Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

适用于 CodeDeploy 的 Amazon 托管（预定义）策略

Amazon通过提供由Amazon创建和管理的独立 IAM 策略来满足许多常用案例的要求。这些 Amazon 托管策略授予常用案例的必要权限，这样您不需要调查需要哪些权限。有关更多信息，请参阅《IAM 用户指南》中的 Amazon 托管策略。

CodeDeploy 的 Amazon 托管策略列表

以下 Amazon 托管策略（可附加到您账户中的用户）特定于 CodeDeploy：

部署过程的某些方面的权限已授予两个代表 CodeDeploy 进行操作的其他角色类型：

您还可以创建自定义的 IAM policy，以便授予 CodeDeploy 操作和资源的权限。您将这些自定义策略附加到 IAM 角色，然后将角色分配给需要权限的用户或组。

CodeDeploy 托管策略和通知

CodeDeploy 支持通知功能，让用户知晓对部署的重要更改。CodeDeploy 托管策略包含通知功能的策略语句。有关更多信息，请参阅什么是通知？。

完全访问托管式策略中通知的权限

AWSCodeDeployFullAccess 托管策略包含以下语句，以允许对通知进行完全访问。已应用此托管式策略的用户还可以创建和管理通知的 Amazon SNS 主题、为用户订阅和取消订阅主题，以及列出要选择作为通知规则的目标的主题。

    {
        "Sid": "CodeStarNotificationsReadWriteAccess",
        "Effect": "Allow",
        "Action": [
            "codestar-notifications:CreateNotificationRule",
            "codestar-notifications:DescribeNotificationRule",
            "codestar-notifications:UpdateNotificationRule",
            "codestar-notifications:DeleteNotificationRule",
            "codestar-notifications:Subscribe",
            "codestar-notifications:Unsubscribe"
        ],
        "Resource": "*",
        "Condition" : {
            "ArnLike" : {"codestar-notifications:NotificationsForResource" : "arn:aws:codedeploy:*:*:application:*"} 
        }
    },    
    {
        "Sid": "CodeStarNotificationsListAccess",
        "Effect": "Allow",
        "Action": [
            "codestar-notifications:ListNotificationRules",
            "codestar-notifications:ListTargets",
            "codestar-notifications:ListTagsforResource"
        ],
        "Resource": "*"
    },
    {
        "Sid": "CodeStarNotificationsSNSTopicCreateAccess",
        "Effect": "Allow",
        "Action": [
            "sns:CreateTopic",
            "sns:SetTopicAttributes"
        ],
        "Resource": "arn:aws:sns:*:*:codestar-notifications*"
    },
    {
      "Sid" : "CodeStarNotificationsChatbotAccess",
      "Effect" : "Allow",
      "Action" : [
        "chatbot:DescribeSlackChannelConfigurations"
      ],
      "Resource" : "*"
    },
    {
        "Sid": "SNSTopicListAccess",
        "Effect": "Allow",
        "Action": [
            "sns:ListTopics"
        ],
        "Resource": "*"
    }

只读托管式策略中通知的权限

AWSCodeDeployReadOnlyAccess 托管策略包含以下语句，以允许对通知进行只读访问。应用此托管策略的用户可以查看资源的通知，但无法创建、管理或订阅这些通知。

   {
        "Sid": "CodeStarNotificationsPowerUserAccess",
        "Effect": "Allow",
        "Action": [
            "codestar-notifications:DescribeNotificationRule"
        ],
        "Resource": "*",
        "Condition" : {
            "ArnLike" : {"codestar-notifications:NotificationsForResource" : "arn:aws:codedeploy:*:*:application:*"} 
        }
    },    
    {
        "Sid": "CodeStarNotificationsListAccess",
        "Effect": "Allow",
        "Action": [
            "codestar-notifications:ListNotificationRules"
        ],
        "Resource": "*"
    }

其它托管式策略中通知的权限

AWSCodeDeployDeployerAccess 托管式策略包括以下语句，可让用户创建、更新、订阅和查看资源的通知，但无法将其删除。应用了此托管式策略的用户还可以创建和管理用于通知的 Amazon SNS 主题。

此策略包括以下权限：

   {
      "Sid" : "CodeStarNotificationsReadWriteAccess",
      "Effect" : "Allow",
      "Action" : [
        "codestar-notifications:CreateNotificationRule",
        "codestar-notifications:DescribeNotificationRule",
        "codestar-notifications:UpdateNotificationRule",
        "codestar-notifications:Subscribe",
        "codestar-notifications:Unsubscribe"
      ],
      "Resource" : "*",
      "Condition" : {
        "ArnLike" : {
          "codestar-notifications:NotificationsForResource" : "arn:aws:codedeploy:*:*:application:*"
        }
      }
    },
    {
      "Sid" : "CodeStarNotificationsListAccess",
      "Effect" : "Allow",
      "Action" : [
        "codestar-notifications:ListNotificationRules",
        "codestar-notifications:ListTargets",
        "codestar-notifications:ListTagsforResource",
        "codestar-notifications:ListEventTypes"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "CodeStarNotificationsChatbotAccess",
      "Effect" : "Allow",
      "Action" : [
        "chatbot:DescribeSlackChannelConfigurations"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "SNSTopicListAccess",
      "Effect" : "Allow",
      "Action" : [
        "sns:ListTopics"
      ],
      "Resource" : "*"
    }

有关更多信息，请参阅适用于 AWS CodeStar 通知的身份和访问权限管理。