AWS 下一代弹性中心的托管策略

AWS 托管策略是由创建和管理的独立策略 AWS。 AWS 托管策略旨在为许多常见用例提供权限，以便您可以开始为用户、组和角色分配权限。

请记住， AWS 托管策略可能不会为您的特定用例授予最低权限权限，因为它们可供所有 AWS 客户使用。建议通过定义特定于您的使用场景的 客户托管式策略来进一步减少权限。

您无法更改 AWS 托管策略中定义的权限。如果 AWS 更新 AWS 托管策略中定义的权限，则更新会影响该策略所关联的所有委托人身份（用户、组和角色）。 AWS 当新服务启动或现有 AWS 服务有新的 API 操作可用时，最有可能更新 AWS 托管策略。

AWSResilienceHubV2AssessmentExecutionPolicy

您可以将 AWSResilienceHubV2AssessmentExecutionPolicy 附加得到 IAM 身份。在运行评估时，此策略向其他 AWS 服务授予只读访问权限，以进行弹性发现、评估和管理。

权限详细信息

此策略授予可能在输出中包含敏感信息的通配符只读权限。

该策略包含以下权限：

以下 IAM 策略为下一代 Resilience Hub 提供了在运行评估时访问其他 AWS 服务所需的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSResilienceHubV2ReadResourceConfigStatement",
            "Effect": "Allow",
            "Action": [
                "acm:DescribeCertificate",
                "acm:GetCertificate",
                "acm:ListCertificates",
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingPolicies",
                "arc-region-switch:GetRegionSwitchStatus",
                "arc-region-switch:ListRegionSwitchAZSummaries",
                "arc-zonal-shift:GetManagedResource",
                "arc-zonal-shift:ListManagedResources",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "backup:DescribeBackupVault",
                "backup:GetBackupPlan",
                "backup:GetBackupSelection",
                "backup:ListBackupPlans",
                "backup:ListBackupSelections",
                "cloudformation:DescribeStacks",
                "cloudformation:GetTemplate",
                "cloudformation:ListStackResources",
                "cloudfront:GetDistribution",
                "cloudfront:ListDistributions",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData",
                "cloudwatch:ListMetrics",
                "config:DescribeConfigRules",
                "config:ListDiscoveredResources",
                "datasync:DescribeTask",
                "datasync:ListLocations",
                "datasync:ListTasks",
                "dlm:GetLifecyclePolicies",
                "dlm:GetLifecyclePolicy",
                "docdb-elastic:GetCluster",
                "docdb-elastic:ListClusters",
                "drs:DescribeJobs",
                "drs:DescribeSourceServers",
                "drs:GetReplicationConfiguration",
                "ds:DescribeDirectories",
                "dsql:GetCluster",
                "dsql:ListClusters",
                "dynamodb:DescribeContinuousBackups",
                "dynamodb:DescribeGlobalTable",
                "dynamodb:DescribeTable",
                "dynamodb:ListGlobalTables",
                "dynamodb:ListTagsOfResource",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeFastSnapshotRestores",
                "ec2:DescribeFleets",
                "ec2:DescribeInstances",
                "ec2:DescribeNatGateways",
                "ec2:DescribeRegions",
                "ec2:DescribeSnapshots",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcs",
                "ecr:DescribeRepositories",
                "ecs:DescribeCapacityProviders",
                "ecs:DescribeClusters",
                "ecs:DescribeContainerInstances",
                "ecs:DescribeServices",
                "ecs:DescribeTaskDefinition",
                "ecs:ListContainerInstances",
                "ecs:ListServices",
                "eks:DescribeCluster",
                "eks:DescribeFargateProfile",
                "eks:DescribeNodegroup",
                "eks:ListFargateProfiles",
                "eks:ListNodegroups",
                "elasticache:DescribeCacheClusters",
                "elasticache:DescribeGlobalReplicationGroups",
                "elasticache:DescribeReplicationGroups",
                "elasticache:DescribeSnapshots",
                "elasticfilesystem:DescribeFileSystems",
                "elasticfilesystem:DescribeMountTargets",
                "elasticfilesystem:DescribeReplicationConfigurations",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetHealth",
                "events:DescribeEventBus",
                "events:DescribeRule",
                "events:ListRules",
                "events:ListTargets",
                "firehose:DescribeDeliveryStream",
                "firehose:ListDeliveryStreams",
                "fis:GetExperiment",
                "fis:GetExperimentTemplate",
                "fis:ListExperimentTemplates",
                "fis:ListExperiments",
                "fsx:DescribeFileSystems",
                "globalaccelerator:DescribeAccelerator",
                "globalaccelerator:DescribeEndpointGroup",
                "globalaccelerator:DescribeListener",
                "globalaccelerator:ListAccelerators",
                "globalaccelerator:ListEndpointGroups",
                "globalaccelerator:ListListeners",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:ListAttachedRolePolicies",
                "kafka:DescribeCluster",
                "kafka:DescribeClusterV2",
                "kafka:GetBootstrapBrokers",
                "kafka:ListClusters",
                "kafka:ListClustersV2",
                "kafkaconnect:DescribeConnector",
                "kafkaconnect:ListConnectors",
                "kinesis:DescribeStream",
                "kinesis:ListStreams",
                "lambda:GetFunctionConcurrency",
                "lambda:GetFunctionConfiguration",
                "lambda:ListAliases",
                "lambda:ListEventSourceMappings",
                "lambda:ListFunctionEventInvokeConfigs",
                "lambda:ListVersionsByFunction",
                "memorydb:DescribeClusters",
                "memorydb:DescribeMultiRegionClusters",
                "network-firewall:DescribeFirewall",
                "network-firewall:DescribeFirewallPolicy",
                "network-firewall:ListFirewallPolicies",
                "network-firewall:ListFirewalls",
                "qldb:DescribeLedger",
                "qldb:ListLedgers",
                "ram:GetResourceShareAssociations",
                "ram:ListResources",
                "rds:DescribeDBClusterSnapshots",
                "rds:DescribeDBClusters",
                "rds:DescribeDBInstanceAutomatedBackups",
                "rds:DescribeDBInstances",
                "rds:DescribeDBProxies",
                "rds:DescribeDBSnapshots",
                "rds:DescribeGlobalClusters",
                "redshift:DescribeClusterSnapshots",
                "redshift:DescribeClusters",
                "resource-groups:GetGroup",
                "resource-groups:ListGroupResources",
                "route53:GetHealthCheck",
                "route53:GetHostedZone",
                "route53:ListHealthChecks",
                "route53:ListHostedZones",
                "route53:ListResourceRecordSets",
                "route53-recovery-control-config:ListClusters",
                "route53-recovery-control-config:ListControlPanels",
                "route53-recovery-control-config:ListRoutingControls",
                "route53-recovery-readiness:GetReadinessCheckStatus",
                "route53-recovery-readiness:GetResourceSet",
                "route53-recovery-readiness:ListReadinessChecks",
                "route53resolver:ListFirewallRuleGroupAssociations",
                "route53resolver:ListResolverEndpoints",
                "route53resolver:ListResolverRules",
                "s3:ListBucket",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecrets",
                "servicecatalog:GetApplication",
                "servicecatalog:ListAssociatedResources",
                "shield:DescribeProtection",
                "shield:ListProtections",
                "sns:GetTopicAttributes",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sqs:GetQueueAttributes",
                "sqs:ListQueues",
                "ssm:DescribeAutomationExecutions",
                "ssm:GetDocument",
                "ssm:GetParametersByPath",
                "ssm-incidents:GetResponsePlan",
                "ssm-incidents:ListReplicationSets",
                "ssm-incidents:ListResponsePlans",
                "states:DescribeStateMachine",
                "states:ListStateMachines",
                "tag:GetResources",
                "vpc-lattice:GetService",
                "vpc-lattice:GetServiceNetwork",
                "vpc-lattice:GetTargetGroup",
                "vpc-lattice:ListServices",
                "vpc-lattice:ListServiceNetworks",
                "vpc-lattice:ListTargetGroups",
                "wafv2:GetWebACL",
                "wafv2:ListWebACLs"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AWSResilienceHubApiGatewayStatement",
            "Effect": "Allow",
            "Action": [
                "apigateway:GET"
            ],
            "Resource": [
                "arn:aws:apigateway:*::/apis/*",
                "arn:aws:apigateway:*::/restapis/*",
                "arn:aws:apigateway:*::/usageplans",
                "arn:aws:apigateway:*::/domainnames/*"
            ]
        },
        {
            "Sid": "AWSResilienceHubS3AccessStatement",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetBucketLogging",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketTagging",
                "s3:GetBucketVersioning",
                "s3:GetMultiRegionAccessPointRoutes",
                "s3:GetReplicationConfiguration",
                "s3:ListAllMyBuckets",
                "s3:ListMultiRegionAccessPoints"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        }
    ]
}

AWSResilienceHubServiceRolePolicy

AWSResilienceHubServiceRolePolicy是服务相关角色 (SLR) 策略。您不能将此策略附加到您的 IAM 实体。当您启用 Organiations 对多账户弹性管理的支持时，下一代 Resilien AWS ce Hub 会自动创建此服务相关角色。此角色信任resiliencehub.amazonaws.com服务主体。

有关 Resilience Hub 的服务相关角色的 AWS 更多信息，请参阅为 Resilience Hub 使用服务相关角色 AWS 。

权限详细信息

通过此政策，下一代 Resilience Hub 可以访问只读的 AWS Organizations 信息，以进行多账户弹性管理。

该策略包含以下权限：

以下 IAM 策略为下一代 Resilience Hub 提供了访问 Organizati AWS ons 资源以进行多账户弹性管理所需的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSResilienceHubOrganizationsReadStatement",
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListChildren",
                "organizations:ListDelegatedAdministrators",
                "organizations:ListDelegatedServicesForAccount",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListParents",
                "organizations:ListRoots",
                "organizations:ListTagsForResource"
            ],
            "Resource": "*"
        }
    ]
}

下一代弹性中心更新为 AWS 托管策略

查看有关下一代 Resilience Hub AWS 托管策略更新的详细信息，因为该服务开始跟踪这些更改。要获取有关此页面变更的自动提醒，请在下一代 Resilience Hub 文档历史记录页面上订阅 RSS 提要。