示例：允许为特定键和值添加容量标签

您附加到 IAM 用户或角色的以下基于身份的策略允许委托人创建和更新计算环境以及设置容量标签，但前提是CostCenter标签值为engineering或ops且不使用除和之外的CostCenter标签密钥。Team包含任何其他标签密钥或其他CostCenter值的请求将被拒绝。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowComputeEnvironmentManagement",
      "Effect": "Allow",
      "Action": [
        "batch:CreateComputeEnvironment",
        "batch:UpdateComputeEnvironment"
      ],
      "Resource": "arn:aws:batch:us-east-1:123456789012:compute-environment/*"
    },
    {
      "Sid": "AllowSetCapacityTagsForApprovedTags",
      "Effect": "Allow",
      "Action": "batch:SetCapacityTags",
      "Resource": "arn:aws:batch:us-east-1:123456789012:compute-environment/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CostCenter": ["engineering", "ops"]
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": ["CostCenter", "Team"]
        }
      }
    }
  ]
}

要完全拒绝容量标记，同时仍允许创建和更新计算环境，请附上明确说明以下内容Deny的策略：batch:SetCapacityTags

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "batch:SetCapacityTags",
      "Resource": "*"
    }
  ]
}