# 权限
<a name="device-defender-detect-permissions"></a>

本部分包含有关如何设置管理 AWS IoT Device Defender Detect 所需的 IAM 角色和策略的信息。有关更多信息，请参阅 [IAM 用户指南](https://docs.aws.amazon.com/IAM/latest/UserGuide/)。

## 授予 AWS IoT Device Defender Detect 向 SNS 主题发布告警的权限
<a name="device-defender-detect-permissions-publish"></a>

如果在 [CreateSecurityProfile](https://docs.aws.amazon.com/iot/latest/apireference/API_CreateSecurityProfile.html) 中使用 `alertTargets` 参数，则必须为 IAM 角色指定两个策略：一个权限策略和一个信任策略。权限策略授予 AWS IoT Device Defender 向 SNS 主题发布通知的权限。信任策略授予 AWS IoT Device Defender 代入所需角色的权限。

### 权限策略
<a name="detect-account-sns-permissions-policy"></a>

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": [
                "arn:aws:sns:us-east-1:123456789012:your-topic-name"
            ]
        }
    ]
}
```

------

### 信任策略
<a name="detect-account-sns-trust-policy"></a>

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "iot.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

------

### 传递角色策略
<a name="detect-account-passrole-policy"></a>

您还需要附加至 IAM 用户的 IAM 权限策略，允许该用户传递角色。请参阅[向用户授予权限以将角色传递给 AWS 服务](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html)

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::123456789012:role/Role_To_Pass"
        }
    ]
}
```

------