管理访问权限 Amazon Trusted Advisor

您可以 Amazon Trusted Advisor 从中访问 Amazon Web Services Management Console。所有 Amazon Web Services 账户 人都可以访问精选的核心Trusted Advisor 支票。如果您拥有商业、Enterprise On-Ramp 或企业 Support 计划，则可以访问所有检查。有关更多信息，请参阅 Amazon Trusted Advisor 检查引用。

您可以使用 Amazon Identity and Access Management (IAM) 来控制对的访问权限 Trusted Advisor。

Trusted Advisor 控制台的权限

要访问 Trusted Advisor 控制台，用户必须拥有一组最低权限。这些权限必须允许用户列出和查看有关您的 Trusted Advisor 资源的详细信息 Amazon Web Services 账户。

可以使用以下选项来控制对 Trusted Advisor的访问：

创建策略时，可以指定服务的命名空间来允许或拒绝操作。的命名空间 Trusted Advisor 是trustedadvisor。但是，您不能使用trustedadvisor命名空间来允许或拒绝 Trusted Advisor API 中的 Amazon Web Services Support API 操作。相反，您必须使用 Amazon Web Services Support 的 support 命名空间。

Trusted Advisor 行动

您可以在控制台中执行以下 Trusted Advisor 操作。您也可以在 IAM 策略中指定这些 Trusted Advisor 操作以允许或拒绝特定操作。

Trusted Advisor 组织视图的操作

以下 Trusted Advisor 操作适用于组织视图功能。有关更多信息，请参阅 Amazon Trusted Advisor 的组织视图。

Trusted Advisor 优先行动

如果您为账户启用了 Trusted Advisor 优先级，则可以在控制台中执行以下 Trusted Advisor 操作。还可以在 IAM policy 中添加这些 Trusted Advisor 操作以允许或拒绝特定操作。有关更多信息，请参阅 Trusted Advisor Priority 的 IAM policy 示例。

有关更多信息，请参阅 Amazon Trusted Advisor Priority 入门。

Trusted Advisor 参与行动

如果您为账户启用了 Eng Trusted Advisor age，则可以在控制台中执行以下 Trusted Advisor 操作。您也可以在 IAM 策略中添加这些 Trusted Advisor 操作以允许或拒绝特定操作。有关更多信息，请参阅 Trusted Advisor Engage 的 IAM policy 示例。

有关更多信息，请参阅 开始使用 Amazon Trusted Advisor Engage（预览版）。

IAM 策略 示例

以下策略介绍如何允许和拒绝对 Trusted Advisor的访问。您可以使用下面的策略之一来在 IAM 控制台中创建客户托管策略。例如，您可以复制示例策略，然后将其粘贴到 IAM 控制台的 JSON 选项卡中。然后，将策略附加您的 IAM 用户、组或角色。

有关如何创建 IAM policy 的更多信息，请参阅 IAM 用户指南中的创建 IAM policy（控制台）。

完全访问权限 Trusted Advisor

以下策略允许用户在 Trusted Advisor 控制台中查看所有 Trusted Advisor 检查并对其执行所有操作。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "trustedadvisor:*",
            "Resource": "*"
        }
    ]
}

对 Trusted Advisor的只读访问权限

以下策略允许用户对 Trusted Advisor 控制台进行只读访问。用户无法进行任何更改，例如刷新检查或更改通知首选项。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "trustedadvisor:Describe*",
                "trustedadvisor:Get*",
                "trustedadvisor:List*"
            ],
            "Resource": "*"
        }
    ]
}

拒绝访问 Trusted Advisor

以下政策不允许用户在 Trusted Advisor 控制台中查看 Trusted Advisor 支票或对其执行操作。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "trustedadvisor:*",
            "Resource": "*"
        }
    ]
}

允许和拒绝特定操作

以下策略允许用户在 Trusted Advisor 控制台中查看所有 Trusted Advisor 支票，但不允许他们刷新任何支票。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "trustedadvisor:*",
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "trustedadvisor:RefreshCheck",
            "Resource": "*"
        }
    ]
}

控制对 Amazon Web Services Support API 操作的访问权限 Trusted Advisor

在中 Amazon Web Services Management Console，单独的 trustedadvisor IAM 命名空间控制对的访问权限 Trusted Advisor。您不能使用trustedadvisor命名空间来允许或拒绝 Trusted Advisor API 中的 Amazon Web Services Support API 操作。相反，可以使用 support 命名空间。您必须拥有 Amazon Web Services Support API 权限才能以 Trusted Advisor 编程方式调用。

例如，如果要调用该RefreshTrustedAdvisorCheck操作，则必须在策略中拥有执行此操作的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "support:DescribeTrustedAdvisorCheckRefreshStatuses",
                "support:DescribeTrustedAdvisorCheckResult",
                "support:DescribeTrustedAdvisorChecks",
                "support:DescribeTrustedAdvisorCheckSummaries",
                "support:RefreshTrustedAdvisorCheck",
                "trustedadvisor:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "support:AddAttachmentsToSet",
                "support:AddCommunicationToCase",
                "support:CreateCase",
                "support:DescribeAttachment",
                "support:DescribeCases",
                "support:DescribeCommunications",
                "support:DescribeServices",
                "support:DescribeSeverityLevels",
                "support:ResolveCase"
            ],
            "Resource": "*"
        }
    ]
}

有关 IAM 如何与 Amazon Web Services Support 和配合使用的更多信息 Trusted Advisor，请参阅操作。

Trusted Advisor Priority 的 IAM policy 示例

您可以使用以下 Amazon 托管策略来控制对 Priority 的 Trusted Advisor 访问权限。有关更多信息，请参阅 Amazon Web Services 的托管策略 Amazon Trusted Advisor 和 Amazon Trusted Advisor Priority 入门。

Trusted Advisor Engage 的 IAM policy 示例

在 Eng Trusted Advisor age 中授予读写权限的策略示例：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "trustedadvisor:CreateEngagement*",
                "trustedadvisor:DescribeAccount*",
                "trustedadvisor:GetEngagement*",
                "trustedadvisor:ListEngagement*",
                "trustedadvisor:UpdateEngagement*"
            ],
            "Resource": "*"
        }
    ]
}

在 Eng Trusted Advisor age 中授予只读访问权限的策略示例：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "trustedadvisor:DescribeAccount*",
                "trustedadvisor:GetEngagement*",
                "trustedadvisor:ListEngagement*"
            ],
            "Resource": "*"
        }
    ]
}

在 Eng Trusted Advisor age 中授予读取和写入权限以及启用可信访问权限的策略示例 Trusted Advisor：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeOrganization",
                "organizations:ListAWSServiceAccessForOrganization",
                "trustedadvisor:CreateEngagement*",
                "trustedadvisor:DescribeAccount*",
                "trustedadvisor:DescribeOrganization",
                "trustedadvisor:GetEngagement*",
                "trustedadvisor:ListEngagement*",
                "trustedadvisor:SetOrganizationAccess",
                "trustedadvisor:UpdateEngagement*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "organizations:EnableAWSServiceAccess",
                "organizations:DisableAWSServiceAccess"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "organizations:ServicePrincipal": [
                        "reporting.trustedadvisor.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::*:role/aws-service-role/reporting.trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisorReporting",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "reporting.trustedadvisor.amazonaws.com"
                }
            }
        }
    ]
}

另请参阅

有关 Trusted Advisor 权限的更多信息，请参阅以下资源：