本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# Deadline Cloud 基于身份的策略示例
默认情况下，用户和角色无权创建或修改 Deadline Cloud 资源。要授予用户对所需资源执行操作的权限，IAM 管理员可以创建 IAM 策略。
要了解如何使用这些示例 JSON 策略文档创建基于 IAM 身份的策略，请参阅《IAM 用户指南》**中的[创建 IAM 策略（控制台）](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html)。
有关 Deadline Cloud 定义的操作和资源类型（包括每种资源类型的格式）的详细信息，请参阅《*服务授权参考*》中的 De [AWS adline Cloud 的操作、资源和条件密钥](https://docs.aws.amazon.com/service-authorization/latest/reference/list_deadline.html)。 ARNs
**Topics**
+ [策略最佳实践](#security_iam_service-with-iam-policy-best-practices)
+ [使用截止日期云控制台](#security_iam_id-based-policy-examples-console)
+ [访问控制台的策略](#security_iam_id-based-policy-console-access)
+ [向队列提交作业的政策](#security_iam_id-based-policy-examples-submit-jobs)
+ [允许创建许可证端点的策略](#security_iam-id-based-policy-examples-create-endpoint)
+ [允许监控特定服务器场队列的策略](#security_iam-id-based-policy-examples-monitor-queue)
## 策略最佳实践
基于身份的策略决定了某人是否可以在您的账户中创建、访问或删除 Deadline Cloud 资源。这些操作可能会使 AWS 账户产生成本。创建或编辑基于身份的策略时，请遵循以下指南和建议：
+ **开始使用 AWS 托管策略并转向最低权限权限** — 要开始向用户和工作负载授予权限，请使用为许多常见用例授予权限的*AWS 托管策略*。它们在你的版本中可用 AWS 账户。我们建议您通过定义针对您的用例的 AWS 客户托管策略来进一步减少权限。有关更多信息，请参阅《IAM 用户指南》**中的 [AWS 托管策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)或[工作职能的AWS 托管策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html)。
+ **应用最低权限**：在使用 IAM 策略设置权限时，请仅授予执行任务所需的权限。为此，您可以定义在特定条件下可以对特定资源执行的操作，也称为*最低权限许可*。有关使用 IAM 应用权限的更多信息，请参阅《IAM 用户指南》**中的 [IAM 中的策略和权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)。
+ **使用 IAM 策略中的条件进一步限制访问权限**：您可以向策略添加条件来限制对操作和资源的访问。例如，您可以编写策略条件来指定必须使用 SSL 发送所有请求。如果服务操作是通过特定的方式使用的，则也可以使用条件来授予对服务操作的访问权限 AWS 服务，例如 CloudFormation。有关更多信息，请参阅《IAM 用户指南》**中的 [IAM JSON 策略元素：条件](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)。
+ **使用 IAM Access Analyzer 验证您的 IAM 策略，以确保权限的安全性和功能性**：IAM Access Analyzer 会验证新策略和现有策略，以确保策略符合 IAM 策略语言（JSON）和 IAM 最佳实践。IAM Access Analyzer 提供 100 多项策略检查和可操作的建议，以帮助您制定安全且功能性强的策略。有关更多信息，请参阅《IAM 用户指南》**中的[使用 IAM Access Analyzer 验证策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html)。
+ **需要多重身份验证 (MFA**)-如果 AWS 账户您的场景需要 IAM 用户或根用户，请启用 MFA 以提高安全性。若要在调用 API 操作时需要 MFA，请将 MFA 条件添加到您的策略中。有关更多信息，请参阅《IAM 用户指南》**中的[使用 MFA 保护 API 访问](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html)。
有关 IAM 中的最佳实操的更多信息，请参阅《IAM 用户指南》**中的 [IAM 中的安全最佳实践](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)。
## 使用截止日期云控制台
要访问 De AWS adline Cloud 控制台，您必须拥有一组最低权限。这些权限必须允许您列出和查看有关您的 Deadline Cloud 资源的详细信息 AWS 账户。如果创建比必需的最低权限更为严格的基于身份的策略，对于附加了该策略的实体（用户或角色），控制台将无法按预期正常运行。
对于仅调用 AWS CLI 或 AWS API 的用户，您无需为其设置最低控制台权限。相反，只允许访问与其尝试执行的 API 操作相匹配的操作。
为确保用户和角色仍然可以使用 Deadline Cloud 控制台，还需要将 Deadline Cloud `ConsoleAccess` 或`ReadOnly` AWS 托管策略附加到实体。有关更多信息，请参阅《IAM 用户指南》**中的[为用户添加权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console)。
## 访问控制台的策略
要授予对 Deadline Cloud 控制台中所有功能的访问权限，请将此身份策略附加到您想要拥有完全访问权限的用户或角色。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [{
"Sid": "EC2InstanceTypeSelection",
"Effect": "Allow",
"Action": [
"ec2:DescribeInstanceTypeOfferings",
"ec2:DescribeInstanceTypes",
"ec2:GetInstanceTypesFromInstanceRequirements",
"pricing:GetProducts"
],
"Resource": ["*"]
},
{
"Sid": "VPCResourceSelection",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups"
],
"Resource": ["*"]
},
{
"Sid": "ViewVpcLatticeResources",
"Effect": "Allow",
"Action": [
"vpc-lattice:ListResourceConfigurations",
"vpc-lattice:GetResourceConfiguration",
"vpc-lattice:GetResourceGateway"
],
"Resource": ["*"]
},
{
"Sid": "ManageVpcEndpointsViaDeadline",
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint",
"ec2:DescribeVpcEndpoints",
"ec2:DeleteVpcEndpoints",
"ec2:CreateTags"
],
"Resource": ["*"],
"Condition": {
"StringEquals": { "aws:CalledViaFirst": "deadline.amazonaws.com" }
}
},
{
"Sid": "ChooseJobAttachmentsBucket",
"Effect": "Allow",
"Action": ["s3:GetBucketLocation", "s3:ListAllMyBuckets"],
"Resource": "*"
},
{
"Sid": "CreateDeadlineCloudLogGroups",
"Effect": "Allow",
"Action": ["logs:CreateLogGroup"],
"Resource": "arn:aws:logs:*:*:log-group:/aws/deadline/*",
"Condition": {
"StringLike": { "aws:CalledViaFirst": "deadline.amazonaws.com" }
}
},
{
"Sid": "ValidateDependencies",
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": "*",
"Condition": {
"StringLike": { "aws:CalledViaFirst": "deadline.amazonaws.com" }
}
},
{
"Sid": "RoleSelection",
"Effect": "Allow",
"Action": ["iam:GetRole", "iam:ListRoles"],
"Resource": "*"
},
{
"Sid": "PassRoleToDeadlineCloud",
"Effect": "Allow",
"Action": ["iam:PassRole"],
"Condition": {
"StringLike": { "iam:PassedToService": "deadline.amazonaws.com" }
},
"Resource": "*"
},
{
"Sid": "KMSKeySelection",
"Effect": "Allow",
"Action": ["kms:ListKeys", "kms:ListAliases"],
"Resource": "*"
},
{
"Sid": "IdentityStoreReadOnly",
"Effect": "Allow",
"Action": [
"identitystore:DescribeUser",
"identitystore:DescribeGroup",
"identitystore:ListGroups",
"identitystore:ListUsers",
"identitystore:IsMemberInGroups",
"identitystore:ListGroupMemberships",
"identitystore:ListGroupMembershipsForMember",
"identitystore:GetGroupMembershipId"
],
"Resource": "*"
},
{
"Sid": "OrganizationAndIdentityCenterIdentification",
"Effect": "Allow",
"Action": [
"sso:ListDirectoryAssociations",
"organizations:DescribeAccount",
"organizations:DescribeOrganization",
"sso:DescribeRegisteredRegions",
"sso:GetManagedApplicationInstance",
"sso:GetSharedSsoConfiguration",
"sso:ListInstances",
"sso:GetApplicationAssignmentConfiguration",
"sso:GetSSOStatus",
"sso:ListRegions",
"sso:DescribeRegion"
],
"Resource": "*"
},
{
"Sid": "ManagedDeadlineCloudIDCApplication",
"Effect": "Allow",
"Action": [
"sso:CreateApplication",
"sso:PutApplicationAssignmentConfiguration",
"sso:PutApplicationAuthenticationMethod",
"sso:PutApplicationGrant",
"sso:DeleteApplication",
"sso:UpdateApplication"
],
"Resource": "*",
"Condition": {
"StringLike": { "aws:CalledViaFirst": "deadline.amazonaws.com" }
}
},
{
"Sid": "ChooseSecret",
"Effect": "Allow",
"Action": ["secretsmanager:ListSecrets"],
"Resource": "*"
},
{
"Sid": "DeadlineMembershipActions",
"Effect": "Allow",
"Action": [
"deadline:AssociateMemberToFarm",
"deadline:AssociateMemberToFleet",
"deadline:AssociateMemberToQueue",
"deadline:AssociateMemberToJob",
"deadline:DisassociateMemberFromFarm",
"deadline:DisassociateMemberFromFleet",
"deadline:DisassociateMemberFromQueue",
"deadline:DisassociateMemberFromJob",
"deadline:ListFarmMembers",
"deadline:ListFleetMembers",
"deadline:ListQueueMembers",
"deadline:ListJobMembers"
],
"Resource": ["*"]
},
{
"Sid": "DeadlineControlPlaneActions",
"Effect": "Allow",
"Action": [
"deadline:CreateMonitor",
"deadline:GetMonitor",
"deadline:UpdateMonitor",
"deadline:DeleteMonitor",
"deadline:ListMonitors",
"deadline:CreateFarm",
"deadline:GetFarm",
"deadline:UpdateFarm",
"deadline:DeleteFarm",
"deadline:ListFarms",
"deadline:CreateQueue",
"deadline:GetQueue",
"deadline:UpdateQueue",
"deadline:DeleteQueue",
"deadline:ListQueues",
"deadline:CreateFleet",
"deadline:GetFleet",
"deadline:UpdateFleet",
"deadline:DeleteFleet",
"deadline:ListFleets",
"deadline:ListWorkers",
"deadline:CreateQueueFleetAssociation",
"deadline:GetQueueFleetAssociation",
"deadline:UpdateQueueFleetAssociation",
"deadline:DeleteQueueFleetAssociation",
"deadline:ListQueueFleetAssociations",
"deadline:CreateQueueEnvironment",
"deadline:GetQueueEnvironment",
"deadline:UpdateQueueEnvironment",
"deadline:DeleteQueueEnvironment",
"deadline:ListQueueEnvironments",
"deadline:CreateLimit",
"deadline:GetLimit",
"deadline:UpdateLimit",
"deadline:DeleteLimit",
"deadline:ListLimits",
"deadline:CreateQueueLimitAssociation",
"deadline:GetQueueLimitAssociation",
"deadline:DeleteQueueLimitAssociation",
"deadline:UpdateQueueLimitAssociation",
"deadline:ListQueueLimitAssociations",
"deadline:CreateStorageProfile",
"deadline:GetStorageProfile",
"deadline:UpdateStorageProfile",
"deadline:DeleteStorageProfile",
"deadline:ListStorageProfiles",
"deadline:ListStorageProfilesForQueue",
"deadline:ListBudgets",
"deadline:TagResource",
"deadline:UntagResource",
"deadline:ListTagsForResource",
"deadline:CreateLicenseEndpoint",
"deadline:GetLicenseEndpoint",
"deadline:DeleteLicenseEndpoint",
"deadline:ListLicenseEndpoints",
"deadline:ListAvailableMeteredProducts",
"deadline:ListMeteredProducts",
"deadline:PutMeteredProduct",
"deadline:DeleteMeteredProduct"
],
"Resource": ["*"]
}]
}
```
------
## 向队列提交作业的政策
在此示例中，您创建了一个范围缩小策略，该策略授予向特定服务器场中的特定队列提交作业的权限。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Sid": "SubmitJobsFarmAndQueue",
"Effect": "Allow",
"Action": "deadline:CreateJob",
"Resource": "arn:aws:deadline:us-east-1:111122223333:farm/FARM_A/queue/QUEUE_B/job/*"
}
]
}
```
------
## 允许创建许可证端点的策略
在此示例中，您将创建一个范围缩小策略，该策略授予创建和管理许可证端点所需的权限。使用此策略为与您的服务器场关联的 VPC 创建许可证终端节点。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [{
"Sid": "CreateLicenseEndpoint",
"Effect": "Allow",
"Action": [
"deadline:CreateLicenseEndpoint",
"deadline:DeleteLicenseEndpoint",
"deadline:GetLicenseEndpoint",
"deadline:ListLicenseEndpoints",
"deadline:PutMeteredProduct",
"deadline:DeleteMeteredProduct",
"deadline:ListMeteredProducts",
"deadline:ListAvailableMeteredProducts",
"ec2:CreateVpcEndpoint",
"ec2:DescribeVpcEndpoints",
"ec2:DeleteVpcEndpoints"
],
"Resource": [
"arn:aws:deadline:*:111122223333:*",
"arn:aws:ec2:*:111122223333:vpc-endpoint/*"
]
}]
}
```
------
## 允许监控特定服务器场队列的策略
在此示例中，您创建了一个范围缩小策略，该策略授予监视特定服务器场特定队列中作业的权限。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [{
"Sid": "MonitorJobsFarmAndQueue",
"Effect": "Allow",
"Action": [
"deadline:SearchJobs",
"deadline:ListJobs",
"deadline:GetJob",
"deadline:SearchSteps",
"deadline:ListSteps",
"deadline:ListStepConsumers",
"deadline:ListStepDependencies",
"deadline:GetStep",
"deadline:SearchTasks",
"deadline:ListTasks",
"deadline:GetTask",
"deadline:ListSessions",
"deadline:GetSession",
"deadline:ListSessionActions",
"deadline:GetSessionAction"
],
"Resource": [
"arn:aws:deadline:us-east-1:123456789012:farm/FARM_A/queue/QUEUE_B",
"arn:aws:deadline:us-east-1:123456789012:farm/FARM_A/queue/QUEUE_B/*"
]
}]
}
```
------