本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。
设置自定义权限边界
从 2024.04 开始,您可以选择通过附加自定义权限边界来修改 RES 创建的角色。通过在 Boundary 参数中提供权限边界的 ARN,可以将自定义权限边界定义为 RES AWS CloudFormation 安装的一部分。 IAMPermission如果将此参数留空,则不会对任何 RES 角色设置权限边界。以下是 RES 角色操作所需的操作列表。确保您计划使用的任何权限边界都明确允许执行以下操作:
[ { "Effect": "Allow", "Resource": "*", "Sid": "ResRequiredActions", "Action": [ "access-analyzer:*", "account:GetAccountInformation", "account:ListRegions", "acm:*", "airflow:*", "amplify:*", "amplifybackend:*", "amplifyuibuilder:*", "aoss:*", "apigateway:*", "appflow:*", "application-autoscaling:*", "appmesh:*", "apprunner:*", "aps:*", "athena:*", "auditmanager:*", "autoscaling-plans:*", "autoscaling:*", "backup-gateway:*", "backup-storage:*", "backup:*", "batch:*", "bedrock:*", "budgets:*", "ce:*", "cloud9:*", "cloudformation:*", "cloudfront:*", "cloudtrail-data:*", "cloudtrail:*", "cloudwatch:*", "codeartifact:*", "codebuild:*", "codeguru-profiler:*", "codeguru-reviewer:*", "codepipeline:*", "codestar-connections:*", "codestar-notifications:*", "codestar:*", "cognito-identity:*", "cognito-idp:*", "cognito-sync:*", "comprehend:*", "compute-optimizer:*", "cur:*", "databrew:*", "datapipeline:*", "datasync:*", "dax:*", "detective:*", "devops-guru:*", "dlm:*", "dms:*", "drs:*", "dynamodb:*", "ebs:*", "ec2-instance-connect:*", "ec2:*", "ec2messages:*", "ecr:*", "ecs:*", "eks:*", "elastic-inference:*", "elasticache:*", "elasticbeanstalk:*", "elasticfilesystem:*", "elasticloadbalancing:*", "elasticmapreduce:*", "elastictranscoder:*", "es:*", "events:*", "firehose:*", "fis:*", "fms:*", "forecast:*", "fsx:*", "geo:*", "glacier:*", "glue:*", "grafana:*", "guardduty:*", "health:*", "iam:*", "identitystore:*", "imagebuilder:*", "inspector2:*", "inspector:*", "internetmonitor:*", "iot:*", "iotanalytics:*", "kafka:*", "kafkaconnect:*", "kinesis:*", "kinesisanalytics:*", "kms:*", "lambda:*", "lightsail:*", "logs:*", "memorydb:*", "mgh:*", "mobiletargeting:*", "mq:*", "neptune-db:*", "organizations:DescribeOrganization", "osis:*", "personalize:*", "pi:*", "pipes:*", "polly:*", "qldb:*", "quicksight:*", "rds-data:*", "rds:*", "redshift-data:*", "redshift-serverless:*", "redshift:*", "rekognition:*", "resiliencehub:*", "resource-groups:*", "route53:*", "route53domains:*", "route53resolver:*", "rum:*", "s3:*", "sagemaker:*", "scheduler:*", "schemas:*", "sdb:*", "secretsmanager:*", "securityhub:*", "serverlessrepo:*", "servicecatalog:*", "servicequotas:*", "ses:*", "signer:*", "sns:*", "sqs:*", "ssm:*", "ssmmessages:*", "states:*", "storagegateway:*", "sts:*", "support:*", "tag:GetResources", "tag:GetTagKeys", "tag:GetTagValues", "textract:*", "timestream:*", "transcribe:*", "transfer:*", "translate:*", "vpc-lattice:*", "waf-regional:*", "waf:*", "wafv2:*", "wellarchitected:*", "wisdom:*", "xray:*" ] } ]