本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# 为 DevOps Guru 使用服务相关角色
Amazon DevOps Guru 使用 AWS Identity and Access Management (IAM) [服务相关](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-service-linked-role)角色。服务相关角色是一种独特的 IAM 角色，直接与 DevOps Guru 关联。服务相关角色由 DevOps Guru 预定义，包括该服务代表您调用 A AWS CloudTrail mazon CloudWatch、 AWS CodeDeploy AWS X-Ray、和 AWS Organizations 所需的所有权限。
与服务相关的角色可以更轻松地设置 DevOps Guru，因为您不必手动添加必要的权限。 DevOpsGuru 定义了其服务相关角色的权限，除非另有定义，否则只有 DevOps Guru 可以担任其角色。定义的权限包括信任策略和权限策略，而且权限策略不能附加到任何其它 IAM 实体。
只有在首先删除服务相关角色的相关资源后，才能删除该角色。这样可以保护您的 DevOps Guru 资源，因为您不会无意中移除对资源的访问权限。
## Guru 的服务相关角色权限 DevOps
DevOpsGuru 使用名为的服务相关角色。`AWSServiceRoleForDevOpsGuru`这是一项 AWS 托管策略，具有 DevOps Guru 需要在您的账户中运行的限定权限。
`AWSServiceRoleForDevOpsGuru` 服务相关角色仅信任以下服务来担任该角色：
+ `devops-guru.amazonaws.com`
角色权限策略`AmazonDevOpsGuruServiceRolePolicy`允许 DevOps Guru 对指定资源完成以下操作。
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups",
"cloudtrail:LookupEvents",
"cloudwatch:GetMetricData",
"cloudwatch:ListMetrics",
"cloudwatch:DescribeAnomalyDetectors",
"cloudwatch:DescribeAlarms",
"cloudwatch:ListDashboards",
"cloudwatch:GetDashboard",
"cloudformation:GetTemplate",
"cloudformation:ListStacks",
"cloudformation:ListStackResources",
"cloudformation:DescribeStacks",
"cloudformation:ListImports",
"codedeploy:BatchGetDeployments",
"codedeploy:GetDeploymentGroup",
"codedeploy:ListDeployments",
"config:DescribeConfigurationRecorderStatus",
"config:GetResourceConfigHistory",
"events:ListRuleNamesByTarget",
"xray:GetServiceGraph",
"organizations:ListRoots",
"organizations:ListChildren",
"organizations:ListDelegatedAdministrators",
"pi:GetResourceMetrics",
"tag:GetResources",
"lambda:GetFunction",
"lambda:GetFunctionConcurrency",
"lambda:GetAccountSettings",
"lambda:ListProvisionedConcurrencyConfigs",
"lambda:ListAliases",
"lambda:ListEventSourceMappings",
"lambda:GetPolicy",
"ec2:DescribeSubnets",
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScalingPolicies",
"sqs:GetQueueAttributes",
"kinesis:DescribeStream",
"kinesis:DescribeLimits",
"dynamodb:DescribeTable",
"dynamodb:DescribeLimits",
"dynamodb:DescribeContinuousBackups",
"dynamodb:DescribeStream",
"dynamodb:ListStreams",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeLoadBalancerAttributes",
"rds:DescribeDBInstances",
"rds:DescribeDBClusters",
"rds:DescribeOptionGroups",
"rds:DescribeDBClusterParameters",
"rds:DescribeDBInstanceAutomatedBackups",
"rds:DescribeAccountAttributes",
"logs:DescribeLogGroups",
"logs:DescribeLogStreams",
"s3:GetBucketNotification",
"s3:GetBucketPolicy",
"s3:GetBucketPublicAccessBlock",
"s3:GetBucketTagging",
"s3:GetBucketWebsite",
"s3:GetIntelligentTieringConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetReplicationConfiguration",
"s3:ListAllMyBuckets",
"s3:ListStorageLensConfigurations",
"servicequotas:GetServiceQuota",
"servicequotas:ListRequestedServiceQuotaChangeHistory",
"servicequotas:ListServiceQuotas"
],
"Resource": "*"
},
{
"Sid": "AllowPutTargetsOnASpecificRule",
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:PutRule"
],
"Resource": "arn:aws:events:*:*:rule/DevOps-Guru-managed-*"
},
{
"Sid": "AllowCreateOpsItem",
"Effect": "Allow",
"Action": [
"ssm:CreateOpsItem"
],
"Resource": "*"
},
{
"Sid": "AllowAddTagsToOpsItem",
"Effect": "Allow",
"Action": [
"ssm:AddTagsToResource"
],
"Resource": "arn:aws:ssm:*:*:opsitem/*"
},
{
"Sid": "AllowAccessOpsItem",
"Effect": "Allow",
"Action": [
"ssm:GetOpsItem",
"ssm:UpdateOpsItem"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/DevOps-GuruInsightSsmOpsItemRelated": "true"
}
}
},
{
"Sid": "AllowCreateManagedRule",
"Effect": "Allow",
"Action": "events:PutRule",
"Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*"
},
{
"Sid": "AllowAccessManagedRule",
"Effect": "Allow",
"Action": [
"events:DescribeRule",
"events:ListTargetsByRule"
],
"Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*"
},
{
"Sid": "AllowOtherOperationsOnManagedRule",
"Effect": "Allow",
"Action": [
"events:DeleteRule",
"events:EnableRule",
"events:DisableRule",
"events:PutTargets",
"events:RemoveTargets"
],
"Resource": "arn:aws:events:*:*:rule/DevOpsGuruManagedRule*",
"Condition": {
"StringEquals": {
"events:ManagedBy": "devops-guru.amazonaws.com"
}
}
},
{
"Sid": "AllowTagBasedFilterLogEvents",
"Effect": "Allow",
"Action": [
"logs:FilterLogEvents"
],
"Resource": "arn:aws:logs:*:*:log-group:*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/DevOps-Guru-Analysis": "true"
}
}
},
{
"Sid": "AllowAPIGatewayGetIntegrations",
"Effect": "Allow",
"Action": "apigateway:GET",
"Resource": [
"arn:aws:apigateway:*::/restapis/??????????",
"arn:aws:apigateway:*::/restapis/*/resources",
"arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integration"
]
}
]
}
```
------
## 为 Guru 创建服务相关角色 DevOps
您无需手动创建服务关联角色。当你在 AWS 管理控制台、或 AWS API 中创建见解时 AWS CLI， DevOpsGuru 会为你创建服务相关角色。
**重要**
如果您在使用该角色支持的功能的其他服务中完成了操作，则该服务相关角色可能会出现在您的账户中；例如，如果您将 DevOps Guru 添加到存储库中，则该角色可能会出现在您的账户中。 AWS CodeCommit
## 编辑 Guru 的服务相关角色 DevOps
DevOpsGuru 不允许您编辑`AWSServiceRoleForDevOpsGuru`服务相关角色。创建服务关联角色后，您将无法更改角色的名称，因为可能有多种实体引用该角色。但是可以使用 IAM 编辑角色描述。有关更多信息，请参阅《IAM 用户指南》**中的[编辑服务关联角色](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role)。
## 删除 Guru 的服务相关角色 DevOps
如果不再需要使用某个需要服务关联角色的功能或服务，我们建议您删除该角色。这样就没有未被主动监控或维护的未使用实体。但是，您必须先取消与所有存储库的关联，然后才能手动删除。
**注意**
如果您尝试删除资源时 DevOps Guru 服务正在使用该角色，则删除可能会失败。如果发生这种情况，请等待几分钟后重试。
**使用 IAM 手动删除服务关联角色**
使用 IAM 控制台 AWS CLI、或 AWS API 删除`AWSServiceRoleForDevOpsGuru`服务相关角色。有关更多信息，请参见《IAM 用户指南》**中的[删除服务相关角色](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role)。