View a markdown version of this page

在 中設定事件警示的許可AWS IoT SiteWise - AWS IoT SiteWise
必要的動作許可（選用） ListInputRoutings 許可SiteWise Monitor 的必要許可

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

在 中設定事件警示的許可AWS IoT SiteWise

當您使用AWS IoT Events警示模型來監控AWS IoT SiteWise資產屬性時，您必須擁有下列 IAM 許可：

  • 允許 將資料AWS IoT Events傳送至其中AWS IoT Events的服務角色AWS IoT SiteWise。如需詳細資訊，請參閱《 AWS IoT Events開發人員指南》中的 的 Identity and Access ManagementAWS IoT Events。

  • 您必須具有下列AWS IoT SiteWise動作許可： iotsitewise:DescribeAssetModel和 iotsitewise:UpdateAssetModelPropertyRouting。這些許可允許 AWS IoT SiteWise將資產屬性值傳送至AWS IoT Events警示模型。

如需詳細資訊，請參閱《IAM 使用者指南》中的資源型政策。

必要的動作許可

管理員可以使用 AWSJSON 政策來指定可存取內容的人員。也就是說，哪個主體在什麼條件下可以對什麼資源執行哪些動作。JSON 政策的 Action 元素描述您可以用來允許或拒絕政策中存取的動作。

定義AWS IoT Events警示模型之前，您必須授予下列許可，AWS IoT SiteWise允許 將資產屬性值傳送至警示模型。

  • iotsitewise:DescribeAssetModel、 iotsitewise:ListAssetModels – 允許 AWS IoT Events檢查資產屬性是否存在。

  • iotsitewise:UpdateAssetModelPropertyRouting – 允許 AWS IoT SiteWise自動建立訂閱，讓 AWS IoT SiteWise將資料傳送到其中AWS IoT Events。

如需AWS IoT SiteWise支援動作的詳細資訊，請參閱《服務授權參考》中的 定義的動作AWS IoT SiteWise。

範例範例許可政策 1

下列政策允許 AWS IoT SiteWise將資產屬性值傳送至任何AWS IoT Events警示模型。

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:CreateAlarmModel",
                "iotevents:UpdateAlarmModel"
            ],
            "Resource": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:DescribeAssetModel",
                "iotsitewise:ListAssetModels",
                "iotsitewise:UpdateAssetModelPropertyRouting"
            ],
            "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*"
        }
    ]
}
範例範例許可政策 2

下列政策允許 AWS IoT SiteWise將指定資產屬性的值傳送至指定的AWS IoT Events警示模型。

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:CreateAlarmModel",
                "iotevents:UpdateAlarmModel"
            ],
            "Resource": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:DescribeAssetModel",
                "iotsitewise:ListAssetModels"
            ],
            "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:UpdateAssetModelPropertyRouting"
            ],
            "Resource": [
                "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/12345678-90ab-cdef-1234-567890abcdef"
            ],
            "Condition": {
                "StringLike": {
                    "iotsitewise:propertyId": "abcdef12-3456-7890-abcd-ef1234567890",
                    "aws:ResourceTag/AlarmModel": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/MyAlarmModel"
                }
            }
        }
    ]
}

（選用） ListInputRoutings 許可

當您更新或刪除資產模型時， AWS IoT SiteWise可以檢查 中的AWS IoT Events警示模型是否正在監控與此資產模型相關聯的資產屬性。這可防止您刪除AWS IoT Events警示目前正在使用的資產屬性。若要在 中啟用此功能AWS IoT SiteWise，您必須擁有 iotevents:ListInputRoutings許可。此許可允許 AWS IoT SiteWise呼叫 支援的 ListInputRoutings API 操作AWS IoT Events。

注意

我們強烈建議您新增 ListInputRoutings許可。

範例許可政策範例

下列政策可讓您更新和刪除資產模型，並在其中使用 ListInputRoutings APIAWS IoT SiteWise。

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:UpdateAssetModel",
                "iotsitewise:DeleteAssetModel",
                "iotevents:ListInputRoutings"
            ],
            "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*"
        }
    ]
}

SiteWise Monitor 的必要許可

如果您想要在 SiteWise Monitor 入口網站中使用警示功能，您必須使用下列政策更新 SiteWise Monitor 服務角色：

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iotsitewise:DescribePortal",
                "iotsitewise:CreateProject",
                "iotsitewise:DescribeProject",
                "iotsitewise:UpdateProject",
                "iotsitewise:DeleteProject",
                "iotsitewise:ListProjects",
                "iotsitewise:BatchAssociateProjectAssets",
                "iotsitewise:BatchDisassociateProjectAssets",
                "iotsitewise:ListProjectAssets",
                "iotsitewise:CreateDashboard",
                "iotsitewise:DescribeDashboard",
                "iotsitewise:UpdateDashboard",
                "iotsitewise:DeleteDashboard",
                "iotsitewise:ListDashboards",
                "iotsitewise:CreateAccessPolicy",
                "iotsitewise:DescribeAccessPolicy",
                "iotsitewise:UpdateAccessPolicy",
                "iotsitewise:DeleteAccessPolicy",
                "iotsitewise:ListAccessPolicies",
                "iotsitewise:DescribeAsset",
                "iotsitewise:ListAssets",
                "iotsitewise:ListAssociatedAssets",
                "iotsitewise:DescribeAssetProperty",
                "iotsitewise:GetAssetPropertyValue",
                "iotsitewise:GetAssetPropertyValueHistory",
                "iotsitewise:GetAssetPropertyAggregates",
                "iotsitewise:BatchPutAssetPropertyValue",
                "iotsitewise:ListAssetRelationships",
                "iotsitewise:DescribeAssetModel",
                "iotsitewise:ListAssetModels",
                "iotsitewise:UpdateAssetModel",
                "iotsitewise:UpdateAssetModelPropertyRouting",
                "sso-directory:DescribeUsers",
                "sso-directory:DescribeUser",
                "iotevents:DescribeAlarmModel",
                "iotevents:ListTagsForResource"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:BatchAcknowledgeAlarm",
                "iotevents:BatchSnoozeAlarm",
                "iotevents:BatchEnableAlarm",
                "iotevents:BatchDisableAlarm"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "iotevents:keyValue": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:CreateAlarmModel",
                "iotevents:TagResource"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:RequestTag/iotsitewisemonitor": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iotevents:UpdateAlarmModel",
                "iotevents:DeleteAlarmModel"
            ],
            "Resource": "*",
            "Condition": {
                "Null": {
                    "aws:ResourceTag/iotsitewisemonitor": "false"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "iotevents.amazonaws.com"
                    ]
                }
            }
        }
    ]
}