• Amazon Systems Manager CloudWatch 控制面板在 2026 年 4 月 30 日之后将不再可用。客户可以像现在一样继续使用 Amazon CloudWatch 控制台来查看、创建和管理其 Amazon CloudWatch 控制面板。有关更多信息，请参阅 [Amazon CloudWatch 控制面板文档](https://docs.amazonaws.cn/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html)。

# 为 Systems Manager Application Manager 配置权限
<a name="application-manager-getting-started-permissions"></a>

如果您的 Amazon Identity and Access Management（IAM）实体（如用户、组或角色）有权访问本主题中列出的 API 操作，则您可以使用 Application Manager（Amazon Systems Manager 中的一项工具）的所有功能。API 操作分为两个表，以帮助您理解它们执行的不同功能。

下表列出了 Systems Manager 您在 Application Manager 中选择资源时调用的 API 操作，因为您希望查看资源详细信息。例如，如果 Application Manager 列出了 Amazon EC2 Auto Scaling 组，而您选择该组查看其详细信息，Systems Manager 会调用 `autoscaling:DescribeAutoScalingGroups` API 操作。如果您的账户中没有任何 Auto Scaling 组，则不会从 Application Manager 中调用此 API。


****  

| 仅资源详细信息 | 
| --- | 
|  <pre>acm:DescribeCertificate <br />acm:ListTagsForCertificate<br />autoscaling:DescribeAutoScalingGroups <br />cloudfront:GetDistribution<br />cloudfront:ListTagsForResource <br />cloudtrail:DescribeTrails<br />cloudtrail:ListTags <br />cloudtrail:LookupEvents<br />codebuild:BatchGetProjects <br />codepipeline:GetPipeline<br />codepipeline:ListTagsForResource <br />dynamodb:DescribeTable<br />dynamodb:ListTagsOfResource <br />ec2:DescribeAddresses<br />ec2:DescribeCustomerGateways <br />ec2:DescribeHosts<br />ec2:DescribeInternetGateways <br />ec2:DescribeNetworkAcls<br />ec2:DescribeNetworkInterfaces <br />ec2:DescribeRouteTables<br />ec2:DescribeSecurityGroups <br />ec2:DescribeSubnets<br />ec2:DescribeVolumes <br />ec2:DescribeVpcs <br />ec2:DescribeVpnConnections<br />ec2:DescribeVpnGateways <br />elasticbeanstalk:DescribeApplications<br />elasticbeanstalk:ListTagsForResource<br />elasticloadbalancing:DescribeInstanceHealth<br />elasticloadbalancing:DescribeListeners<br />elasticloadbalancing:DescribeLoadBalancers<br />elasticloadbalancing:DescribeTags <br />iam:GetGroup <br />iam:GetPolicy<br />iam:GetRole <br />iam:GetUser <br />lambda:GetFunction<br />rds:DescribeDBClusters <br />rds:DescribeDBInstances<br />rds:DescribeDBSecurityGroups <br />rds:DescribeDBSnapshots<br />rds:DescribeDBSubnetGroups <br />rds:DescribeEventSubscriptions<br />rds:ListTagsForResource <br />redshift:DescribeClusterParameters<br />redshift:DescribeClusterSecurityGroups<br />redshift:DescribeClusterSnapshots<br />redshift:DescribeClusterSubnetGroups <br />redshift:DescribeClusters<br />s3:GetBucketTagging</pre>  | 

下表列出了 Systems Manager 用于更改 Application Manager 中所列应用程序和资源或查看所选应用程序或资源的操作信息的 API 操作。


****  

| 申请操作和详细信息 | 
| --- | 
|  <pre><br />applicationinsights:CreateApplication<br />applicationinsights:DescribeApplication<br />applicationinsights:ListProblems<br />ce:GetCostAndUsage<br />ce:GetTags<br />ce:ListCostAllocationTags<br />ce:UpdateCostAllocationTagsStatus<br />cloudformation:CreateStack<br />cloudformation:DeleteStack<br />cloudformation:DescribeStackDriftDetectionStatus<br />cloudformation:DescribeStackEvents<br />cloudformation:DescribeStacks<br />cloudformation:DetectStackDrift<br />cloudformation:GetTemplate<br />cloudformation:GetTemplateSummary<br />cloudformation:ListStacks<br />cloudformation:UpdateStack<br />cloudwatch:DescribeAlarms<br />cloudwatch:DescribeInsightRules<br />cloudwatch:DisableAlarmActions<br />cloudwatch:EnableAlarmActions<br />cloudwatch:GetMetricData<br />cloudwatch:ListTagsForResource<br />cloudwatch:PutMetricAlarm<br />config:DescribeComplianceByConfigRule<br />config:DescribeComplianceByResource<br />config:DescribeConfigRules<br />config:DescribeRemediationConfigurations<br />config:GetComplianceDetailsByConfigRule<br />config:GetComplianceDetailsByResource<br />config:GetResourceConfigHistory<br />config:ListDiscoveredResources<br />config:PutRemediationConfigurations<br />config:SelectResourceConfig<br />config:StartConfigRulesEvaluation<br />config:StartRemediationExecution<br />ec2:DescribeInstances<br />ecs:DescribeCapacityProviders<br />ecs:DescribeClusters<br />ecs:DescribeContainerInstances<br />ecs:ListClusters<br />ecs:ListContainerInstances<br />ecs:TagResource<br />eks:DescribeCluster<br />eks:DescribeFargateProfile<br />eks:DescribeNodegroup<br />eks:ListClusters<br />eks:ListFargateProfiles<br />eks:ListNodegroups<br />eks:TagResource<br />iam:CreateServiceLinkedRole<br />iam:ListRoles<br />logs:DescribeLogGroups<br />resource-groups:CreateGroup<br />resource-groups:DeleteGroup<br />resource-groups:GetGroup<br />resource-groups:GetGroupQuery<br />resource-groups:GetTags<br />resource-groups:ListGroupResources<br />resource-groups:ListGroups<br />resource-groups:Tag<br />resource-groups:Untag<br />resource-groups:UpdateGroup<br />s3:ListAllMyBuckets<br />s3:ListBucket<br />s3:ListBucketVersions<br />servicecatalog:GetApplication<br />servicecatalog:ListApplications<br />sns:CreateTopic<br />sns:ListSubscriptionsByTopic<br />sns:ListTopics<br />sns:Subscribe<br />ssm:AddTagsToResource<br />ssm:CreateDocument<br />ssm:CreateOpsMetadata<br />ssm:DeleteDocument<br />ssm:DeleteOpsMetadata<br />ssm:DescribeAssociation<br />ssm:DescribeAutomationExecutions<br />ssm:DescribeDocument<br />ssm:DescribeDocumentPermission<br />ssm:GetDocument<br />ssm:GetInventory<br />ssm:GetOpsMetadata<br />ssm:GetOpsSummary<br />ssm:GetServiceSetting<br />ssm:ListAssociations<br />ssm:ListComplianceItems<br />ssm:ListDocuments<br />ssm:ListDocumentVersions<br />ssm:ListOpsMetadata<br />ssm:ListResourceComplianceSummaries<br />ssm:ListTagsForResource<br />ssm:ModifyDocumentPermission<br />ssm:RemoveTagsFromResource<br />ssm:StartAssociationsOnce<br />ssm:StartAutomationExecution<br />ssm:UpdateDocument<br />ssm:UpdateDocumentDefaultVersion<br />ssm:UpdateOpsItem<br />ssm:UpdateOpsMetadata<br />ssm:UpdateServiceSetting<br />tag:GetTagKeys<br />tag:GetTagValues<br />tag:TagResources<br />tag:UntagResources</pre>  | 

## 所有 Application Manager 权限的策略示例
<a name="application-manager-getting-started-user-permissions"></a>

要为 IAM 实体（如用户、组或角色）配置 Application Manager 权限，请使用以下示例创建 IAM policy。此策略示例包括 Application Manager 使用的所有 API 操作。

------
#### [ JSON ]

****  

```
                    {
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acm:DescribeCertificate",
                "acm:ListTagsForCertificate",
                "applicationinsights:CreateApplication",
                "applicationinsights:DescribeApplication",
                "applicationinsights:ListProblems",
                "autoscaling:DescribeAutoScalingGroups",
                "ce:GetCostAndUsage",
                "ce:GetTags",
                "ce:ListCostAllocationTags",
                "ce:UpdateCostAllocationTagsStatus",
                "cloudformation:CreateStack",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStackDriftDetectionStatus",
                "cloudformation:DescribeStackEvents",
                "cloudformation:DescribeStacks",
                "cloudformation:DetectStackDrift",
                "cloudformation:GetTemplate",
                "cloudformation:GetTemplateSummary",
                "cloudformation:ListStacks",
                "cloudformation:ListStackResources",
                "cloudformation:UpdateStack",
                "cloudfront:GetDistribution",
                "cloudfront:ListTagsForResource",
                "cloudtrail:DescribeTrails",
                "cloudtrail:ListTags",
                "cloudtrail:LookupEvents",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DescribeInsightRules",
                "cloudwatch:DisableAlarmActions",
                "cloudwatch:EnableAlarmActions",
                "cloudwatch:GetMetricData",
                "cloudwatch:ListTagsForResource",
                "cloudwatch:PutMetricAlarm",
                "codebuild:BatchGetProjects",
                "codepipeline:GetPipeline",
                "codepipeline:ListTagsForResource",
                "config:DescribeComplianceByConfigRule",
                "config:DescribeComplianceByResource",
                "config:DescribeConfigRules",
                "config:DescribeRemediationConfigurations",
                "config:GetComplianceDetailsByConfigRule",
                "config:GetComplianceDetailsByResource",
                "config:GetResourceConfigHistory",
                "config:ListDiscoveredResources",
                "config:PutRemediationConfigurations",
                "config:SelectResourceConfig",
                "config:StartConfigRulesEvaluation",
                "config:StartRemediationExecution",
                "dynamodb:DescribeTable",
                "dynamodb:ListTagsOfResource",
                "ec2:DescribeAddresses",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeHosts",
                "ec2:DescribeInstances",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeVpnGateways",
                "ecs:DescribeCapacityProviders",
                "ecs:DescribeClusters",
                "ecs:DescribeContainerInstances",
                "ecs:ListClusters",
                "ecs:ListContainerInstances",
                "ecs:TagResource",
                "eks:DescribeCluster",
                "eks:DescribeFargateProfile",
                "eks:DescribeNodegroup",
                "eks:ListClusters",
                "eks:ListFargateProfiles",
                "eks:ListNodegroups",
                "eks:TagResource",
                "elasticbeanstalk:DescribeApplications",
                "elasticbeanstalk:ListTagsForResource",
                "elasticloadbalancing:DescribeInstanceHealth",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags",
                "iam:CreateServiceLinkedRole",
                "iam:GetGroup",
                "iam:GetPolicy",
                "iam:GetRole",
                "iam:GetUser",
                "iam:ListRoles",
                "lambda:GetFunction",
                "logs:DescribeLogGroups",
                "rds:DescribeDBClusters",
                "rds:DescribeDBInstances",
                "rds:DescribeDBSecurityGroups",
                "rds:DescribeDBSnapshots",
                "rds:DescribeDBSubnetGroups",
                "rds:DescribeEventSubscriptions",
                "rds:ListTagsForResource",
                "redshift:DescribeClusterParameters",
                "redshift:DescribeClusters",
                "redshift:DescribeClusterSecurityGroups",
                "redshift:DescribeClusterSnapshots",
                "redshift:DescribeClusterSubnetGroups",
                "resource-groups:CreateGroup",
                "resource-groups:DeleteGroup",
                "resource-groups:GetGroup",
                "resource-groups:GetGroupQuery",
                "resource-groups:GetTags",
                "resource-groups:ListGroupResources",
                "resource-groups:ListGroups",
                "resource-groups:Tag",
                "resource-groups:Untag",
                "resource-groups:UpdateGroup",
                "s3:GetBucketTagging",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "servicecatalog:GetApplication",
                "servicecatalog:ListApplications",
                "sns:CreateTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:Subscribe",
                "ssm:AddTagsToResource",
                "ssm:CreateDocument",
                "ssm:CreateOpsMetadata",
                "ssm:DeleteDocument",
                "ssm:DeleteOpsMetadata",
                "ssm:DescribeAssociation",
                "ssm:DescribeAutomationExecutions",
                "ssm:DescribeDocument",
                "ssm:DescribeDocumentPermission",
                "ssm:GetDocument",
                "ssm:GetInventory",
                "ssm:GetOpsMetadata",
                "ssm:GetOpsSummary",
                "ssm:GetServiceSetting",
                "ssm:ListAssociations",
                "ssm:ListComplianceItems",
                "ssm:ListDocuments",
                "ssm:ListDocumentVersions",
                "ssm:ListOpsMetadata",
                "ssm:ListResourceComplianceSummaries",
                "ssm:ListTagsForResource",
                "ssm:ModifyDocumentPermission",
                "ssm:RemoveTagsFromResource",
                "ssm:StartAssociationsOnce",
                "ssm:StartAutomationExecution",
                "ssm:UpdateDocument",
                "ssm:UpdateDocumentDefaultVersion",
                "ssm:UpdateOpsMetadata",
                "ssm:UpdateOpsItem",
                "ssm:UpdateServiceSetting",
                "tag:GetResources",
                "tag:GetTagKeys",
                "tag:GetTagValues",
                "tag:TagResources",
                "tag:UntagResources"
            ],
            "Resource": "*"
        }
    ]
}
```

------

**注意**  
您可以限制用户在 Application Manager 中对应用程序和资源的进行修改的能力，方法是从附加到其用户、组或角色的 IAM 权限策略中删除以下 API 操作。删除这些操作会在 Application Manager 中创建一个只读体验。以下是允许用户更改应用程序或其他相关资源的所有 API。  

```
applicationinsights:CreateApplication
ce:UpdateCostAllocationTagsStatus
cloudformation:CreateStack
cloudformation:DeleteStack
cloudformation:UpdateStack
cloudwatch:DisableAlarmActions
cloudwatch:EnableAlarmActions
cloudwatch:PutMetricAlarm
config:PutRemediationConfigurations
config:StartConfigRulesEvaluation
config:StartRemediationExecution
ecs:TagResource
eks:TagResource
iam:CreateServiceLinkedRole
resource-groups:CreateGroup
resource-groups:DeleteGroup
resource-groups:Tag
resource-groups:Untag
resource-groups:UpdateGroup
sns:CreateTopic
sns:Subscribe
ssm:AddTagsToResource
ssm:CreateDocument
ssm:CreateOpsMetadata
ssm:DeleteDocument
ssm:DeleteOpsMetadata
ssm:ModifyDocumentPermission
ssm:RemoveTagsFromResource
ssm:StartAssociationsOnce
ssm:StartAutomationExecution
ssm:UpdateDocument
ssm:UpdateDocumentDefaultVersion
ssm:UpdateOpsMetadata
ssm:UpdateOpsItem
ssm:UpdateServiceSetting
tag:TagResources
tag:UntagResources
```

有关如何创建 IAM policy 的信息，请参阅 *IAM 用户指南*中的[创建 IAM policy](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies_create.html)。有关如何将此策略分配给 IAM 实体（如用户、组或角色）的信息，请参阅[添加和删除 IAM 身份权限](https://docs.amazonaws.cn/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)。