本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 示例：允许为特定键和值添加容量标签
<a name="capacity-tags-access-policy-example"></a>

您附加到 IAM 用户或角色的以下基于身份的策略允许委托人创建和更新计算环境以及设置容量标签，但前提是`CostCenter`标签值为`engineering`或`ops`且不使用除和之外的`CostCenter`标签密钥。`Team`包含任何其他标签密钥或其他`CostCenter`值的请求将被拒绝。

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowComputeEnvironmentManagement",
      "Effect": "Allow",
      "Action": [
        "batch:CreateComputeEnvironment",
        "batch:UpdateComputeEnvironment"
      ],
      "Resource": "arn:aws:batch:us-east-1:123456789012:compute-environment/*"
    },
    {
      "Sid": "AllowSetCapacityTagsForApprovedTags",
      "Effect": "Allow",
      "Action": "batch:SetCapacityTags",
      "Resource": "arn:aws:batch:us-east-1:123456789012:compute-environment/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/CostCenter": ["engineering", "ops"]
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": ["CostCenter", "Team"]
        }
      }
    }
  ]
}
```

要完全拒绝容量标记，同时仍允许创建和更新计算环境，请附上明确说明以下内容`Deny`的策略：`batch:SetCapacityTags`

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "batch:SetCapacityTags",
      "Resource": "*"
    }
  ]
}
```