本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
为设置权限Amazon IoT Events警报
当你使用Amazon IoT Events用于监控的警报模型Amazon IoT SiteWise资产属性，您必须拥有以下 IAM 权限：
-
一个Amazon IoT Events允许的服务角色Amazon IoT Events将数据发送到Amazon IoT SiteWise。有关更多信息，请参阅的身份和访问管理Amazon IoT Events在Amazon IoT Events开发者指南。
-
你必须具备以下条件Amazon IoT SiteWise操作权限：
iotsitewise:DescribeAssetModel和iotsitewise:UpdateAssetModelPropertyRouting。这些权限允许Amazon IoT SiteWise将资产属性值发送到Amazon IoT Events警报模型。
有关更多信息，请参阅基于资源的政策在IAM 用户指南。
所需的操作权限
管理员可以使用 Amazon JSON 策略来指定谁有权访问什么内容。也就是说，哪个主体 可以对什么资源 执行操作，以及在什么 条件 下执行。JSON 策略的 Action 元素描述可用于在策略中允许或拒绝访问的操作。
在定义之前Amazon IoT Events警报模型，您必须授予以下权限Amazon IoT SiteWise向警报模型发送资产属性值。
-
iotsitewise:DescribeAssetModel— 允许Amazon IoT Events检查资产属性是否存在。 -
iotsitewise:UpdateAssetModelPropertyRouting— 允许Amazon IoT SiteWise自动创建启用的订阅Amazon IoT SiteWise将数据发送到Amazon IoT Events。
有关以下内容的更多信息Amazon IoT SiteWise支持的操作，请参阅操作定义为Amazon IoT SiteWise在服务授权参考。
例 权限策略示例 1
以下政策允许Amazon IoT SiteWise将资产属性值发送给任何Amazon IoT Events警报模型。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotevents:CreateAlarmModel", "iotevents:UpdateAlarmModel" ], "Resource": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/*" }, { "Effect": "Allow", "Action": [ "iotsitewise:DescribeAssetModel", "iotsitewise:UpdateAssetModelPropertyRouting" ], "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*" } ] }
例 权限策略示例 2
以下政策允许Amazon IoT SiteWise将指定资产属性的值发送到指定的Amazon IoT Events警报模型。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotevents:CreateAlarmModel", "iotevents:UpdateAlarmModel" ], "Resource": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/*" }, { "Effect": "Allow", "Action": [ "iotsitewise:DescribeAssetModel" ], "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*" }, { "Effect": "Allow", "Action": [ "iotsitewise:UpdateAssetModelPropertyRouting" ], "Resource": [ "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/12345678-90ab-cdef-1234-567890abcdef" ], "Condition": { "StringLike": { "iotsitewise:propertyId": "abcdef12-3456-7890-abcd-ef1234567890", "iotevents:alarmModelArn": "arn:aws:iotevents:us-east-1:123456789012:alarmModel/MyAlarmModel" } } } ] }
（可选） ListInputRoutings 许可
当您更新或删除资产模型时，Amazon IoT SiteWise可以检查警报型号是否在Amazon IoT Events正在监控与此资产模型关联的资产属性。这可以防止您删除具有以下内容的资产属性Amazon IoT Events警报当前正在使用。要在中启用此功能Amazon IoT SiteWise，你必须有iotevents:ListInputRoutings许可。此权限允许Amazon IoT SiteWise拨打电话ListInputRoutings支持的 API 操作Amazon IoT Events。
注意
我们强烈建议您添加ListInputRoutings许可。
例 权限策略示例
以下策略允许您更新和删除资产模型，并使用ListInputRoutingsAPI 在Amazon IoT SiteWise。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:UpdateAssetModel", "iotsitewise:DeleteAssetModel", "iotevents:ListInputRoutings" ], "Resource": "arn:aws:iotsitewise:us-east-1:123456789012:asset-model/*" } ] }
必需的权限 SiteWise 监视器
如果你想在中使用警报功能 SiteWise 监控门户，您必须更新SiteWise 监控服务角色遵循以下政策：
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iotsitewise:DescribePortal", "iotsitewise:CreateProject", "iotsitewise:DescribeProject", "iotsitewise:UpdateProject", "iotsitewise:DeleteProject", "iotsitewise:ListProjects", "iotsitewise:BatchAssociateProjectAssets", "iotsitewise:BatchDisassociateProjectAssets", "iotsitewise:ListProjectAssets", "iotsitewise:CreateDashboard", "iotsitewise:DescribeDashboard", "iotsitewise:UpdateDashboard", "iotsitewise:DeleteDashboard", "iotsitewise:ListDashboards", "iotsitewise:CreateAccessPolicy", "iotsitewise:DescribeAccessPolicy", "iotsitewise:UpdateAccessPolicy", "iotsitewise:DeleteAccessPolicy", "iotsitewise:ListAccessPolicies", "iotsitewise:DescribeAsset", "iotsitewise:ListAssets", "iotsitewise:ListAssociatedAssets", "iotsitewise:DescribeAssetProperty", "iotsitewise:GetAssetPropertyValue", "iotsitewise:GetAssetPropertyValueHistory", "iotsitewise:GetAssetPropertyAggregates", "iotsitewise:BatchPutAssetPropertyValue", "iotsitewise:ListAssetRelationships", "iotsitewise:DescribeAssetModel", "iotsitewise:ListAssetModels", "iotsitewise:UpdateAssetModel", "iotsitewise:UpdateAssetModelPropertyRouting", "sso-directory:DescribeUsers", "sso-directory:DescribeUser", "iotevents:DescribeAlarmModel", "iotevents:ListTagsForResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iotevents:BatchAcknowledgeAlarm", "iotevents:BatchSnoozeAlarm", "iotevents:BatchEnableAlarm", "iotevents:BatchDisableAlarm" ], "Resource": "*", "Condition": { "Null": { "iotevents:keyValue": "false" } } }, { "Effect": "Allow", "Action": [ "iotevents:CreateAlarmModel", "iotevents:TagResource" ], "Resource": "*", "Condition": { "Null": { "aws:RequestTag/iotsitewisemonitor": "false" } } }, { "Effect": "Allow", "Action": [ "iotevents:UpdateAlarmModel", "iotevents:DeleteAlarmModel" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/iotsitewisemonitor": "false" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": [ "iotevents.amazonaws.com" ] } } } ] }