使用 Amazon Q 建立即時節點存取的核准政策

使用適用於命令列的 Amazon Q 建立核准政策

1. 開啟終端並使用 Amazon Q 啟動工作階段。

   $ q chat

2. 輸入提示並描述您要建立的政策陳述式類型。例如，如果使用先前的核准政策案例，您可以輸入下列提示：

   Create a Cedar policy statement that allows a principal to use the “getTokenForInstanceAccess" action for a resource 
   that has a tag key “Environment” and tag value of “Testing”. Use the following example statement for reference to verify the syntax.
   
   permit (
       principal in AWS::IdentityStore::Group::"e8c17310-e011-7089-d989-10da1EXAMPLE",
       action == AWS::SSM::Action::"getTokenForInstanceAccess",
       resource
   )
   when {
       principal has organization && resource.hasTag("Engineering") && resource.hasTag("Production") && principal.organization == "Platform"
   };
   
   The Cedar policy statement you create must be valid. Validate the Cedar statement using the AWS documentation provided for just-in-time node access policy statement structure and make sure you abide by the schema.

3. 輸入此範例提示會產生下列輸出：

   Based on the AWS documentation for Cedar policy statements and the examples provided, I'll create a valid Cedar policy 
   statement that allows a principal to use the "getTokenForInstanceAccess" action for resources with the tag key "Environment" and tag value "Testing".
                               
   Here's the Cedar policy statement:
   
   permit (
       principal,
       action == AWS::SSM::Action::"getTokenForInstanceAccess",
       resource
   )
   when {
       resource.hasTag("Environment") &&
       resource.getTag("Environment") == "Testing"
   };
   
   
   This policy statement:
   1. Uses the permit effect to allow access
   2. Applies to any principal (since no specific principal is defined)
   3. Specifically targets the "getTokenForInstanceAccess" action
   4. Applies to resources that have a tag with key "Environment" and value "Testing"
   5. Uses the proper syntax for the condition clause with the hasTag() and getTag() operators
   
   The statement follows the Cedar policy language structure as documented in the AWS Systems Manager documentation for just-in-time node access policies.

4. 將政策陳述式貼到新的 Cedar 檔案中，以驗證語法。您也可以使用 Cedar 演練場驗證陳述式。

5. 驗證陳述式之後，儲存 Cedar 檔案。

6. 從終端機執行下列 AWS CLI 命令，以使用您的政策內容建立 SSM 文件。在生產環境中使用核准政策之前，請使用 AWS 帳戶 和 中的身分和節點子集來測試核准政策 AWS 區域。

   注意

   對於自動核准政策，文件名稱必須為 SSM-JustInTimeAccessAutoApprovalPolicy。每個 AWS 帳戶 和 只能有一個自動核准政策 AWS 區域。對於拒絕存取政策，文件名稱必須是 SSM-JustInTimeAccessDenyAccessOrgPolicy。每個 AWS Organizations 組織只能有一個拒絕存取政策，且必須在 Systems Manager 的委派管理員帳戶中建立政策。手動核准政策的命名限制與其他 SSM 文件相同。如需詳細資訊，請參閱 CreateDocument。

   Linux & macOS

   aws ssm create-document \
       --content file://path/to/file/policyContent.cedar \
       --name "SSM-JustInTimeAccessAutoApprovalPolicy" \
       --document-type "AutoApproval"

   Windows

   aws ssm create-document ^
       --content file://C:\path\to\file\policyContent.cedar ^
       --name "SSM-JustInTimeAccessAutoApprovalPolicy" ^
       --document-type "AutoApproval"

   PowerShell

   $cedar = Get-Content -Path "C:\path\to\file\policyContent.cedar" | Out-String
   New-SSMDocument `
       -Content $cedar `
       -Name "SSM-JustInTimeAccessAutoApprovalPolicy" `
       -DocumentType "AutoApproval"