本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# AWS IoT 如何使用 IAM
<a name="security_iam_service-with-iam"></a>

在您使用 IAM 管理對 的存取之前 AWS IoT，您應該了解哪些 IAM 功能可與 搭配使用 AWS IoT。若要全面了解 AWS IoT 和其他 AWS 服務如何與 IAM 搭配使用，請參閱《[AWS IAM 使用者指南》中的與 IAM 搭配使用的 服務](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_aws-services-that-work-with-iam.html)。 **

**Topics**
+ [AWS IoT 身分型政策](#security_iam_service-with-iam-id-based-policies)
+ [AWS IoT 資源型政策](#security_iam_service-with-iam-resource-based-policies)
+ [以 AWS IoT 標籤為基礎的授權](#security_iam_service-with-iam-tags)
+ [AWS IoT IAM 角色](#security_iam_service-with-iam-roles)

## AWS IoT 身分型政策
<a name="security_iam_service-with-iam-id-based-policies"></a>

使用 IAM 身分類型政策，您可以指定允許或拒絕的動作和資源，以及在何種條件下會允許或拒絕動作。 AWS IoT 支援特定動作、資源及條件索引鍵。若要了解您在 JSON 政策中使用的所有元素，請參閱《*IAM 使用者指南*》中的 [JSON 政策元素參考](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_elements.html)。

### 動作
<a name="security_iam_service-with-iam-id-based-policies-actions"></a>

管理員可以使用 AWS JSON 政策來指定誰可以存取內容。也就是說，哪個**主體**在什麼**條件**下可以對什麼**資源**執行哪些**動作**。

JSON 政策的 `Action` 元素描述您可以用來允許或拒絕政策中存取的動作。政策會使用動作來授予執行相關聯動作的許可。

下表列出 IAM IoT 動作、相關聯的 AWS IoT API，以及動作操作的資源。


****  

| 政策動作 | AWS IoT API | Resources | 
| --- | --- | --- | 
| iot:AcceptCertificateTransfer | AcceptCertificateTransfer |  `arn:aws:iot:region:account-id:cert/cert-id`  ARN 中 AWS 帳戶 指定的 必須是憑證要傳輸到的帳戶。   | 
| iot:AddThingToThingGroup | AddThingToThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:AssociateTargetsWithJob | AssociateTargetsWithJob | 無  | 
| iot:AttachPolicy | AttachPolicy |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 或 `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:AttachPrincipalPolicy | AttachPrincipalPolicy |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:AttachSecurityProfile | AttachSecurityProfile |  `arn:aws:iot:region:account-id:securityprofile/security-profile-name` `arn:aws:iot:region:account-id:dimension/dimension-name`  | 
| iot:AttachThingPrincipal | AttachThingPrincipal |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:CancelCertificateTransfer | CancelCertificateTransfer |  `arn:aws:iot:region:account-id:cert/cert-id`  ARN 中 AWS 帳戶 指定的 必須是憑證要傳輸到的帳戶。   | 
| iot:CancelJob | CancelJob |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:CancelJobExecution | CancelJobExecution |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ClearDefaultAuthorizer | ClearDefaultAuthorizer | 無 | 
| iot:CreateAuthorizer | CreateAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-function-name`  | 
| iot:CreateCertificateFromCsr | CreateCertificateFromCsr | \$1 | 
| iot:CreateDimension | CreateDimension | `arn:aws:iot:region:account-id:dimension/dimension-name` | 
| iot:CreateJob | CreateJob |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:thinggroup/thing-group-name` `arn:aws:iot:region:account-id:thing/thing-name` `arn:aws:iot:region:account-id:jobtemplate/job-template-id`  | 
| iot:CreateJobTemplate | CreateJobTemplate |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:jobtemplate/job-template-id`  | 
| iot:CreateKeysAndCertificate | CreateKeysAndCertificate | \$1 | 
| iot:CreatePolicy | CreatePolicy | `arn:aws:iot:region:account-id:policy/policy-name` | 
| iot:CreatePolicyVersion | CreatePolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  這必須是 AWS IoT 政策，而非 IAM 政策。   | 
| iot:CreateRoleAlias | CreateRoleAlias |  (參數：roleAlias) `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:CreateSecurityProfile | CreateSecurityProfile |  `arn:aws:iot:region:account-id:securityprofile/security-profile-name` `arn:aws:iot:region:account-id:dimension/dimension-name`  | 
| iot:CreateThing | CreateThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:CreateThingGroup | CreateThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 適用正在建立的群組和父群組 (若使用)  | 
| iot:CreateThingType | CreateThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:CreateTopicRule | CreateTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:DeleteAuthorizer | DeleteAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-name`  | 
| iot:DeleteCACertificate | DeleteCACertificate |  `arn:aws:iot:region:account-id:cacert/cert-id`  | 
| iot:DeleteCertificate | DeleteCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DeleteDimension | DeleteDimension |  `arn:aws:iot:region:account-id:dimension/dimension-name`  | 
| iot:DeleteJob | DeleteJob |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:DeleteJobTemplate | DeleteJobTemplate |  `arn:aws:iot:region:account-id:job/job-template-id`  | 
| iot:DeleteJobExecution | DeleteJobExecution |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:DeletePolicy | DeletePolicy |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:DeletePolicyVersion | DeletePolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:DeleteRegistrationCode | DeleteRegistrationCode | \$1 | 
| iot:DeleteRoleAlias | DeleteRoleAlias |  `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:DeleteSecurityProfile | DeleteSecurityProfile |  `arn:aws:iot:region:account-id:securityprofile/security-profile-name` `arn:aws:iot:region:account-id:dimension/dimension-name`  | 
| iot:DeleteThing | DeleteThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:DeleteThingGroup | DeleteThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DeleteThingType | DeleteThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:DeleteTopicRule | DeleteTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:DeleteV2LoggingLevel | DeleteV2LoggingLevel |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DeprecateThingType | DeprecateThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:DescribeAuthorizer | DescribeAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-function-name` (參數：authorizerName) 無  | 
| iot:DescribeCACertificate | DescribeCACertificate |  `arn:aws:iot:region:account-id:cacert/cert-id`  | 
| iot:DescribeCertificate | DescribeCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DescribeDefaultAuthorizer | DescribeDefaultAuthorizer | 無  | 
| iot:DescribeEndpoint | DescribeEndpoint | \$1 | 
| iot:DescribeEventConfigurations | DescribeEventConfigurations | 無  | 
| iot:DescribeIndex | DescribeIndex |  `arn:aws:iot:region:account-id:index/index-name`  | 
| iot:DescribeJob | DescribeJob |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:DescribeJobExecution | DescribeJobExecution | 無 | 
| iot:DescribeJobTemplate | DescribeJobTemplate |  `arn:aws:iot:region:account-id:job/job-template-id`  | 
| iot:DescribeRoleAlias | DescribeRoleAlias |  `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:DescribeThing | DescribeThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:DescribeThingGroup | DescribeThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DescribeThingRegistrationTask | DescribeThingRegistrationTask | 無 | 
| iot:DescribeThingType | DescribeThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:DetachPolicy | DetachPolicy |  `arn:aws:iot:region:account-id:cert/cert-id` 或 `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DetachPrincipalPolicy | DetachPrincipalPolicy |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DetachSecurityProfile | DetachSecurityProfile |  `arn:aws:iot:region:account-id:securityprofile/security-profile-name` `arn:aws:iot:region:account-id:dimension/dimension-name`  | 
| iot:DetachThingPrincipal | DetachThingPrincipal |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DisableTopicRule | DisableTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:EnableTopicRule | EnableTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:GetEffectivePolicies | GetEffectivePolicies |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:GetIndexingConfiguration | GetIndexingConfiguration | 無 | 
| iot:GetJobDocument | GetJobDocument |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:GetLoggingOptions | GetLoggingOptions | \$1 | 
| iot:GetPolicy | GetPolicy |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:GetPolicyVersion | GetPolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:GetRegistrationCode | GetRegistrationCode | \$1 | 
| iot:GetTopicRule | GetTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:ListAttachedPolicies | ListAttachedPolicies |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 或 `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:ListAuthorizers | ListAuthorizers | 無 | 
| iot:ListCACertificates | ListCACertificates | \$1 | 
| iot:ListCertificates | ListCertificates | \$1 | 
| iot:ListCertificatesByCA | ListCertificatesByCA | \$1 | 
| iot:ListIndices | ListIndices | 無 | 
| iot:ListJobExecutionsForJob | ListJobExecutionsForJob | 無 | 
| iot:ListJobExecutionsForThing | ListJobExecutionsForThing | 無 | 
| iot:ListJobs | ListJobs |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 若使用 thingGroupName 參數  | 
| iot:ListJobTemplates | ListJobs | 無 | 
| iot:ListOutgoingCertificates | ListOutgoingCertificates | \$1 | 
| iot:ListPolicies | ListPolicies | \$1 | 
| iot:ListPolicyPrincipals | ListPolicyPrincipals | \$1 | 
| iot:ListPolicyVersions | ListPolicyVersions |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:ListPrincipalPolicies | ListPrincipalPolicies |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:ListPrincipalThings | ListPrincipalThings |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:ListRoleAliases | ListRoleAliases | 無 | 
| iot:ListTargetsForPolicy | ListTargetsForPolicy |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:ListThingGroups | ListThingGroups | 無 | 
| iot:ListThingGroupsForThing | ListThingGroupsForThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ListThingPrincipals | ListThingPrincipals |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ListThingRegistrationTaskReports | ListThingRegistrationTaskReports | 無 | 
| iot:ListThingRegistrationTasks | ListThingRegistrationTasks | 無 | 
| iot:ListThingTypes | ListThingTypes | \$1 | 
| iot:ListThings | ListThings | \$1 | 
| iot:ListThingsInThingGroup | ListThingsInThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:ListTopicRules | ListTopicRules | \$1 | 
| iot:ListV2LoggingLevels | ListV2LoggingLevels | 無 | 
| iot:RegisterCACertificate | RegisterCACertificate | \$1 | 
| iot:RegisterCertificate | RegisterCertificate | \$1 | 
| iot:RegisterThing | RegisterThing | 無 | 
| iot:RejectCertificateTransfer | RejectCertificateTransfer |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:RemoveThingFromThingGroup | RemoveThingFromThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ReplaceTopicRule | ReplaceTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:SearchIndex | SearchIndex |  `arn:aws:iot:region:account-id:index/index-id`  | 
| iot:SetDefaultAuthorizer | SetDefaultAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-function-name`  | 
| iot:SetDefaultPolicyVersion | SetDefaultPolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:SetLoggingOptions | SetLoggingOptions |  `arn:aws:iot:region:account-id:role/role-name`  | 
| iot:SetV2LoggingLevel | SetV2LoggingLevel |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:SetV2LoggingOptions | SetV2LoggingOptions |  `arn:aws:iot:region:account-id:role/role-name`  | 
| iot:StartThingRegistrationTask | StartThingRegistrationTask | 無 | 
| iot:StopThingRegistrationTask | StopThingRegistrationTask | 無 | 
| iot:TestAuthorization | TestAuthorization |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:TestInvokeAuthorizer | TestInvokeAuthorizer | 無 | 
| iot:TransferCertificate | TransferCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:UpdateAuthorizer | UpdateAuthorizer |  `arn:aws:iot:region:account-id:authorizerfunction/authorizer-function-name`  | 
| iot:UpdateCACertificate | UpdateCACertificate |  `arn:aws:iot:region:account-id:cacert/cert-id`  | 
| iot:UpdateCertificate | UpdateCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:UpdateDimension | UpdateDimension |  `arn:aws:iot:region:account-id:dimension/dimension-name`  | 
| iot:UpdateEventConfigurations | UpdateEventConfigurations | 無 | 
| iot:UpdateIndexingConfiguration | UpdateIndexingConfiguration | 無 | 
| iot:UpdateRoleAlias | UpdateRoleAlias |  `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:UpdateSecurityProfile | UpdateSecurityProfile |  `arn:aws:iot:region:account-id:securityprofile/security-profile-name` `arn:aws:iot:region:account-id:dimension/dimension-name`  | 
| iot:UpdateThing | UpdateThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:UpdateThingGroup | UpdateThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:UpdateThingGroupsForThing | UpdateThingGroupsForThing |  `arn:aws:iot:region:account-id:thing/thing-name` `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 

中的政策動作在動作之前 AWS IoT 使用下列字首：`iot:`。例如，若要授予某人許可，以列出在 中 AWS 帳戶 向 `ListThings` API 註冊的所有 IoT 物件，請在其政策中包含 `iot:ListThings`動作。政策陳述式必須包含 `Action`或 `NotAction`元素。 AWS IoT 會定義自己的一組動作，描述您可以使用此服務執行的任務。

若要在單一陳述式中指定多個動作，請用逗號分隔，如下所示：

```
"Action": [
      "ec2:action1",
      "ec2:action2"
```

您也可以使用萬用字元 (\$1) 來指定多個動作。例如，若要指定開頭是 `Describe` 文字的所有動作，請包含以下動作：

```
"Action": "iot:Describe*"
```

若要查看 AWS IoT 動作清單，請參閱《*IAM 使用者指南*》中的 [定義的動作 AWS IoT](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)。

#### Device Advisor 動作
<a name="security_iam_service-actions-device-advisor"></a>

下表列出 IAM IoT Device Advisor 動作、相關的 AWS IoT Device Advisor API，以及動作所操控的資源。


****  

| 政策動作 | AWS IoT API | Resources | 
| --- | --- | --- | 
| iotdeviceadvisor:CreateSuiteDefinition | CreateSuiteDefinition |  無  | 
| iotdeviceadvisor:DeleteSuiteDefinition | DeleteSuiteDefinition |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id`  | 
| iotdeviceadvisor:GetSuiteDefinition | GetSuiteDefinition |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id`  | 
| iotdeviceadvisor:GetSuiteRun | GetSuiteRun |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-run-id`  | 
| iotdeviceadvisor:GetSuiteRunReport | GetSuiteRunReport |  `arn:aws:iotdeviceadvisor:region:account-id:suiterun/suite-definition-id/suite-run-id`  | 
| iotdeviceadvisor:ListSuiteDefinitions | ListSuiteDefinitions | 無 | 
| iotdeviceadvisor:ListSuiteRuns | ListSuiteRuns |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id`  | 
| iotdeviceadvisor:ListTagsForResource | ListTagsForResource |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id` `arn:aws:iotdeviceadvisor:region:account-id:suiterun/suite-definition-id/suite-run-id`  | 
| iotdeviceadvisor:StartSuiteRun | StartSuiteRun |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id`  | 
| iotdeviceadvisor:TagResource | TagResource |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id` `arn:aws:iotdeviceadvisor:region:account-id:suiterun/suite-definition-id/suite-run-id`  | 
| iotdeviceadvisor:UntagResource | UntagResource |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id` `arn:aws:iotdeviceadvisor:region:account-id:suiterun/suite-definition-id/suite-run-id`  | 
| iotdeviceadvisor:UpdateSuiteDefinition | UpdateSuiteDefinition |  `arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id`  | 
| iotdeviceadvisor:StopSuiteRun | StopSuiteRun |  `arn:aws:iotdeviceadvisor:region:account-id:suiterun/suite-definition-id/suite-run-id`  | 

 AWS IoT Device Advisor 中的政策動作在動作之前使用以下字首：`iotdeviceadvisor:`。例如，若要授予某人許可，以列出 AWS 帳戶 在其中使用 ListSuiteDefinitions API 註冊的所有套件定義，請在其政策中包含 `iotdeviceadvisor:ListSuiteDefinitions`動作。

### Resources
<a name="security_iam_service-with-iam-id-based-policies-resources"></a>

管理員可以使用 AWS JSON 政策來指定誰可以存取內容。也就是說，哪個**主體**在什麼**條件**下可以對什麼**資源**執行哪些**動作**。

`Resource` JSON 政策元素可指定要套用動作的物件。最佳實務是使用其 [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) 來指定資源。若動作不支援資源層級許可，使用萬用字元 (\$1) 表示該陳述式適用於所有資源。

```
"Resource": "*"
```


**AWS IoT 資源**  

| 政策動作 | AWS IoT API | Resources | 
| --- | --- | --- | 
| iot:AcceptCertificateTransfer | AcceptCertificateTransfer |  `arn:aws:iot:region:account-id:cert/cert-id`  ARN 中 AWS 帳戶 指定的 必須是憑證要傳輸到的帳戶。   | 
| iot:AddThingToThingGroup | AddThingToThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:AssociateTargetsWithJob | AssociateTargetsWithJob | 無  | 
| iot:AttachPolicy | AttachPolicy | `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 或 `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:AttachPrincipalPolicy | AttachPrincipalPolicy |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:AttachThingPrincipal | AttachThingPrincipal |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:CancelCertificateTransfer | CancelCertificateTransfer |  `arn:aws:iot:region:account-id:cert/cert-id`  ARN 中 AWS 帳戶 指定的 必須是憑證要傳輸到的帳戶。   | 
| iot:CancelJob | CancelJob |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:CancelJobExecution | CancelJobExecution |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ClearDefaultAuthorizer | ClearDefaultAuthorizer | 無 | 
| iot:CreateAuthorizer | CreateAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-function-name`  | 
| iot:CreateCertificateFromCsr | CreateCertificateFromCsr | \$1 | 
| iot:CreateJob | CreateJob |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:thinggroup/thing-group-name` `arn:aws:iot:region:account-id:thing/thing-name` `arn:aws:iot:region:account-id:jobtemplate/job-template-id`  | 
| iot:CreateJobTemplate | CreateJobTemplate |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:jobtemplate/job-template-id`  | 
| iot:CreateKeysAndCertificate | CreateKeysAndCertificate | \$1 | 
| iot:CreatePolicy | CreatePolicy | `arn:aws:iot:region:account-id:policy/policy-name` | 
| CreatePolicyVersion | iot:CreatePolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  這必須是 AWS IoT 政策，而非 IAM 政策。   | 
| iot:CreateRoleAlias | CreateRoleAlias |  (參數：roleAlias) `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:CreateThing | CreateThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:CreateThingGroup | CreateThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 適用正在建立的群組和父群組 (若使用)  | 
| iot:CreateThingType | CreateThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:CreateTopicRule | CreateTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:DeleteAuthorizer | DeleteAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-name`  | 
| iot:DeleteCACertificate | DeleteCACertificate |  `arn:aws:iot:region:account-id:cacert/cert-id`  | 
| iot:DeleteCertificate | DeleteCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DeleteJob | DeleteJob |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:DeleteJobExecution | DeleteJobExecution |  `arn:aws:iot:region:account-id:job/job-id` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:DeleteJobTemplate | DeleteJobTemplate |  `arn:aws:iot:region:account-id:jobtemplate/job-template-id`  | 
| iot:DeletePolicy | DeletePolicy |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:DeletePolicyVersion | DeletePolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:DeleteRegistrationCode | DeleteRegistrationCode | \$1 | 
| iot:DeleteRoleAlias | DeleteRoleAlias |  `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:DeleteThing | DeleteThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:DeleteThingGroup | DeleteThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DeleteThingType | DeleteThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:DeleteTopicRule | DeleteTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:DeleteV2LoggingLevel | DeleteV2LoggingLevel |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DeprecateThingType | DeprecateThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:DescribeAuthorizer | DescribeAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-function-name` (參數：authorizerName) 無  | 
| iot:DescribeCACertificate | DescribeCACertificate |  `arn:aws:iot:region:account-id:cacert/cert-id`  | 
| iot:DescribeCertificate | DescribeCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DescribeDefaultAuthorizer | DescribeDefaultAuthorizer | 無  | 
| iot:DescribeEndpoint | DescribeEndpoint | \$1 | 
| iot:DescribeEventConfigurations | DescribeEventConfigurations | 無  | 
| iot:DescribeIndex | DescribeIndex |  `arn:aws:iot:region:account-id:index/index-name`  | 
| iot:DescribeJob | DescribeJob |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:DescribeJobExecution | DescribeJobExecution | 無 | 
| iot:DescribeJobTemplate | DescribeJobTemplate |  `arn:aws:iot:region:account-id:jobtemplate/job-template-id`  | 
| iot:DescribeRoleAlias | DescribeRoleAlias |  `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:DescribeThing | DescribeThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:DescribeThingGroup | DescribeThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DescribeThingRegistrationTask | DescribeThingRegistrationTask | 無 | 
| iot:DescribeThingType | DescribeThingType |  `arn:aws:iot:region:account-id:thingtype/thing-type-name`  | 
| iot:DetachPolicy | DetachPolicy |  `arn:aws:iot:region:account-id:cert/cert-id` 或 `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:DetachPrincipalPolicy | DetachPrincipalPolicy |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DetachThingPrincipal | DetachThingPrincipal |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:DisableTopicRule | DisableTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:EnableTopicRule | EnableTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:GetEffectivePolicies | GetEffectivePolicies |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:GetIndexingConfiguration | GetIndexingConfiguration | 無 | 
| iot:GetJobDocument | GetJobDocument |  `arn:aws:iot:region:account-id:job/job-id`  | 
| iot:GetLoggingOptions | GetLoggingOptions | \$1 | 
| iot:GetPolicy | GetPolicy |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:GetPolicyVersion | GetPolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:GetRegistrationCode | GetRegistrationCode | \$1 | 
| iot:GetTopicRule | GetTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:ListAttachedPolicies | ListAttachedPolicies |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 或 `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:ListAuthorizers | ListAuthorizers | 無 | 
| iot:ListCACertificates | ListCACertificates | \$1 | 
| iot:ListCertificates | ListCertificates | \$1 | 
| iot:ListCertificatesByCA | ListCertificatesByCA | \$1 | 
| iot:ListIndices | ListIndices | 無 | 
| iot:ListJobExecutionsForJob | ListJobExecutionsForJob | 無 | 
| iot:ListJobExecutionsForThing | ListJobExecutionsForThing | 無 | 
| iot:ListJobs | ListJobs |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` 若使用 thingGroupName 參數  | 
| iot:ListJobTemplates | ListJobTemplates | 無 | 
| iot:ListOutgoingCertificates | ListOutgoingCertificates | \$1 | 
| iot:ListPolicies | ListPolicies | \$1 | 
| iot:ListPolicyPrincipals | ListPolicyPrincipals |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:ListPolicyVersions | ListPolicyVersions |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:ListPrincipalPolicies | ListPrincipalPolicies |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:ListPrincipalThings | ListPrincipalThings |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:ListRoleAliases | ListRoleAliases | 無 | 
| iot:ListTargetsForPolicy | ListTargetsForPolicy |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:ListThingGroups | ListThingGroups | 無 | 
| iot:ListThingGroupsForThing | ListThingGroupsForThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ListThingPrincipals | ListThingPrincipals |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ListThingRegistrationTaskReports | ListThingRegistrationTaskReports | 無 | 
| iot:ListThingRegistrationTasks | ListThingRegistrationTasks | 無 | 
| iot:ListThingTypes | ListThingTypes | \$1 | 
| iot:ListThings | ListThings | \$1 | 
| iot:ListThingsInThingGroup | ListThingsInThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:ListTopicRules | ListTopicRules | \$1 | 
| iot:ListV2LoggingLevels | ListV2LoggingLevels | 無 | 
| iot:RegisterCACertificate | RegisterCACertificate | \$1 | 
| iot:RegisterCertificate | RegisterCertificate | \$1 | 
| iot:RegisterThing | RegisterThing | 無 | 
| iot:RejectCertificateTransfer | RejectCertificateTransfer |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:RemoveThingFromThingGroup | RemoveThingFromThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name` `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:ReplaceTopicRule | ReplaceTopicRule |  `arn:aws:iot:region:account-id:rule/rule-name`  | 
| iot:SearchIndex | SearchIndex |  `arn:aws:iot:region:account-id:index/index-id`  | 
| iot:SetDefaultAuthorizer | SetDefaultAuthorizer |  `arn:aws:iot:region:account-id:authorizer/authorizer-function-name`  | 
| iot:SetDefaultPolicyVersion | SetDefaultPolicyVersion |  `arn:aws:iot:region:account-id:policy/policy-name`  | 
| iot:SetLoggingOptions | SetLoggingOptions | \$1 | 
| iot:SetV2LoggingLevel | SetV2LoggingLevel | \$1 | 
| iot:SetV2LoggingOptions | SetV2LoggingOptions | \$1 | 
| iot:StartThingRegistrationTask | StartThingRegistrationTask | 無 | 
| iot:StopThingRegistrationTask | StopThingRegistrationTask | 無 | 
| iot:TestAuthorization | TestAuthorization |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:TestInvokeAuthorizer | TestInvokeAuthorizer | 無 | 
| iot:TransferCertificate | TransferCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:UpdateAuthorizer | UpdateAuthorizer |  `arn:aws:iot:region:account-id:authorizerfunction/authorizer-function-name`  | 
| iot:UpdateCACertificate | UpdateCACertificate |  `arn:aws:iot:region:account-id:cacert/cert-id`  | 
| iot:UpdateCertificate | UpdateCertificate |  `arn:aws:iot:region:account-id:cert/cert-id`  | 
| iot:UpdateEventConfigurations | UpdateEventConfigurations | 無 | 
| iot:UpdateIndexingConfiguration | UpdateIndexingConfiguration | 無 | 
| iot:UpdateRoleAlias | UpdateRoleAlias |  `arn:aws:iot:region:account-id:rolealias/role-alias-name`  | 
| iot:UpdateThing | UpdateThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 
| iot:UpdateThingGroup | UpdateThingGroup |  `arn:aws:iot:region:account-id:thinggroup/thing-group-name`  | 
| iot:UpdateThingGroupsForThing | UpdateThingGroupsForThing |  `arn:aws:iot:region:account-id:thing/thing-name`  | 

如需 ARNs 格式的詳細資訊，請參閱 [Amazon Resource Name (ARNs AWS 和服務命名空間](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html)。

有些 AWS IoT 動作無法對特定資源執行，例如用於建立資源的動作。在這些情況下，您必須使用萬用字元 (\$1)。

```
"Resource": "*"
```

若要查看 AWS IoT 資源類型及其 ARNs的清單，請參閱《*IAM 使用者指南*》中的 [定義的資源 AWS IoT](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-resources-for-iam-policies)。若要了解您可以使用哪些動作指定每個資源的 ARN，請參閱 [AWS IoT定義的動作](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)。

#### Device Advisor 資源
<a name="security_iam_service-device-advisor-resources"></a>

若要定義 AWS IoT Device Advisor IAM 政策的資源層級限制，請針對套件定義和套件執行使用以下資源 ARN 格式。

套件定義資源 ARN 格式  
`arn:aws:iotdeviceadvisor:region:account-id:suitedefinition/suite-definition-id`

套件執行資源 ARN 格式  
`arn:aws:iotdeviceadvisor:region:account-id:suiterun/suite-definition-id/suite-run-id`

### 條件索引鍵
<a name="security_iam_service-with-iam-id-based-policies-conditionkeys"></a>

管理員可以使用 AWS JSON 政策來指定誰可以存取內容。也就是說，哪個**主體**在什麼**條件**下可以對什麼**資源**執行哪些**動作**。

`Condition` 元素會根據定義的條件，指定陳述式的執行時機。您可以建立使用[條件運算子](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html)的條件運算式 (例如等於或小於)，來比對政策中的條件和請求中的值。若要查看所有 AWS 全域條件索引鍵，請參閱《*IAM 使用者指南*》中的[AWS 全域條件內容索引鍵](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html)。

AWS IoT 會定義自己的一組條件金鑰，也支援使用一些全域條件金鑰。若要查看所有 AWS 全域條件金鑰，請參閱《*IAM 使用者指南*》中的[AWS 全域條件內容金鑰](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_condition-keys.html)。


**AWS IoT 條件索引鍵**  

| AWS IoT 條件索引鍵 | 描述 | Type | 
| --- | --- | --- | 
| aws:RequestTag/\$1\$1tag-key\$1 | 在使用者對 AWS IoT提出的請求中存在的標籤金鑰。 | String | 
| aws:ResourceTag/\$1\$1tag-key\$1 | 連接至 AWS IoT 資源之標籤的標籤索引鍵元件。 | String | 
| aws:TagKeys | 與請求中資源相關聯的所有標籤鍵名稱清單。 | String | 

若要查看 AWS IoT 條件金鑰清單，請參閱《*IAM 使用者指南*》中的 [的條件金鑰 AWS IoT](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-policy-keys)。若要了解您可以使用條件金鑰的動作和資源，請參閱 [定義的動作 AWS IoT](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions)。

### 範例
<a name="security_iam_service-with-iam-id-based-policies-examples"></a>



若要檢視 AWS IoT 身分型政策的範例，請參閱 [AWS IoT 身分型政策範例](security_iam_id-based-policy-examples.md)。

## AWS IoT 資源型政策
<a name="security_iam_service-with-iam-resource-based-policies"></a>

以資源為基礎的政策是 JSON 政策文件，指定指定委託人可以在 AWS IoT 資源上執行的動作，以及在哪些條件下執行的動作。

AWS IoT 不支援 IAM 資源型政策。不過，它支援以 AWS IoT 資源為基礎的政策。如需詳細資訊，請參閱[AWS IoT Core 政策](iot-policies.md)。

## 以 AWS IoT 標籤為基礎的授權
<a name="security_iam_service-with-iam-tags"></a>

您可以將標籤連接至 AWS IoT 資源，或將請求中的標籤傳遞至 AWS IoT。如需根據標籤控制存取，請使用 `iot:ResourceTag/key-name`、`aws:RequestTag/key-name` 或 `aws:TagKeys` 條件索引鍵，在政策的[條件元素](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_elements_condition.html)中，提供標籤資訊。如需詳細資訊，請參閱[搭配 IAM 政策使用標籤](tagging-iot-iam.md)。如需標記 AWS IoT 資源的詳細資訊，請參閱 [標記您的 AWS IoT 資源](tagging-iot.md)。

若要檢視身分型原則範例，以根據該資源上的標籤來限制存取資源，請參閱[根據標籤檢視 AWS IoT 資源](security_iam_id-based-policy-examples.md#security_iam_id-based-policy-examples-view-thing-tags)。

## AWS IoT IAM 角色
<a name="security_iam_service-with-iam-roles"></a>

[IAM 角色](https://docs.aws.amazon.com/service-authorization/latest/reference/id_roles.html)是 中具有特定許可 AWS 帳戶 的實體。

### 搭配 使用臨時登入資料 AWS IoT
<a name="security_iam_service-with-iam-roles-tempcreds"></a>

您可以搭配聯合使用暫時憑證、擔任 IAM 角色，或是擔任跨帳戶角色。您可以透過呼叫 [AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) 或 [GetFederationToken](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetFederationToken.html) 等 AWS STS API 操作來取得臨時安全登入資料。

AWS IoT 支援使用臨時登入資料。

### 服務連結角色
<a name="security_iam_service-with-iam-roles-service-linked"></a>

[服務連結角色](https://docs.aws.amazon.com/service-authorization/latest/reference/id_roles_terms-and-concepts.html#iam-term-service-linked-role)可讓 AWS 服務存取其他服務中的資源，以代表您完成 動作。服務連結角色會顯示在您的 IAM 帳戶中，並由該服務所擁有。IAM 管理員可以檢視，但不能編輯服務連結角色的許可。

AWS IoT 不支援服務連結角色。

### 服務角色
<a name="security_iam_service-with-iam-roles-service"></a>

此功能可讓服務代表您擔任[服務角色](https://docs.aws.amazon.com/service-authorization/latest/reference/id_roles_terms-and-concepts.html#iam-term-service-role)。此角色可讓服務存取其他服務中的資源，以代表您完成動作。服務角色會出現在您的 IAM 帳戶中，且由該帳戶所擁有。這表示 IAM 管理員可以變更此角色的許可。不過，這樣可能會破壞此服務的功能。