeLocalGatewayVirtualInterfaceGroups", "ec2:DescribeLocalGatewayVirtualInterfaces", "ec2:DescribeMovingAddresses", "ec2:DescribeNatGateways", "ec2:DescribeNetwork*", "ec2:DescribePlacementGroups", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeReserved*", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroupRules", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshot*", "ec2:DescribeSpot*", "ec2:DescribeSubnets", "ec2:DescribeTags", "ec2:DescribeVolume*", "ec2:DescribeVpc*", "ec2:DescribeVpnGateways", "ec2:SearchLocalGatewayRoutes", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:ListImages", "ecs:Describe*", "ecs:List*", "eks:ListTagsForResource", "elasticache:Describe*", "elasticbeanstalk:DescribeApplications", "elasticbeanstalk:DescribeApplicationVersions", "elasticbeanstalk:DescribeEnvironments", "elasticbeanstalk:ListAvailableSolutionStacks", "elasticfilesystem:DescribeFileSystems", "elasticloadbalancing:DescribeInstanceHealth", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticmapreduce:List*", "elastictranscoder:List*", "emr-serverless:ListApplications", "es:DescribeElasticsearchDomain", "es:DescribeElasticsearchDomains", "es:ListDomainNames", "events:ListRuleNamesByTarget", "events:ListRules", "events:ListTargetsByRule", "firehose:DescribeDeliveryStream", "firehose:List*", "fsx:DescribeFileSystems", "gamelift:List*", "glacier:List*", "glue:GetTags", "greengrass:List*", "iam:GetAccountSummary", "iam:GetLoginProfile", "iam:List*", "importexport:ListJobs", "inspector:List*", "iot:List*", "kafka:ListClusters", "kendra:ListDataSources", "kendra:ListTagsForResource", "kinesis:ListStreams", "kinesisanalytics:ListApplications", "kinesisanalytics:ListTagsForResource", "kms:ListKeys", "kms:ListResourceTags", "lambda:List*", "lex:GetBotAliases", "lex:GetBotChannelAssociations", "lex:GetBots", "lex:GetBotVersions", "lex:GetIntents", "lex:GetIntentVersions", "lex:GetSlotTypes", "lex:GetSlotTypeVersions", "lex:GetUtterancesView", "lightsail:GetBlueprints", "lightsail:GetBundles", "lightsail:GetInstances", "lightsail:GetInstanceSnapshots", "lightsail:GetKeyPair", "lightsail:GetRegions", "lightsail:GetStaticIps", "lightsail:IsVpcPeered", "logs:Describe*", "logs:GetTransformer", "logs:ListEntitiesForLogGroup", "logs:ListLogGroupsForEntity", "logs:ListLogGroupsForQuery", "logs:ListTagsForResource", "lookoutvision:ListModelPackagingJobs", "lookoutvision:ListModels", "lookoutvision:ListProjects", "m2:GetApplication", "m2:GetEnvironment", "m2:ListApplications", "m2:ListEnvironments", "m2:ListTagsForResource", "machinelearning:Describe*", "mediaconnect:ListEntitlements", "mediaconnect:ListFlows", "mediaconnect:ListOfferings", "mediaconnect:ListReservations", "mediaconnect:ListRouterInputs", "mediaconnect:ListRouterOutputs", "mediaconnect:ListRouterNetworkInterfaces", "mobiletargeting:GetApplicationSettings", "mobiletargeting:GetCampaigns", "mobiletargeting:GetImportJobs", "mobiletargeting:GetSegments", "oam:ListAttachedLinks", "oam:ListLinks", "oam:ListSinks", "opsworks-cm:Describe*", "opsworks:Describe*", "organizations:List*", "outposts:GetOutpost", "outposts:GetOutpostInstanceTypes", "outposts:ListOutposts", "outposts:ListSites", "outposts:ListTagsForResource", "polly:Describe*", "polly:List*", "profile:ListDomains", "profile:ListIntegrations", "rds:Describe*", "redshift-serverless:ListTagsForResource", "redshift-serverless:ListWorkgroups", "redshift:DescribeClusters", "redshift:DescribeEvents", "redshift:ViewQueriesInConsole", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:ListIndexes", "resource-explorer-2:ListSupportedResourceTypes", "resource-explorer-2:ListTagsForResource", "resource-explorer-2:ListViews", "rolesanywhere:ListCrls", "rolesanywhere:ListProfiles", "rolesanywhere:ListSubjects", "rolesanywhere:ListTagsForResource", "rolesanywhere:ListTrustAnchors", "route53:Get*", "route53:List*", "route53domains:List*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:ListProfileAssociations", "route53profiles:ListProfileResourceAssociations", "route53profiles:ListProfiles", "route53profiles:ListTagsForResource", "route53resolver:Get*", "route53resolver:List*", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListMultiRegionAccessPoints", "sagemaker:Describe*", "sagemaker:List*", "sdb:List*", "servicecatalog:List*", "ses:DescribeActiveReceiptRuleSet", "ses:List*", "ses:ListDedicatedIpPools", "shield:List*", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ListMessageMoveTasks", "sqs:ListQueues", "sqs:ListQueueTags", "ssm:ListAssociations", "ssm:ListDocuments", "states:ListActivities", "states:ListExecutions", "states:ListMapRuns", "states:ListStateMachineAliases", "states:ListStateMachines", "states:ListStateMachineVersions", "storagegateway:ListGateways", "storagegateway:ListLocalDisks", "storagegateway:ListVolumeRecoveryPoints", "storagegateway:ListVolumes", "swf:List*", "trustedadvisor:Describe*", "waf-regional:List*", "waf:List*", "wafv2:List*", "workdocs:DescribeAvailableDirectories", "workdocs:DescribeInstances", "workmail:Describe*", "workspaces:Describe*", "xray:GetEncryptionConfig", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetSamplingStatisticSummaries", "xray:GetSamplingTargets", "xray:GetTraceSegmentDestination", "xray:ListResourcePolicies" ], "Resource" : "*" }, { "Effect" : "Allow", "Sid" : "APIGatewayAccess", "Action" : [ "apigateway:GET" ], "Resource" : [ "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*/authorizers/*", "arn:aws:apigateway:*::/apis/*/authorizers", "arn:aws:apigateway:*::/apis/*/cors", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/exports/*", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/models/*", "arn:aws:apigateway:*::/apis/*/models", "arn:aws:apigateway:*::/apis/*/routes/*", "arn:aws:apigateway:*::/apis/*/routes", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/clientcertificates", "arn:aws:apigateway:*::/clientcertificates/*", "arn:aws:apigateway:*::/domainnames", "arn:aws:apigateway:*::/domainnames/*/apimappings", "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*/authorizers/*", "arn:aws:apigateway:*::/restapis/*/authorizers", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/documentation/parts/*", "arn:aws:apigateway:*::/restapis/*/documentation/parts", "arn:aws:apigateway:*::/restapis/*/documentation/versions/*", "arn:aws:apigateway:*::/restapis/*/documentation/versions", "arn:aws:apigateway:*::/restapis/*/gatewayresponses/*", "arn:aws:apigateway:*::/restapis/*/gatewayresponses", "arn:aws:apigateway:*::/restapis/*/models/*", "arn:aws:apigateway:*::/restapis/*/models", "arn:aws:apigateway:*::/restapis/*/requestvalidators", "arn:aws:apigateway:*::/restapis/*/requestvalidators/*", "arn:aws:apigateway:*::/restapis/*/resources/*", "arn:aws:apigateway:*::/restapis/*/resources", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/tags/*", "arn:aws:apigateway:*::/vpclinks" ] } ] } ``` ## 了解详情 + [在 IAM 身份中心使用 AWS 托管策略创建权限集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [添加和删除 IAM 身份权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM policy 版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略，转向最低权限权限](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)