使用 Amazon Q 为即时节点访问创建审批策略

使用适用于命令行的 Amazon Q 创建审批策略

1. 打开您的终端并开始与 Amazon Q 的会话。

   $ q chat

2. 输入提示并描述要创建的策略语句类型。例如，使用前面所述的审批策略场景，您可以输入以下提示：

   Create a Cedar policy statement that allows a principal to use the “getTokenForInstanceAccess" action for a resource 
   that has a tag key “Environment” and tag value of “Testing”. Use the following example statement for reference to verify the syntax.
   
   permit (
       principal in Amazon::IdentityStore::Group::"e8c17310-e011-7089-d989-10da1EXAMPLE",
       action == Amazon::SSM::Action::"getTokenForInstanceAccess",
       resource
   )
   when {
       principal has organization && resource.hasTag("Engineering") && resource.hasTag("Production") && principal.organization == "Platform"
   };
   
   The Cedar policy statement you create must be valid. Validate the Cedar statement using the Amazon documentation provided for just-in-time node access policy statement structure and make sure you abide by the schema.

3. 输入此示例提示会得到以下输出：

   Based on the Amazon documentation for Cedar policy statements and the examples provided, I'll create a valid Cedar policy 
   statement that allows a principal to use the "getTokenForInstanceAccess" action for resources with the tag key "Environment" and tag value "Testing".
                               
   Here's the Cedar policy statement:
   
   permit (
       principal,
       action == Amazon::SSM::Action::"getTokenForInstanceAccess",
       resource
   )
   when {
       resource.hasTag("Environment") &&
       resource.getTag("Environment") == "Testing"
   };
   
   
   This policy statement:
   1. Uses the permit effect to allow access
   2. Applies to any principal (since no specific principal is defined)
   3. Specifically targets the "getTokenForInstanceAccess" action
   4. Applies to resources that have a tag with key "Environment" and value "Testing"
   5. Uses the proper syntax for the condition clause with the hasTag() and getTag() operators
   
   The statement follows the Cedar policy language structure as documented in the Amazon Systems Manager documentation for just-in-time node access policies.

4. 将策略语句粘贴到新的 Cedar 文件中以验证语法。您也可以使用 Cedar 操场来验证语句。

5. 验证语句后，保存 Cedar 文件。

6. 在您的终端上，运行以下 Amazon CLI 命令，使用您的策略内容创建 SSM 文档。在生产环境中使用审批策略之前，请使用 Amazon Web Services 账户 和 Amazon Web Services 区域 中的身份和节点子集测试您的审批策略。

   注意

   对于自动审批策略，文档名称必须为 SSM-JustInTimeAccessAutoApprovalPolicy。每个 Amazon Web Services 账户 和 Amazon Web Services 区域 只能有一个自动审批策略。对于拒绝访问策略，文档名称必须为 SSM-JustInTimeAccessDenyAccessOrgPolicy。每个 Amazon Organizations 组织只能有一个拒绝访问策略，并且该策略必须在 Systems Manager 的委派管理员账户中创建。手动审批策略的命名限制与其他 SSM 文档相同。有关更多信息，请参阅 CreateDocument。

   Linux & macOS

   aws ssm create-document \
       --content file://path/to/file/policyContent.cedar \
       --name "SSM-JustInTimeAccessAutoApprovalPolicy" \
       --document-type "AutoApproval"

   Windows

   aws ssm create-document ^
       --content file://C:\path\to\file\policyContent.cedar ^
       --name "SSM-JustInTimeAccessAutoApprovalPolicy" ^
       --document-type "AutoApproval"

   PowerShell

   $cedar = Get-Content -Path "C:\path\to\file\policyContent.cedar" | Out-String
   New-SSMDocument `
       -Content $cedar `
       -Name "SSM-JustInTimeAccessAutoApprovalPolicy" `
       -DocumentType "AutoApproval"