本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 针对 Amazon Chime SDK 使用通话分析资源访问角色
<a name="call-analytics-resource-access-role"></a>

调用账户必须创建媒体见解管道配置使用的资源访问角色。您无法使用跨账户角色。

根据您在创建通话分析配置时启用的功能，您必须使用其他资源策略。展开以下部分以了解更多信息。

## 所需的最小策略
<a name="minimum-policy"></a>

该角色至少需要以下策略：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [{
            "Effect": "Allow",
            "Action": [
                "transcribe:StartCallAnalyticsStreamTranscription",
                "transcribe:StartStreamTranscription"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kinesisvideo:GetDataEndpoint",
                "kinesisvideo:GetMedia"
            ],
            "Resource": "arn:aws:kinesisvideo:{{us-east-1}}:{{111122223333}}:stream/Chime*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kinesisvideo:GetDataEndpoint",
                "kinesisvideo:GetMedia"
            ],
            "Resource": "arn:aws:kinesisvideo:{{us-east-1}}:{{111122223333}}:stream/*",
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/AWSServiceName": "ChimeSDK"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": ["kms:Decrypt"],
            "Resource": "arn:aws:kms:{{us-east-1}}:{{111122223333}}:key/*",
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/AWSServiceName": "ChimeSDK"
                }
            }
        }
    ]
}
```

------

您还必须使用以下信任策略：

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "mediapipelines.chime.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
            "aws:SourceAccount": "{{111122223333}}"
        },
        "ArnLike": {
            "aws:SourceARN": "arn:aws:chime:*:{{111122223333}}:*"
        }
        }
    }
  ]
}
```

------

## KinesisDataStreamSink 策略
<a name="kds-stream-sink-policy"></a>

如果您使用 `KinesisDataStreamSink`，请添加以下策略：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [{
            "Effect": "Allow",
            "Action": [
                "kinesis:PutRecord"
            ],
            "Resource": [
                "arn:aws:kinesis:{{us-east-1}}:{{111122223333}}:stream/{{output_stream_name}}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:GenerateDataKey"
            ],
            "Resource": [
            "arn:aws:kms:{{us-east-1}}:{{111122223333}}:key/*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/AWSServiceName": "ChimeSDK"
                }
            }
        }
    ]
}
```

------

## S3RecordingSink 策略
<a name="s3-recording-sink-policy"></a>

如果您使用 `S3RecordingSink`，请添加以下策略：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectTagging"
            ],
            "Resource": [
                "arn:aws:s3:::{{input_bucket_path}}/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kinesisvideo:GetDataEndpoint",
                "kinesisvideo:ListFragments",
                "kinesisvideo:GetMediaForFragmentList"
            ],
            "Resource": [
                "arn:aws:kinesisvideo:{{us-east-1}}:{{111122223333}}:stream/*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/AWSServiceName": "ChimeSDK"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "kinesisvideo:ListFragments",
                "kinesisvideo:GetMediaForFragmentList"
            ],
            "Resource": [
            "arn:aws:kinesisvideo:{{us-east-1}}:{{111122223333}}:stream/Chime*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:GenerateDataKey"
            ],
            "Resource": [
            "arn:aws:kms:{{us-east-1}}:{{111122223333}}:key/*"
            ],
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/AWSServiceName": "ChimeSDK"
                }
            }
        }
    ]
}
```

------

## 通话后分析策略
<a name="post-call-analytics-policy"></a>

如果您使用 `AmazonTranscribeCallAnalyticsProcessor` 的通话后分析功能，请添加以下策略：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::{{111122223333}}:role/{{transcribe_role_name}}"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": "transcribe.streaming.amazonaws.com"
                }
            }
        }
    ]
}
```

------

## VoiceEnhancementSinkConfiguration 策略
<a name="enhancement-sink-config-policy"></a>

如果您使用 `VoiceEnhancementSinkConfiguration` 元素，添加以下策略：

------
#### [ JSON ]

****  

```
{
   "Version":"2012-10-17",		 	 	 
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "s3:GetObject",
            "s3:PutObject",
            "s3:PutObjectAcl",
            "s3:PutObjectTagging"
         ],
         "Resource":[
            "arn:aws:s3:::{{input_bucket_path}}/*"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "kinesisvideo:GetDataEndpoint",
            "kinesisvideo:ListFragments",
            "kinesisvideo:GetMediaForFragmentList"
         ],
         "Resource":[
            "arn:aws:kinesisvideo:{{us-east-1}}:{{111122223333}}:stream/*"
         ],
         "Condition":{
            "StringLike":{
               "aws:ResourceTag/AWSServiceName":"ChimeSDK"
            }
         }
      },
      {
         "Effect":"Allow",
         "Action":[
            "kinesisvideo:ListFragments",
            "kinesisvideo:GetMediaForFragmentList"
         ],
         "Resource":[
         "arn:aws:kinesisvideo:{{us-east-1}}:{{111122223333}}:stream/Chime*"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "kms:GenerateDataKey"
         ],
         "Resource":[
         "arn:aws:kms:{{us-east-1}}:{{111122223333}}:key/*"
         ],
         "Condition":{
            "StringLike":{
               "aws:ResourceTag/AWSServiceName":"ChimeSDK"
            }
         }
      }
   ]
}
```

------

## VoiceAnalyticsProcessor 策略
<a name="voice-analytics-processor-policy"></a>

如果您使用 `VoiceAnalyticsProcessor`，则根据您定义的接收器添加 `LambdaFunctionSink`、`SqsQueueSink` 和 `SnsTopicSink` 的策略。

`LambdaFunctionSink` 策略：    
****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Action": [
        "lambda:InvokeFunction",
        "lambda:GetPolicy"
       ],
      "Resource": [
          "arn:aws:lambda:{{us-east-1}}:{{111122223333}}:{{function}}:{{function_name}}"
       ],
      "Effect": "Allow"
    }
  ]
}
```

`SqsQueueSink` 策略    
****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Action": [
        "sqs:SendMessage",
        "sqs:GetQueueAttributes"
       ],
      "Resource": [
      "arn:aws:sqs:{{us-east-1}}:{{111122223333}}:{{queue_name}}"
        ],
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
      "Resource": "arn:aws:kms:{{us-east-1}}:{{111122223333}}:key/*",
      "Condition": {
        "StringLike": {
            "aws:ResourceTag/AWSServiceName": "ChimeSDK"
        }
      }
    }
  ]
}
```

`SnsTopicSink` 策略：    
****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Action": [
        "sns:Publish",
        "sns:GetTopicAttributes"
      ],
      "Resource": [
      "arn:aws:sns:{{us-east-1}}:{{111122223333}}:{{topic_name}}"
      ],
      "Effect": "Allow"
    },
    {
      "Effect": "Allow",
      "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
      "Resource": "arn:aws:kms:{{us-east-1}}:{{111122223333}}:key/*",
      "Condition": {
        "StringLike": {
            "aws:ResourceTag/AWSServiceName": "ChimeSDK"
        }
      }
    }
  ]
}
```