CloudWatch Canary 的必需角色和权限 - Amazon CloudWatch
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 Amazon Web Services 服务入门

CloudWatch Canary 的必需角色和权限

创建和管理 Canary 的用户以及 Canary 本身都必须拥有某些权限。

Amazon用于 CloudWatch Synthetics 的 托管式策略

要向用户、组和角色添加权限,与自己编写策略相比,使用 Amazon 托管式策略更简单。创建仅为团队提供所需权限的 IAM 客户托管式策略需要时间和专业知识。要快速入门,您可以使用我们的 Amazon 托管策略。这些策略涵盖常见使用案例,可在您的 Amazon 账户中使用。有关 Amazon 托管式策略的更多信息,请参阅 IAM 用户指南中的 Amazon 托管式策略 Amazon 托管式策略。

Amazon 服务负责维护和更新 Amazon 托管策略。您无法更改 Amazon 托管策略中的权限。服务会偶尔更改 Amazon 托管式策略中的权限。此类更新会影响附加策略的所有身份(用户、组和角色)。

CloudWatch Synthetics 对 Amazon 托管式策略的更新

查看有关 CloudWatch Synthetics 的 Amazon 托管式策略更新的详细信息(从该服务开始跟踪这些更改开始)。有关此页面更改的自动提示,请订阅 CloudWatch 文档历史记录页面上的 RSS 源。

更改 描述 日期

删除了 CloudWatchSyntheticsFullAccess 中的冗余操作

CloudWatch Synthetics 删除了 CloudWatchSyntheticsFullAccess 策略中的 s3:PutBucketEncryptionlambda:GetLayerVersionByArn 操作,因为这些操作相较于策略中的其他权限是多余的。删除的操作不提供任何权限,策略授予的权限也未发生任何净更改。

2021 年 3 月 12 日

CloudWatch Synthetics 开始跟踪变更

CloudWatch Synthetics 开始跟踪其 Amazon 托管式策略的更改。

2021 年 3 月 10 日

CloudWatchSyntheticsFullAccess

以下是 CloudWatchSyntheticsFullAccess 策略的内容:

{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "synthetics:*" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "s3:CreateBucket", "s3:PutEncryptionConfiguration" ], "Resource":[ "arn:aws:s3:::cw-syn-results-*" ] }, { "Effect":"Allow", "Action":[ "iam:ListRoles", "s3:ListAllMyBuckets", "s3:GetBucketLocation", "xray:GetTraceSummaries", "xray:BatchGetTraces", "apigateway:GET" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "s3:GetObject", "s3:ListBucket" ], "Resource":"arn:aws:s3:::cw-syn-*" }, { "Effect":"Allow", "Action":[ "s3:GetObjectVersion" ], "Resource":"arn:aws:s3:::aws-synthetics-library-*" }, { "Effect":"Allow", "Action":[ "iam:PassRole" ], "Resource":[ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ], "Condition":{ "StringEquals":{ "iam:PassedToService":[ "lambda.amazonaws.com", "synthetics.amazonaws.com" ] } } }, { "Effect":"Allow", "Action":[ "iam:GetRole" ], "Resource":[ "arn:aws:iam::*:role/service-role/CloudWatchSyntheticsRole*" ] }, { "Effect":"Allow", "Action":[ "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics" ], "Resource":"*" }, { "Effect":"Allow", "Action":[ "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms" ], "Resource":[ "arn:aws:cloudwatch:*:*:alarm:Synthetics-*" ] }, { "Effect":"Allow", "Action":[ "cloudwatch:DescribeAlarms" ], "Resource":[ "arn:aws:cloudwatch:*:*:alarm:*" ] }, { "Effect":"Allow", "Action":[ "lambda:CreateFunction", "lambda:AddPermission", "lambda:PublishVersion", "lambda:UpdateFunctionConfiguration", "lambda:GetFunctionConfiguration" ], "Resource":[ "arn:aws:lambda:*:*:function:cwsyn-*" ] }, { "Effect":"Allow", "Action":[ "lambda:GetLayerVersion", "lambda:PublishLayerVersion" ], "Resource":[ "arn:aws:lambda:*:*:layer:cwsyn-*", "arn:aws:lambda:*:*:layer:Synthetics:*" ] }, { "Effect":"Allow", "Action":[ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups" ], "Resource":[ "*" ] }, { "Effect":"Allow", "Action":[ "sns:ListTopics" ], "Resource":[ "*" ] }, { "Effect":"Allow", "Action":[ "sns:CreateTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic" ], "Resource":[ "arn:*:sns:*:*:Synthetics-*" ] } ] }

CloudWatchSyntheticsReadOnlyAccess

以下是 CloudWatchSyntheticsReadOnlyAccess 策略的内容:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "synthetics:Describe*", "synthetics:Get*", "synthetics:List*" ], "Resource": "*" } ] }