本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
AWS 的托管策略 AWS IoT SiteWise
使用 AWS 托管策略简化向用户、群组和角色添加权限的过程，而不是自己编写策略。创建为团队提供确切权限的 IAM 客户管理型策略需要时间和专业知识。为了更快地进行设置，可以考虑将我们的 AWS 托管策略用于常见用例。在您的 AWS 账户中查找 AWS 托管政策。有关 AWS
托管式策略的更多信息，请参阅《IAM 用户指南》中的 AWS 托管式策略。
AWS 服务负责更新和维护 AWS 托管策略，这意味着您无法修改这些策略的权限。有时， AWS IoT SiteWise 可能会添加权限以适应新功能，从而影响附加策略的所有身份。新服务或特征的推出往往伴随着此类更新。但是，权限永远不会被移除，这就可以确保您的设置保持不变。
此外，还 AWS 支持跨多个服务的工作职能的托管策略。例如，ReadOnlyAccess AWS 托管策略提供对所有 AWS 服务和资源的只读访问权限。当服务启动一项新功能时， AWS 会为新操作和资源添加只读权限。有关工作职能策略的列表和说明，请参阅 IAM 用户指南中的适用于工作职能的AWS 托管策略。
AWS 托管策略： AWSIoTSiteWiseReadOnlyAccess
使用AWSIoTSiteWiseReadOnlyAccess AWS 托管策略允许只读访问权限 AWS IoT SiteWise。
您可以将 AWSIoTSiteWiseReadOnlyAccess 策略附加到 IAM 身份。
服务级别权限
此策略提供对的只读访问权限 AWS IoT SiteWise。此策略中不包含其他服务权限。
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iotsitewise:Describe*",
"iotsitewise:List*",
"iotsitewise:BatchGet*",
"iotsitewise:Get*"
],
"Resource": "*"
}
]
}
AWS 托管策略： AWSServiceRoleForIoTSiteWise
AWSServiceRoleForIoTSiteWise 角色获得下列权限使用 AWSServiceRoleForIoTSiteWise 策略。本策略：
-
AWS IoT SiteWise 允许部署 SiteWise Edge 网关（在上运行AWS IoT Greengrass）。
-
AWS IoT SiteWise 允许执行日志记录。
-
AWS IoT SiteWise 允许对 AWS IoT TwinMaker 数据库运行元数据搜索查询。
如果您 AWS IoT SiteWise 使用的是单个用户账户，则该AWSServiceRoleForIoTSiteWise角色将在您的 IAM 账户中创建AWSServiceRoleForIoTSiteWise策略，并将其附加到的AWSServiceRoleForIoTSiteWise服务相关角色。 AWS IoT SiteWise
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSiteWiseReadGreenGrass",
"Effect": "Allow",
"Action": [
"greengrass:GetAssociatedRole",
"greengrass:GetCoreDefinition",
"greengrass:GetCoreDefinitionVersion",
"greengrass:GetGroup",
"greengrass:GetGroupVersion"
],
"Resource": "*"
},
{
"Sid": "AllowSiteWiseAccessLogGroup",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:DescribeLogGroups"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*"
},
{
"Sid": "AllowSiteWiseAccessLog",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:DescribeLogStreams",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*"
},
{
"Sid": "AllowSiteWiseAccessSiteWiseManagedWorkspaceInTwinMaker",
"Effect": "Allow",
"Action": [
"iottwinmaker:GetWorkspace",
"iottwinmaker:ExecuteQuery"
],
"Resource": "arn:aws:iottwinmaker:*:*:workspace/*",
"Condition": {
"ForAnyValue:StringEquals": {
"iottwinmaker:linkedServices": [
"IOTSITEWISE"
]
}
}
}
]
}
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSiteWiseReadGreenGrass",
"Effect": "Allow",
"Action": [
"greengrass:GetAssociatedRole",
"greengrass:GetCoreDefinition",
"greengrass:GetCoreDefinitionVersion",
"greengrass:GetGroup",
"greengrass:GetGroupVersion"
],
"Resource": "*"
},
{
"Sid": "AllowSiteWiseAccessLogGroup",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:DescribeLogGroups"
],
"Resource": "arn:aws-us-gov:logs:*:*:log-group:/aws/iotsitewise*"
},
{
"Sid": "AllowSiteWiseAccessLog",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:DescribeLogStreams",
"logs:PutLogEvents"
],
"Resource": "arn:aws-us-gov:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*"
},
{
"Sid": "AllowSiteWiseAccessSiteWiseManagedWorkspaceInTwinMaker",
"Effect": "Allow",
"Action": [
"iottwinmaker:GetWorkspace",
"iottwinmaker:ExecuteQuery"
],
"Resource": "arn:aws-us-gov:iottwinmaker:*:*:workspace/*",
"Condition": {
"ForAnyValue:StringEquals": {
"iottwinmaker:linkedServices": [
"IOTSITEWISE"
]
}
}
}
]
}
- JSON
-
-
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSiteWiseReadGreenGrass",
"Effect": "Allow",
"Action": [
"greengrass:GetAssociatedRole",
"greengrass:GetCoreDefinition",
"greengrass:GetCoreDefinitionVersion",
"greengrass:GetGroup",
"greengrass:GetGroupVersion"
],
"Resource": "*"
},
{
"Sid": "AllowSiteWiseAccessLogGroup",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:DescribeLogGroups"
],
"Resource": "arn:aws-cn:logs:*:*:log-group:/aws/iotsitewise*"
},
{
"Sid": "AllowSiteWiseAccessLog",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:DescribeLogStreams",
"logs:PutLogEvents"
],
"Resource": "arn:aws-cn:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*"
},
{
"Sid": "AllowSiteWiseAccessSiteWiseManagedWorkspaceInTwinMaker",
"Effect": "Allow",
"Action": [
"iottwinmaker:GetWorkspace",
"iottwinmaker:ExecuteQuery"
],
"Resource": "arn:aws-cn:iottwinmaker:*:*:workspace/*",
"Condition": {
"ForAnyValue:StringEquals": {
"iottwinmaker:linkedServices": [
"IOTSITEWISE"
]
}
}
}
]
}
AWS IoT SiteWiseAWS 托管策略的更新
您可以查看有关 AWS 托管策略更新的详细信息 AWS IoT SiteWise，从该服务开始跟踪更改时开始。要获得有关此页面变更的自动提醒，请订阅 “ AWS IoT SiteWise 文档历史记录” 页面上的 RSS feed。
