适用于 Java 的 Amazon SDK 1.x于2025年12月31日达到支撑终止状态。我们建议您迁移到 [Amazon SDK for Java 2.x](https://docs.amazonaws.cn/sdk-for-java/latest/developer-guide/home.html) 以继续获得新功能、可用性改进和安全更新。 本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # 使用 IAM 策略 ## 创建策略 要创建新策略，请在 [CreatePolicyRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/CreatePolicyRequest.html) 中向 AmazonIdentityManagementClient 的 `createPolicy` 方法提供策略名称和 JSON 格式的策略文档。 **导入**。 ``` import com.amazonaws.services.identitymanagement.AmazonIdentityManagement; import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder; import com.amazonaws.services.identitymanagement.model.CreatePolicyRequest; import com.amazonaws.services.identitymanagement.model.CreatePolicyResult; ``` **代码** ``` final AmazonIdentityManagement iam = AmazonIdentityManagementClientBuilder.defaultClient(); CreatePolicyRequest request = new CreatePolicyRequest() .withPolicyName(policy_name) .withPolicyDocument(POLICY_DOCUMENT); CreatePolicyResult response = iam.createPolicy(request); ``` IAM policy 文档是使用[明确语法](https://docs.amazonaws.cn/IAM/latest/UserGuide/reference_policies_grammar.html)的 JSON 字符串。下面的示例中提供了向 DynamoDB 发出特定请求的访问权。 ``` public static final String POLICY_DOCUMENT = "{" + " \"Version\": \"2012-10-17\", " + " \"Statement\": [" + " {" + " \"Effect\": \"Allow\"," + " \"Action\": \"logs:CreateLogGroup\"," + " \"Resource\": \"%s\"" + " }," + " {" + " \"Effect\": \"Allow\"," + " \"Action\": [" + " \"dynamodb:DeleteItem\"," + " \"dynamodb:GetItem\"," + " \"dynamodb:PutItem\"," + " \"dynamodb:Scan\"," + " \"dynamodb:UpdateItem\"" + " ]," + " \"Resource\": \"RESOURCE_ARN\"" + " }" + " ]" + "}"; ``` 请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/CreatePolicy.java)。 ## 获取策略 要检索现有策略，请调用 AmazonIdentityManagementClient 的 `getPolicy` 方法，并在 [GetPolicyRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/GetPolicyRequest.html) 对象中提供策略的 ARN。 **导入**。 ``` import com.amazonaws.services.identitymanagement.AmazonIdentityManagement; import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder; import com.amazonaws.services.identitymanagement.model.GetPolicyRequest; import com.amazonaws.services.identitymanagement.model.GetPolicyResult; ``` **代码** ``` final AmazonIdentityManagement iam = AmazonIdentityManagementClientBuilder.defaultClient(); GetPolicyRequest request = new GetPolicyRequest() .withPolicyArn(policy_arn); GetPolicyResult response = iam.getPolicy(request); ``` 请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/GetPolicy.java)。 ## 附加角色策略 您可以通过调用 AmazonIdentityManagementClient 的 `attachRolePolicy` 方法，在 [AttachRolePolicyRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/AttachRolePolicyRequest.html) 中向其提供角色名称和策略 ARN 来将策略附加到 IAM 角色 (http://docs.aws.amazon.com/IAM/latest/UserGuide/id\_roles.html)。 **导入**。 ``` import com.amazonaws.services.identitymanagement.AmazonIdentityManagement; import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder; import com.amazonaws.services.identitymanagement.model.AttachRolePolicyRequest; import com.amazonaws.services.identitymanagement.model.AttachedPolicy; ``` **代码** ``` final AmazonIdentityManagement iam = AmazonIdentityManagementClientBuilder.defaultClient(); AttachRolePolicyRequest attach_request = new AttachRolePolicyRequest() .withRoleName(role_name) .withPolicyArn(POLICY_ARN); iam.attachRolePolicy(attach_request); ``` 请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/AttachRolePolicy.java)。 ## 列出附加的角色策略 通过调用 AmazonIdentityManagementClient 的 `listAttachedRolePolicies` 方法列出角色中附加的策略。这需要 [ListAttachedRolePoliciesRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/ListAttachedRolePoliciesRequest.html) 对象，它包含要列出策略的角色名称。 在返回的 [ListAttachedRolePoliciesResult](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/ListAttachedRolePoliciesResult.html) 对象中调用 `getAttachedPolicies` 来获取所附加策略的列表。如果 `ListAttachedRolePoliciesResult` 对象的 `getIsTruncated` 方法返回 `true`，调用 `ListAttachedRolePoliciesRequest` 对象的 `setMarker` 方法并使用其再次调用 `listAttachedRolePolicies` 来获取下一批结果，则结果可能被截断。 **导入**。 ``` import com.amazonaws.services.identitymanagement.AmazonIdentityManagement; import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder; import com.amazonaws.services.identitymanagement.model.ListAttachedRolePoliciesRequest; import com.amazonaws.services.identitymanagement.model.ListAttachedRolePoliciesResult; import java.util.ArrayList; import java.util.List; import java.util.stream.Collectors; ``` **代码** ``` final AmazonIdentityManagement iam = AmazonIdentityManagementClientBuilder.defaultClient(); ListAttachedRolePoliciesRequest request = new ListAttachedRolePoliciesRequest() .withRoleName(role_name); List matching_policies = new ArrayList<>(); boolean done = false; while(!done) { ListAttachedRolePoliciesResult response = iam.listAttachedRolePolicies(request); matching_policies.addAll( response.getAttachedPolicies() .stream() .filter(p -> p.getPolicyName().equals(role_name)) .collect(Collectors.toList())); if(!response.getIsTruncated()) { done = true; } request.setMarker(response.getMarker()); } ``` 请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/AttachRolePolicy.java)。 ## 分离角色策略 要从角色分离策略，请调用 AmazonIdentityManagementClient 的 `detachRolePolicy` 方法，并在 [DetachRolePolicyRequest](https://docs.amazonaws.cn/sdk-for-java/v1/reference/com/amazonaws/services/identitymanagement/model/DetachRolePolicyRequest.html) 中为其提供角色名称和策略 ARN。 **导入**。 ``` import com.amazonaws.services.identitymanagement.AmazonIdentityManagement; import com.amazonaws.services.identitymanagement.AmazonIdentityManagementClientBuilder; import com.amazonaws.services.identitymanagement.model.DetachRolePolicyRequest; import com.amazonaws.services.identitymanagement.model.DetachRolePolicyResult; ``` **代码** ``` final AmazonIdentityManagement iam = AmazonIdentityManagementClientBuilder.defaultClient(); DetachRolePolicyRequest request = new DetachRolePolicyRequest() .withRoleName(role_name) .withPolicyArn(policy_arn); DetachRolePolicyResult response = iam.detachRolePolicy(request); ``` 请参阅 GitHub 上的[完整示例](https://github.com/awsdocs/aws-doc-sdk-examples/blob/master/java/example_code/iam/src/main/java/aws/example/iam/DetachRolePolicy.java)。 ## 更多信息 + 《IAM 用户指南》中的 [IAM policy 概述](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies.html)。 + 《IAM 用户指南》中的 [Amazon IAM policy 参考](https://docs.amazonaws.cn/IAM/latest/UserGuide/reference_policies.html)。 + 《IAM API Reference》中的 [CreatePolicy](https://docs.amazonaws.cn/IAM/latest/APIReference/API_CreatePolicy.html) + 《IAM API Reference》中的 [GetPolicy](https://docs.amazonaws.cn/IAM/latest/APIReference/API_GetPolicy.html) + 《IAM API Reference》中的 [AttachRolePolicy](https://docs.amazonaws.cn/IAM/latest/APIReference/API_AttachRolePolicy.html) + 《IAM API Reference》中的 [ListAttachedRolePolicies](https://docs.amazonaws.cn/IAM/latest/APIReference/API_ListAttachedRolePolicies.html) + 《IAM API Reference》中的 [DetachRolePolicy](https://docs.amazonaws.cn/IAM/latest/APIReference/API_DetachRolePolicy.html)