本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。
安装程序配置资源的最低 IAM 策略
当你安装Amazon IoT Greengrass核心软件,你可以调配所需Amazon资源,例如Amazon IoT事物以及您的设备的 IAM 角色。您还可以将本地开发工具部署到设备。安装程序需要Amazon以便它可以在您的Amazon Web Services 账户. 有关更多信息,请参阅 安装 Amazon IoT Greengrass Core 软件。
以下示例策略包含安装程序为预配置这些资源所需的一组最少操作。如果未指定--provision
安装程序的参数。Replaceaccount-id
与您的Amazon Web Services 账户ID,然后替换GreenGrassv2Token Exchange 角色
使用您使用指定的令牌交换角色的名称--tes-role-name
安装参数.
注意
这些区域有:DeployDevTools
只在未指定时才需要--deploy-dev-tools
安装程序的参数。
- Greengrass nucleus v2.5.0 and later
-
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTokenExchangeRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreateRole", "iam:GetPolicy", "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::
account-id
:role/GreengrassV2TokenExchangeRole
", "arn:aws:iam::account-id
:policy/GreengrassV2TokenExchangeRole
Access" ] }, { "Sid": "CreateIoTResources", "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachThingPrincipal", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreateRoleAlias", "iot:CreateThing", "iot:CreateThingGroup", "iot:DescribeEndpoint", "iot:DescribeRoleAlias", "iot:DescribeThingGroup", "iot:GetPolicy" ], "Resource": "*" }, { "Sid": "DeployDevTools", "Effect": "Allow", "Action": [ "greengrass:CreateDeployment", "iot:CancelJob", "iot:CreateJob", "iot:DeleteThingShadow", "iot:DescribeJob", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:GetThingShadow", "iot:UpdateJob", "iot:UpdateThingShadow" ], "Resource": "*" } ] } - Earlier than v2.5.0
-
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CreateTokenExchangeRole", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:CreatePolicy", "iam:CreateRole", "iam:GetPolicy", "iam:GetRole", "iam:PassRole" ], "Resource": [ "arn:aws:iam::
account-id
:role/GreengrassV2TokenExchangeRole
", "arn:aws:iam::account-id
:policy/GreengrassV2TokenExchangeRole
Access", "arn:aws:iam::aws:policy/GreengrassV2TokenExchangeRole
Access" ] }, { "Sid": "CreateIoTResources", "Effect": "Allow", "Action": [ "iot:AddThingToThingGroup", "iot:AttachPolicy", "iot:AttachThingPrincipal", "iot:CreateKeysAndCertificate", "iot:CreatePolicy", "iot:CreateRoleAlias", "iot:CreateThing", "iot:CreateThingGroup", "iot:DescribeEndpoint", "iot:DescribeRoleAlias", "iot:DescribeThingGroup", "iot:GetPolicy" ], "Resource": "*" }, { "Sid": "DeployDevTools", "Effect": "Allow", "Action": [ "greengrass:CreateDeployment", "iot:CancelJob", "iot:CreateJob", "iot:DeleteThingShadow", "iot:DescribeJob", "iot:DescribeThing", "iot:DescribeThingGroup", "iot:GetThingShadow", "iot:UpdateJob", "iot:UpdateThingShadow" ], "Resource": "*" } ] }
授权核心设备与Amazon服务
Greengrass 服务角色