View a markdown version of this page

Amazon的托管策略Amazon IoT SiteWise - Amazon IoT SiteWise
AWSIoTSiteWiseReadOnlyAccessAWSServiceRoleForIoTSiteWise策略更新
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

Amazon的托管策略Amazon IoT SiteWise

使用Amazon托管策略简化向用户、群组和角色添加权限的过程，而不是自己编写策略。创建为团队提供确切权限的 IAM 客户管理型策略需要时间和专业知识。为了更快地进行设置，可以考虑将我们的Amazon托管策略用于常见用例。在您的Amazon账户中查找Amazon托管政策。有关 Amazon 托管式策略的更多信息，请参阅《IAM 用户指南》中的 Amazon 托管式策略。

Amazon服务负责更新和维护Amazon托管策略，这意味着您无法修改这些策略的权限。有时，Amazon IoT SiteWise可能会添加权限以适应新功能，从而影响附加策略的所有身份。新服务或特征的推出往往伴随着此类更新。但是，权限永远不会被移除，这就可以确保您的设置保持不变。

此外，还Amazon支持跨多个服务的工作职能的托管策略。例如，ReadOnlyAccessAmazon托管策略提供对所有Amazon服务和资源的只读访问权限。当服务启动一项新功能时，Amazon会为新操作和资源添加只读权限。有关工作职能策略的列表和说明，请参阅 IAM 用户指南中的适用于工作职能的 Amazon 托管策略。

Amazon托管策略： AWSIoTSiteWiseReadOnlyAccess

使用AWSIoTSiteWiseReadOnlyAccessAmazon托管策略允许只读访问Amazon IoT SiteWise。

您可以将 AWSIoTSiteWiseReadOnlyAccess 策略附加到 IAM 身份。

Service-level permissions

此策略提供对的只读访问权限Amazon IoT SiteWise，包括执行只读 SQL 查询的权限。此策略中不包含其他服务权限。

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
        "Effect": "Allow",
        "Action": [
                "iotsitewise:BatchGetAssetPropertyAggregates",
                "iotsitewise:BatchGetAssetPropertyValue",
                "iotsitewise:BatchGetAssetPropertyValueHistory",
                "iotsitewise:DescribeAccessPolicy",
                "iotsitewise:DescribeAction",
                "iotsitewise:DescribeAsset",
                "iotsitewise:DescribeAssetCompositeModel",
                "iotsitewise:DescribeAssetModel",
                "iotsitewise:DescribeAssetModelCompositeModel",
                "iotsitewise:DescribeAssetModelInterfaceRelationship",
                "iotsitewise:DescribeAssetProperty",
                "iotsitewise:DescribeBulkImportJob",
                "iotsitewise:DescribeComputationModel",
                "iotsitewise:DescribeComputationModelExecutionSummary",
                "iotsitewise:DescribeDashboard",
                "iotsitewise:DescribeDataset",
                "iotsitewise:DescribeDefaultEncryptionConfiguration",
                "iotsitewise:DescribeExecution",
                "iotsitewise:DescribeGateway",
                "iotsitewise:DescribeGatewayCapabilityConfiguration",
                "iotsitewise:DescribeLoggingOptions",
                "iotsitewise:DescribePortal",
                "iotsitewise:DescribeProject",
                "iotsitewise:DescribeStorageConfiguration",
                "iotsitewise:DescribeTimeSeries",
                "iotsitewise:GetAssetPropertyAggregates",
                "iotsitewise:GetAssetPropertyValue",
                "iotsitewise:GetAssetPropertyValueHistory",
                "iotsitewise:GetInterpolatedAssetPropertyValues",
                "iotsitewise:ListAccessPolicies",
                "iotsitewise:ListActions",
                "iotsitewise:ListAssetModelCompositeModels",
                "iotsitewise:ListAssetModelProperties",
                "iotsitewise:ListAssetModels",
                "iotsitewise:ListAssetProperties",
                "iotsitewise:ListAssetRelationships",
                "iotsitewise:ListAssets",
                "iotsitewise:ListAssociatedAssets",
                "iotsitewise:ListBulkImportJobs",
                "iotsitewise:ListCompositionRelationships",
                "iotsitewise:ListComputationModelDataBindingUsages",
                "iotsitewise:ListComputationModelResolveToResources",
                "iotsitewise:ListComputationModels",
                "iotsitewise:ListDashboards",
                "iotsitewise:ListDatasets",
                "iotsitewise:ListExecutions",
                "iotsitewise:ListGateways",
                "iotsitewise:ListInterfaceRelationships",
                "iotsitewise:ListPortals",
                "iotsitewise:ListProjectAssets",
                "iotsitewise:ListProjects",
                "iotsitewise:ListTagsForResource",
                "iotsitewise:ListTimeSeries"
            ],
            "Resource": "*"
        }
    ]
}

Amazon托管策略： AWSServiceRoleForIoTSiteWise

AWSServiceRoleForIoTSiteWise 角色获得下列权限使用 AWSServiceRoleForIoTSiteWise 策略。本策略：

  • Amazon IoT SiteWise允许部署 SiteWise Edge 网关（在上运行Amazon IoT Greengrass）。

  • Amazon IoT SiteWise允许执行日志记录。

  • Amazon IoT SiteWise允许对Amazon IoT TwinMaker数据库运行元数据搜索查询。

如果您Amazon IoT SiteWise使用的是单个用户账户，则该AWSServiceRoleForIoTSiteWise角色将在您的 IAM 账户中创建AWSServiceRoleForIoTSiteWise策略，并将其附加到的AWSServiceRoleForIoTSiteWiseService-linked Amazon IoT SiteWise角色中。

JSON

{
	"Version":"2012-10-17",
	"Statement": [
		{
			"Sid": "AllowSiteWiseReadGreenGrass",
			"Effect": "Allow",
			"Action": [
				"greengrass:GetAssociatedRole",
				"greengrass:GetCoreDefinition",
				"greengrass:GetCoreDefinitionVersion",
				"greengrass:GetGroup",
				"greengrass:GetGroupVersion"
			],
			"Resource": "*"
		},
		{
			"Sid": "AllowSiteWiseAccessLogGroup",
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogGroup",
				"logs:DescribeLogGroups"
			],
			"Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*"
		},
		{
			"Sid": "AllowSiteWiseAccessLog",
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogStream",
				"logs:DescribeLogStreams",
				"logs:PutLogEvents"
			],
			"Resource": "arn:aws:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*"
		},
		{
			"Sid": "AllowSiteWiseAccessSiteWiseManagedWorkspaceInTwinMaker",
			"Effect": "Allow",
			"Action": [
				"iottwinmaker:GetWorkspace",
				"iottwinmaker:ExecuteQuery"
			],
			"Resource": "arn:aws:iottwinmaker:*:*:workspace/*",
			"Condition": {
				"ForAnyValue:StringEquals": {
					"iottwinmaker:linkedServices": [
						"IOTSITEWISE"
					]
				}
			}
		}
	]
}
JSON

{
	"Version":"2012-10-17",
	"Statement": [
		{
			"Sid": "AllowSiteWiseReadGreenGrass",
			"Effect": "Allow",
			"Action": [
				"greengrass:GetAssociatedRole",
				"greengrass:GetCoreDefinition",
				"greengrass:GetCoreDefinitionVersion",
				"greengrass:GetGroup",
				"greengrass:GetGroupVersion"
			],
			"Resource": "*"
		},
		{
			"Sid": "AllowSiteWiseAccessLogGroup",
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogGroup",
				"logs:DescribeLogGroups"
			],
			"Resource": "arn:aws-us-gov:logs:*:*:log-group:/aws/iotsitewise*"
		},
		{
			"Sid": "AllowSiteWiseAccessLog",
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogStream",
				"logs:DescribeLogStreams",
				"logs:PutLogEvents"
			],
			"Resource": "arn:aws-us-gov:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*"
		},
		{
			"Sid": "AllowSiteWiseAccessSiteWiseManagedWorkspaceInTwinMaker",
			"Effect": "Allow",
			"Action": [
				"iottwinmaker:GetWorkspace",
				"iottwinmaker:ExecuteQuery"
			],
			"Resource": "arn:aws-us-gov:iottwinmaker:*:*:workspace/*",
			"Condition": {
				"ForAnyValue:StringEquals": {
					"iottwinmaker:linkedServices": [
						"IOTSITEWISE"
					]
				}
			}
		}
	]
}
JSON

{
	"Version":"2012-10-17",
	"Statement": [
		{
			"Sid": "AllowSiteWiseReadGreenGrass",
			"Effect": "Allow",
			"Action": [
				"greengrass:GetAssociatedRole",
				"greengrass:GetCoreDefinition",
				"greengrass:GetCoreDefinitionVersion",
				"greengrass:GetGroup",
				"greengrass:GetGroupVersion"
			],
			"Resource": "*"
		},
		{
			"Sid": "AllowSiteWiseAccessLogGroup",
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogGroup",
				"logs:DescribeLogGroups"
			],
			"Resource": "arn:aws-cn:logs:*:*:log-group:/aws/iotsitewise*"
		},
		{
			"Sid": "AllowSiteWiseAccessLog",
			"Effect": "Allow",
			"Action": [
				"logs:CreateLogStream",
				"logs:DescribeLogStreams",
				"logs:PutLogEvents"
			],
			"Resource": "arn:aws-cn:logs:*:*:log-group:/aws/iotsitewise*:log-stream:*"
		},
		{
			"Sid": "AllowSiteWiseAccessSiteWiseManagedWorkspaceInTwinMaker",
			"Effect": "Allow",
			"Action": [
				"iottwinmaker:GetWorkspace",
				"iottwinmaker:ExecuteQuery"
			],
			"Resource": "arn:aws-cn:iottwinmaker:*:*:workspace/*",
			"Condition": {
				"ForAnyValue:StringEquals": {
					"iottwinmaker:linkedServices": [
						"IOTSITEWISE"
					]
				}
			}
		}
	]
}

Amazon IoT SiteWise更新到Amazon托管策略

您可以查看有关Amazon托管策略更新的详细信息Amazon IoT SiteWise，从该服务开始跟踪更改时开始。要获得有关此页面变更的自动提醒，请订阅 “Amazon IoT SiteWise文档历史记录” 页面上的 RSS feed。

更改 描述 日期

AWSServiceRoleForIoTSiteWise：对现有策略的更新

Amazon IoT SiteWise现在可以对Amazon IoT TwinMaker数据库运行元数据搜索查询。

 2023 年 11 月 6 日

AWSIoTSiteWiseReadOnlyAccess：对现有策略的更新

Amazon IoT SiteWise添加了新的策略前缀BatchGet*，使您可以执行批量读取操作。

 2022 年 9 月 16 日

AWSIoTSiteWiseReadOnlyAccess：新策略

Amazon IoT SiteWise添加了授予只读访问权限的新策略Amazon IoT SiteWise。

 2021 年 11 月 24 日

Amazon IoT SiteWise开始跟踪更改

Amazon IoT SiteWise开始跟踪其Amazon托管策略的更改。

 2021 年 11 月 24 日