Identity and Access Management (IAM) | 更新實體或政策 （讀寫許可）

若要檢查變更類型版本，請使用下列命令：

aws amscm list-change-type-version-summaries --filter Attribute=ChangeTypeId,Value=CT_ID

內嵌建立：

使用內嵌提供的執行參數發出建立 RFC 命令 （在內嵌提供執行參數時逸出引號），然後提交傳回的 RFC ID。例如，您可以將內容取代為如下內容：

aws amscm create-rfc --change-type-id "ct-1e0xmuy1diafq" --change-type-version "1.0" --title "Update role or policy" --execution-parameters "{\"DocumentName\":\"AWSManagedServices-HandleAutomatedIAMProvisioningUpdate-Admin\",\"Region\":\"us-east-1\",\"Parameters\":{\"ValidateOnly\":\"No\"},\"RoleDetails\":{\"Roles\":[{\"RoleName\":\"RoleTest01\",\"Description\":\"This is a test role\",\"AssumeRolePolicyDocument\":\"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"AWS\\\":\\\"arn:aws:iam::123456789012:root\\\"},\\\"Action\\\":\\\"sts:AssumeRole\\\"}]}\",\"ManagedPolicyArns\":[\"arn:aws:iam::123456789012:policy/policy01\",\"arn:aws:iam::123456789012:policy/policy02\"],\"MaxSessionDuration\":\"7200\",\"PermissionsBoundary\":\"arn:aws:iam::123456789012:policy/permission_boundary01\"}]},\"ManagedPolicyDetails\":{\"Policies\":[{\"ManagedPolicyName\":\"TestPolicy01\",\"PolicyDocument\":\"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Sid\\\":\\\"AllQueueActions\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"sqs:ListQueues\\\",\\\"Resource\\\":\\\"*\\\",\\\"Condition\\\":{\\\"ForAllValues:StringEquals\\\":{\\\"aws:tagKeys\\\":[\\\"temporary\\\"]}}}]}\"}]}}"

範本建立：

1. 將此變更類型的執行參數 JSON 結構描述輸出至檔案；範例將其命名為 UpdateIamResourceParams.json:

   aws amscm get-change-type-version --change-type-id "ct-1e0xmuy1diafq" --query "ChangeTypeVersion.ExecutionInputSchema" --output text > UpdateIamResourceParams.json

2. 修改並儲存 UpdateIamResourceParams 檔案；範例會建立內嵌貼上政策文件的 IAM 角色。

   {
     "DocumentName": "AWSManagedServices-HandleAutomatedIAMProvisioningUpdate-Admin",
     "Region": "us-east-1",
     "Parameters": {
       "ValidateOnly": "No"
     },
     "RoleDetails": {
       "Roles": [
         {
           "RoleName": "RoleTest01",
           "Description": "This is a test role",
           "AssumeRolePolicyDocument": {"Version": "2012-10-17",		 	 	 "Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]},
           "ManagedPolicyArns": [
             "arn:aws:iam::123456789012:policy/policy01",
             "arn:aws:iam::123456789012:policy/policy02"
           ],
           "MaxSessionDuration": "7200",
           "PermissionsBoundary": "arn:aws:iam::123456789012:policy/permission_boundary01"
         }
       ]
     },
     "ManagedPolicyDetails": {
       "Policies": [
         {
           "ManagedPolicyName": "TestPolicy01",
           "PolicyDocument": {"Version": "2012-10-17",		 	 	 "Statement":[{"Sid":"AllQueueActions","Effect":"Allow","Action":"sqs:ListQueues","Resource":"*","Condition":{"ForAllValues:StringEquals":{"aws:tagKeys":["temporary"]}}}]}
         }
       ]
     }
   }

3. 將 RFC 範本 JSON 檔案輸出至名為 UpdateIamResourceRfc.json:

   aws amscm create-rfc --generate-cli-skeleton > UpdateIamResourceRfc.json

4. 修改並儲存 UpdateIamResourceRfc.json 檔案。例如，您可以將內容取代為如下內容：

   {
       "ChangeTypeVersion": "1.0",
       "ChangeTypeId": "ct-1e0xmuy1diafq",
       "Title": "Update entity or policy (read-write permissions)"
   }

5. 建立 RFC，指定 UpdateIamResourceRfc 檔案和 UpdateIamResourceParams 檔案：

   aws amscm create-rfc --cli-input-json file://UpdateIamResourceRfc.json  --execution-parameters file://UpdateIamResourceParams.json

   您會在回應中收到新 RFC 的 ID，並且可以使用它來提交和監控 RFC。在您提交之前，RFC 會保持在編輯狀態，不會啟動。