Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

适用于 Amazon Identity and Access Management Access Analyzer 的 Amazon 托管策略

Amazon 托管策略是由 Amazon 创建和管理的独立策略。Amazon 托管策略旨在为许多常见用例提供权限，以便您可以开始为用户、组和角色分配权限。

请记住，Amazon 托管式策略可能不会为您的特定使用场景授予最低权限，因为它们可供所有 Amazon 客户使用。我们建议通过定义特定于您的使用场景的客户管理型策略来进一步减少权限。

您无法更改 Amazon 托管策略中定义的权限。如果 Amazon 更新在 Amazon 托管式策略中定义的权限，则更新会影响该策略所附加到的所有主体身份（用户、组和角色）。当新的 Amazon Web Service启动或新的 API 操作可用于现有服务时，Amazon 最有可能更新 Amazon 托管式策略。

有关更多信息，请参阅《IAM 用户指南》中的 Amazon 托管式策略。

IAMReadOnlyAccess

使用 IAMReadOnlyAccess 托管式策略来允许对 IAM 资源的只读权限。此策略授予权限，使其能够获取和列出所有 IAM 资源。它允许查看用户、组、角色、策略、身份提供程序和 MFA 设备的详细信息和活动报告。它不包括创建或删除资源或访问 IAM Access Analyzer 资源的能力。有关此策略支持的服务和操作的完整列表，请查看此 policy（策略）。

IAMUserChangePassword

使用 IAMUserChangePassword 托管式策略可允许 IAM 用户更改他们的密码。

通过配置 IAM Account 设置和 Password 策略，IAM 用户可以修改自己的 IAM 账户密码。当您允许此操作时，IAM 会向每个用户附加以下策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:ChangePassword"
            ],
            "Resource": [
                "arn:aws:iam::*:user/${aws:username}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetAccountPasswordPolicy"
            ],
            "Resource": "*"
        }
    ]
}

IAMAccessAnalyzerFullAccess

使用 IAMAccessAnalyzerFullAccess Amazon 托管策略，以允许您的管理员访问 IAM Access Analyzer。

权限分组

此策略根据提供的权限集分为多个语句。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "access-analyzer:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "access-analyzer.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:ListAccounts",
        "organizations:ListAccountsForParent",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:ListChildren",
        "organizations:ListDelegatedAdministrators",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListParents",
        "organizations:ListRoots"
      ],
      "Resource": "*"
    }
  ]
}

IAMAccessAnalyzerReadOnlyAccess

要允许对 IAM Access Analyzer 进行只读访问，请使用 IAMAccessAnalyzerReadOnlyAccess Amazon 托管策略。

要同时允许对用于 Amazon Organizations 的 IAM Access Analyzer 进行只读访问中，请创建一个客户托管策略，以允许来自 IAMAccessAnalyzerFullAccess Amazon 托管策略的“Describe”（描述）和“List”（列示）操作。

服务级别权限

此策略提供对 IAM Access Analyzer 的只读访问权限。此策略中不包含其他服务权限。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IAMAccessAnalyzerReadOnlyAccess",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:CheckAccessNotGranted",
        "access-analyzer:CheckNoNewAccess",
        "access-analyzer:Get*",
        "access-analyzer:List*",
        "access-analyzer:ValidatePolicy"
      ],
      "Resource": "*"
    }
  ]
}

AccessAnalyzerServiceRolePolicy

您无法将 AccessAnalyzerServiceRolePolicy 附加到您的 IAM 实体。此附加到服务相关角色的策略允许 IAM Access Analyzer 代表您执行操作。有关更多信息，请参阅将服务相关角色用于 Amazon Identity and Access Management Access Analyzer。

权限分组

该策略允许访问 IAM Access Analyzer，以分析来自多个 Amazon Web Services 的资源元数据。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AccessAnalyzerServiceRolePolicy",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetResourcePolicy",
        "dynamodb:ListStreams",
        "dynamodb:ListTables",
        "ec2:DescribeAddresses",
        "ec2:DescribeByoipCidrs",
        "ec2:DescribeSnapshotAttribute",
        "ec2:DescribeSnapshots",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcs",
        "ec2:GetSnapshotBlockPublicAccessState",
        "ecr:DescribeRepositories",
        "ecr:GetRepositoryPolicy",
        "elasticfilesystem:DescribeFileSystemPolicy",
        "elasticfilesystem:DescribeFileSystems",
        "iam:GenerateServiceLastAccessedDetails",
        "iam:GetAccessKeyLastUsed"
        "iam:GetGroup",
        "iam:GetLoginProfile",
        "iam:GetRole",
        "iam:GetServiceLastAccessedDetails",
        "iam:GetUser",
        "iam:ListAccessKeys",
        "iam:ListEntitiesForPolicy",
        "iam:ListRoles",
        "iam:ListUsers",
        "kms:DescribeKey",
        "kms:GetKeyPolicy",
        "kms:ListGrants",
        "kms:ListKeyPolicies",
        "kms:ListKeys",
        "lambda:GetFunctionUrlConfig",
        "lambda:GetLayerVersionPolicy",
        "lambda:GetPolicy",
        "lambda:ListAliases",
        "lambda:ListFunctions",
        "lambda:ListLayers",
        "lambda:ListLayerVersions",
        "lambda:ListVersionsByFunction",
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:ListAccounts",
        "organizations:ListAccountsForParent",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:ListChildren",
        "organizations:ListDelegatedAdministrators",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListParents",
        "organizations:ListRoots",
        "rds:DescribeDBClusterSnapshotAttributes",
        "rds:DescribeDBClusterSnapshots",
        "rds:DescribeDBSnapshotAttributes",
        "rds:DescribeDBSnapshots",
        "s3:DescribeMultiRegionAccessPointOperation",
        "s3:GetAccessPoint",
        "s3:GetAccessPointPolicy",
        "s3:GetAccessPointPolicyStatus",
        "s3:GetAccountPublicAccessBlock",
        "s3:GetBucketAcl",
        "s3:GetBucketLocation",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPolicy",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetMultiRegionAccessPoint",
        "s3:GetMultiRegionAccessPointPolicy",
        "s3:GetMultiRegionAccessPointPolicyStatus",
        "s3:ListAccessPoints",
        "s3:ListAllMyBuckets",
        "s3:ListMultiRegionAccessPoints",
        "s3express:GetBucketPolicy",
        "s3express:ListAllMyDirectoryBuckets",
        "sns:GetTopicAttributes",
        "sns:ListTopics",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:ListSecrets",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues"
      ],
      "Resource": "*"
    }
  ]
}

IAM 和 IAM Access Analyzer 更新 Amazon 托管策略

查看从服务开始跟踪这些更改以来，有关 IAM 和 Amazon 托管式策略更新的详细信息。有关此页面更改的自动警报，请订阅 IAM 和 IAM Access Analyzer 文档历史记录页面上的 RSS 源。