示例:管理组织备份策略所需的合并权限 - Amazon Organizations
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅 中国的 Amazon Web Services 服务入门 (PDF)

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

示例:管理组织备份策略所需的合并权限

此示例说明如何创建基于资源的委托策略,该策略允许管理账户委托管理组织内部备份策略所需的全部权限,包括 createreadupdatedelete 操作以及 attachdetach 策略操作。要了解每项操作、资源和条件的重要性,请参阅 基于资源的委托策略示例

重要

此策略允许委托管理员对组织中任何账户(包括管理账户)创建的策略执行指定操作。

此示例委托策略授予以编程方式通过 Amazon API 或 Amazon CLI 完成此操作的必要权限。要使用此委托策略,请用您自己的信息替换 MemberAccountIdManagementAccountIdOrganizationIdRootId 的 Amazon 占位符文本。然后,按照 Amazon Organizations 的委托管理员 中的说明进行操作。

{ "Version": "2012-10-17", "Statement": [ { "Sid": "DelegatingNecessaryDescribeListActions", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::MemberAccountId:root" }, "Action": [ "organizations:DescribeOrganization", "organizations:DescribeOrganizationalUnit", "organizations:DescribeAccount", "organizations:DescribePolicy", "organizations:DescribeEffectivePolicy", "organizations:ListRoots", "organizations:ListOrganizationalUnitsForParent", "organizations:ListParents", "organizations:ListChildren", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListPolicies", "organizations:ListPoliciesForTarget", "organizations:ListTargetsForPolicy", "organizations:ListTagsForResource" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "organizations:PolicyType": "BACKUP_POLICY" } } }, { "Sid": "DelegatingAllActionsForBackupPolicies", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::MemberAccountId:root" }, "Action": [ "organizations:CreatePolicy", "organizations:UpdatePolicy", "organizations:DeletePolicy", "organizations:AttachPolicy", "organizations:DetachPolicy", "organizations:EnablePolicyType", "organizations:DisablePolicyType" ], "Resource": [ "arn:aws:organizations::ManagementAccountId:root/o-OrganizationId/r-RootId", "arn:aws:organizations::ManagementAccountId:ou/o-OrganizationId/*", "arn:aws:organizations::ManagementAccountId:account/o-OrganizationId/*", "arn:aws:organizations::ManagementAccountId:policy/o-OrganizationId/backup_policy/*" ] } ] }