Identity and Access Management (IAM) | 建立實體或政策 （讀寫許可）

若要檢查變更類型版本，請使用下列命令：

aws amscm list-change-type-version-summaries --filter Attribute=ChangeTypeId,Value=CT_ID

內嵌建立：

使用內嵌提供的執行參數發出建立 RFC 命令 （在內嵌提供執行參數時逸出引號），然後提交傳回的 RFC ID。例如，您可以將內容取代為如下內容：

aws amscm create-rfc --change-type-id "ct-1n9gfnog5x7fl" --change-type-version "1.0" --title "Create role or policy" --execution-parameters '{"DocumentName":"AWSManagedServices-HandleAutomatedIAMProvisioningCreate-Admin","Region":"us-east-1","Parameters":{"ValidateOnly":"No"},"RoleDetails":{"Roles":[{"RoleName":"RoleTest01","Description":"This is a test role","AssumeRolePolicyDocument":"{"Version": "2012-10-17",		 	 	 "Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]}","ManagedPolicyArns":["arn:aws:iam::123456789012:policy/policy01","arn:aws:iam::123456789012:policy/policy02"],"Path":"/","MaxSessionDuration":"7200","PermissionsBoundary":"arn:aws:iam::123456789012:policy/permission_boundary01","InstanceProfile":"No"}]},"ManagedPolicyDetails":{"Policies":[{"ManagedPolicyName":"TestPolicy01","Description":"This is customer policy","Path":"/test/","PolicyDocument":"{"Version":"2012-10-17","Statement":[{"Sid":"AllQueueActions","Effect":"Allow","Action":"sqs:ListQueues","Resource":"*","Condition":{"ForAllValues:StringEquals":{"aws:tagKeys":["temporary"]}}}]}"}]}}'

範本建立：

1. 將此變更類型的執行參數 JSON 結構描述輸出至檔案；範例名稱為 CreateIamResourceParams.json:

   aws amscm get-change-type-version --change-type-id "ct-1n9gfnog5x7fl" --query "ChangeTypeVersion.ExecutionInputSchema" --output text > CreateIamResourceParams.json

2. 修改並儲存 CreateIamResourceParams 檔案；範例會建立內嵌貼上政策文件的 IAM 角色。

   {
     "DocumentName": "AWSManagedServices-HandleAutomatedIAMProvisioningCreate-Admin",
     "Region": "us-east-1",
     "Parameters": {
       "ValidateOnly": "No"
     },
     "RoleDetails": {
       "Roles": [
         {
           "RoleName": "RoleTest01",
           "Description": "This is a test role",
           "AssumeRolePolicyDocument": {
             "Version": "2012-10-17",		 	 	 
             "Statement": [
               {
                 "Effect": "Allow",
                 "Principal": {
                   "AWS": "arn:aws:iam::123456789012:root"
                 },
                 "Action": "sts:AssumeRole"
               }
             ]
           },
           "ManagedPolicyArns": [
             "arn:aws:iam::123456789012:policy/policy01",
             "arn:aws:iam::123456789012:policy/policy02"
           ],
           "Path": "/",
           "MaxSessionDuration": "7200",
           "PermissionsBoundary": "arn:aws:iam::123456789012:policy/permission_boundary01",
           "InstanceProfile": "No"
         }
       ]
     },
     "ManagedPolicyDetails": {
       "Policies": [
         {
           "ManagedPolicyName": "TestPolicy01",
           "Description": "This is customer policy",
           "Path": "/test/",
           "PolicyDocument": {
             "Version": "2012-10-17",		 	 	 
             "Statement": [
               {
                 "Sid": "AllQueueActions",
                 "Effect": "Allow",
                 "Action": "sqs:ListQueues",
                 "Resource": "*",
                 "Condition": {
                   "ForAllValues:StringEquals": {
                     "aws:tagKeys": [
                       "temporary"
                     ]
                   }
                 }
               }
             ]
           }
         }
       ]
     }
   }

3. 將 RFC 範本 JSON 檔案輸出至名為 CreateIamResourceRfc.json:

   aws amscm create-rfc --generate-cli-skeleton > CreateIamResourceRfc.json

4. 修改並儲存 CreateIamResourceRfc.json 檔案。例如，您可以將內容取代為如下內容：

   {
     "ChangeTypeVersion": "1.0",
     "ChangeTypeId": "ct-1n9gfnog5x7fl",
     "Title": "Create entity or policy (read-write permissions)"
   }

5. 建立 RFC，指定 CreateIamResourceRfc 檔案和 CreateIamResourceParams 檔案：

   aws amscm create-rfc --cli-input-json file://CreateIamResourceRfc.json  --execution-parameters file://CreateIamResourceParams.json

   您會在回應中收到新 RFC 的 ID，並使用它來提交和監控 RFC。在您提交之前，RFC 會保持在編輯狀態，不會啟動。