使用 CloudWatch RUM 的 IAM 政策

若要建立可以建立新 Amazon Cognito 身分集區以供授權使用的應用程式監控，您必須擁有管理員 IAM 角色或 AdministratorAccess IAM 政策。

若要建立將資料傳送至 CloudWatch Logs 的應用程式監控，您必須登入具備下列許可的 IAM 角色或政策：

{
    "Effect": "Allow",
    "Action": [
        "logs:PutResourcePolicy"
    ],
    "Resource": [
        "*"
    ]
}

若要在應用程式監視器中啟用 JavaScript 來源映射，您需要將來源映射檔案上傳至 Amazon S3 儲存貯體。您的 IAM 角色或政策需要特定的 Amazon S3 許可，以允許建立 Amazon S3 儲存貯體、設定儲存貯體政策和管理儲存貯體中的檔案。為了安全起見，請將這些許可範圍限定為特定資源。以下範例政策會限制對名稱rum中包含 的儲存貯體的存取，並使用 aws:ResourceAccount條件金鑰來限制只有委託人帳戶的許可。

{
    "Sid": "AllowS3BucketCreationAndListing",
    "Effect": "Allow",
    "Action": [
        "s3:CreateBucket",
        "s3:ListAllMyBuckets"
    ],
    "Resource": "arn:aws:s3:::*",
    "Condition": {
        "StringEquals": {
            "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
    }
},
{
    "Sid": "AllowS3BucketActions",
    "Effect": "Allow",
    "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket"
    ],
    "Resource": "arn:aws:s3:::*rum*",
    "Condition": {
        "StringEquals": {
            "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
    }
},
{
    "Sid": "AllowS3BucketPolicyActions",
    "Effect": "Allow",
    "Action": [
        "s3:PutBucketPolicy",
        "s3:GetBucketPolicy"
    ],
    "Resource": "arn:aws:s3:::*rum*",
    "Condition": {
        "StringEquals": {
            "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
    }
},
{
    "Sid": "AllowS3ObjectActions",
    "Effect": "Allow",
    "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload"
    ],
    "Resource": "arn:aws:s3:::*rum*",
    "Condition": {
        "StringEquals": {
            "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
    }
}

若要在來源映射儲存貯體上使用您自己的 AWS KMS 金鑰進行伺服器端加密，IAM 角色或政策將需要特定 AWS KMS 許可，以允許建立金鑰、更新金鑰政策、搭配 Amazon S3 使用 AWS KMS 金鑰，以及設定 Amazon S3 儲存貯體的加密組態。為了安全起見，請將這些許可範圍限定為特定用途。以下範例限制存取特定區域和 accountId 的金鑰，並且具有與上述範例類似的 S3 限制。

{
    "Sid": "AllowKMSKeyCreation",
    "Effect": "Allow",
    "Action": [
        "kms:CreateKey",
        "kms:CreateAlias"
    ],
    "Resource": "*"
},
{
    "Sid": "KMSReadPermissions",
    "Effect": "Allow",
    "Action": [
        "kms:ListAliases"
    ],
    "Resource": "*"
},
{
    "Sid": "AllowUpdatingKeyPolicy",
    "Effect": "Allow",
    "Action": [
        "kms:PutKeyPolicy",
        "kms:GetKeyPolicy",
        "kms:ListKeyPolicies"
    ],
    "Resource": "arn:aws:kms:REGION:ACCOUNT_ID:key/*"
},
{
    "Sid": "AllowUseOfKMSKeyForS3",
    "Effect": "Allow",
    "Action": [
        "kms:DescribeKey",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey"
    ],
    "Resource": "arn:aws:kms:REGION:ACCOUNT_ID:key/*"
},
{
    "Sid": "AllowS3EncryptionConfiguration",
    "Effect": "Allow",
    "Action": [
        "s3:PutEncryptionConfiguration",
        "s3:GetEncryptionConfiguration"
    ],
    "Resource": "arn:aws:s3:::*rum*",
    "Condition": {
        "StringEquals": {
            "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
    }
}