金丝雀的必需角色和权限
每个金丝雀必须与附加某些权限的 IAM 角色相关联。当您使用 CloudWatch 控制台创建金丝雀时，您可以选择 CloudWatch Synthetics 为金丝雀创建 IAM 角色。如果您这样做，该角色将拥有所需的权限。
如果您要自己创建 IAM 角色，或者创建使用 Amazon CLI 或 API 创建金丝雀时可以使用的 IAM 角色，角色必须包含本部分中列出的权限。
金丝雀的所有 IAM 角色必须包含以下信任策略语句。
- JSON
-
-
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
此外，金丝雀的 IAM 角色需要以下语句之一。
不使用 Amazon KMS 或者需要 Amazon VPC 访问的基本金丝雀
- JSON
-
-
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::path/to/your/s3/bucket/canary/results/folder" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::name/of/the/s3/bucket/that/contains/canary/results" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "xray:PutTraceSegments" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Resource": "*", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "CloudWatchSynthetics" } } } ] }
使用 Amazon KMS 加密金丝雀构件但不需要 Amazon VPC 访问的金丝雀
- JSON
-
-
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "xray:PutTraceSegments" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Resource": "*", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "CloudWatchSynthetics" } } }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/KMS_key_id", "Condition": { "StringEquals": { "kms:ViaService": [ "s3.us-east-1.amazonaws.com" ] } } } ] }
不使用 Amazon KMS 但需要 Amazon VPC 访问的金丝雀
- JSON
-
-
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "xray:PutTraceSegments" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Resource": "*", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "CloudWatchSynthetics" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface" ], "Resource": [ "*" ] } ] }
使用 Amazon KMS 加密金丝雀构件并且也需要 Amazon VPC 访问的金丝雀
如果您更新非 VPC 金丝雀以开始使用 VPC，则为了包含以下策略中列出的网络接口权限，需要更新金丝雀的角色。
- JSON
-
-
{ "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::path/to/your/S3/bucket/canary/results/folder" ] }, { "Effect": "Allow", "Action": [ "s3:GetBucketLocation" ], "Resource": [ "arn:aws:s3:::name/of/the/S3/bucket/that/contains/canary/results" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup" ], "Resource": [ "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/cwsyn-canary_name-*" ] }, { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "xray:PutTraceSegments" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Resource": "*", "Action": "cloudwatch:PutMetricData", "Condition": { "StringEquals": { "cloudwatch:namespace": "CloudWatchSynthetics" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:DescribeNetworkInterfaces", "ec2:DeleteNetworkInterface" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/KMS_key_id", "Condition": { "StringEquals": { "kms:ViaService": [ "s3.us-east-1.amazonaws.com" ] } } } ] }
使用客户自主管理型 Amazon KMS 密钥加密 Lambda 函数环境变量的金丝雀
如果将客户自主管理型密钥配置为静态环境变量加密，则必须对密钥具有 kms:CreateGrant、kms:Encrypt、kms:Decrypt 和 kms:DescribeKey 权限。如果使用传输中加密，则金丝雀执行角色还必须具有 kms:Decrypt。有关更多信息，请参阅 使用客户自主管理型密钥对环境变量进行静态加密。。
如果使用传输中加密，需将以下语句添加到金丝雀的执行角色策略中：
{ "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "arn:aws:kms:us-east-1:111122223333:key/a1b2c3d4-e5f6-7890-abcd-EXAMPLE11111" }
将此语句添加到已在使用的任何基本执行角色策略（基本、VPC 或构件 KMS）中。
管理 CloudWatch 金丝雀的用户的必需角色和权限
限制用户查看特定的金丝雀