设置 Systems Manager 控制台访问
要 Amazon Systems Manager在中使用 Amazon Web Services Management Console，您必须配置正确的权限。
有关如何创建 Amazon Identity and Access Management 策略并将其附加到 IAM 身份的更多信息，请参阅《IAM 用户指南》中的创建 IAM 策略
Systems Manager 载入策略
您可以创建一个如以下示例所示的 IAM 策略，并将该策略附加到您的 IAM 身份。此策略授予对载入到 Systems Manager 并对其进行配置的完全访问权限。
权限详细信息
该策略包含以下权限。
-
ssm-quicksetup：允许主体访问所有 Amazon Systems Manager 快速设置功能 操作。 -
ssm：允许主体访问 Systems Manager Automation 和资源探索器。 -
organizations：允许主体读取 Amazon Organizations 中组织的结构，并在委派管理员以组织身份载入 Systems Manager 时管理委派管理员。 -
cloudformation：允许主体管理其Quick Setup堆栈。 -
iam：允许主体管理 Systems Manager 载入所需的 IAM 角色和策略。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "QuickSetupActions", "Effect": "Allow", "Action": [ "ssm-quicksetup:*" ], "Resource": "*" }, { "Sid": "SsmReadOnly", "Effect": "Allow", "Action": [ "ssm:DescribeAutomationExecutions", "ssm:GetAutomationExecution", "ssm:ListAssociations", "ssm:DescribeAssociation", "ssm:ListDocuments", "ssm:ListResourceDataSync", "ssm:DescribePatchBaselines", "ssm:GetPatchBaseline", "ssm:DescribeMaintenanceWindows", "ssm:DescribeMaintenanceWindowTasks" ], "Resource": "*" }, { "Sid": "SsmDocument", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource": [ "arn:aws:ssm:*:*:document/AWSQuickSetupType-*", "arn:aws:ssm:*:*:document/AWS-EnableExplorer" ] }, { "Sid": "SsmEnableExplorer", "Effect": "Allow", "Action": "ssm:StartAutomationExecution", "Resource": "arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer:*" }, { "Sid": "SsmExplorerRds", "Effect": "Allow", "Action": [ "ssm:GetOpsSummary", "ssm:CreateResourceDataSync", "ssm:UpdateResourceDataSync" ], "Resource": "arn:aws:ssm:*:*:resource-data-sync/AWS-QuickSetup-*" }, { "Sid": "OrgsReadOnly", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:DescribeOrganizationalUnit", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" }, { "Sid": "OrgsAdministration", "Effect": "Allow", "Action": [ "organizations:EnableAWSServiceAccess", "organizations:RegisterDelegatedAdministrator", "organizations:DeregisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": [ "ssm.amazonaws.com", "ssm-quicksetup.amazonaws.com", "member.org.stacksets.cloudformation.amazonaws.com", "resource-explorer-2.amazonaws.com" ] } } }, { "Sid": "CfnReadOnly", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:DescribeStacks", "cloudformation:ListStackSets", "cloudformation:DescribeOrganizationsAccess" ], "Resource": "*" }, { "Sid": "OrgCfnAccess", "Effect": "Allow", "Action": [ "cloudformation:ActivateOrganizationsAccess" ], "Resource": "*" }, { "Sid": "CfnStackActions", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackResources", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:RollbackStack", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateStack" ], "Resource": [ "arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:stack/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:type/resource/*" ] }, { "Sid": "CfnStackSetActions", "Effect": "Allow", "Action": [ "cloudformation:CreateStackInstances", "cloudformation:CreateStackSet", "cloudformation:DeleteStackInstances", "cloudformation:DeleteStackSet", "cloudformation:DescribeStackInstance", "cloudformation:DetectStackSetDrift", "cloudformation:ListStackInstanceResourceDrifts", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults", "cloudformation:TagResource", "cloudformation:UntagResource", "cloudformation:UpdateStackSet" ], "Resource": [ "arn:aws:cloudformation:*:*:stackset/AWS-QuickSetup-*", "arn:aws:cloudformation:*:*:type/resource/*", "arn:aws:cloudformation:*:*:stackset-target/AWS-QuickSetup-*:*" ] }, { "Sid": "ValidationReadonlyActions", "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRole" ], "Resource": "*" }, { "Sid": "IamRolesMgmt", "Effect": "Allow", "Action": [ "iam:CreateRole", "iam:DeleteRole", "iam:GetRole", "iam:AttachRolePolicy", "iam:DetachRolePolicy", "iam:GetRolePolicy", "iam:ListRolePolicies" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/service-role/AWS-QuickSetup-*" ] }, { "Sid": "IamPassRole", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/service-role/AWS-QuickSetup-*" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com", "ssm-quicksetup.amazonaws.com", "cloudformation.amazonaws.com" ] } } }, { "Sid": "IamRolesPoliciesMgmt", "Effect": "Allow", "Action": [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/service-role/AWS-QuickSetup-*" ], "Condition": { "ArnEquals": { "iam:PolicyARN": [ "arn:aws:iam::aws:policy/AWSSystemsManagerEnableExplorerExecutionPolicy", "arn:aws:iam::aws:policy/AWSQuickSetupSSMDeploymentRolePolicy" ] } } }, { "Sid": "CfnStackSetsSLR", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/stacksets.cloudformation.amazonaws.com/AWSServiceRoleForCloudFormationStackSetsOrgAdmin", "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM", "arn:aws:iam::*:role/aws-service-role/accountdiscovery.ssm.amazonaws.com/AWSServiceRoleForAmazonSSM_AccountDiscovery", "arn:aws:iam::*:role/aws-service-role/ssm-quicksetup.amazonaws.com/AWSServiceRoleForSSMQuickSetup", "arn:aws:iam::*:role/aws-service-role/resource-explorer-2.amazonaws.com/AWSServiceRoleForResourceExplorer" ] } ] }
Amazon Systems Manager 控制台操作员策略
您可以创建一个如以下示例所示的 IAM 策略，并将该策略附加到您的 IAM 身份。此策略授予操作 Systems Manager 的完全访问权限，并允许 Systems Manager 运行自动化文档来进行诊断和修复。
权限详细信息
该策略包含以下权限。
-
ssm：允许主体访问所有 Systems Manager API。 -
ssm-quicksetup：允许主体管理其Quick Setup配置。 -
ec2：允许 Systems Manager 确定您启用的 Amazon Web Services 区域和 Amazon EC2 实例状态。 -
cloudformation：允许主体读取其Quick Setup堆栈。 -
organizations：允许主体读取 Amazon Organizations 中组织的结构，并在委派管理员以组织身份载入 Systems Manager 时管理委派管理员。 -
s3：允许主体列出并获取 Amazon S3 存储桶中的对象以进行诊断，该存储桶是在 Systems Manager 载入过程中创建的。 -
iam:PassRole：允许主体在运行自动化来诊断和修复非托管节点时将要代入的角色传递给 Systems Manager。 -
iam:GetRole：允许主体在 Systems Manager 中工作时获取Quick Setup角色的特定角色信息。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:*", "ssm-quicksetup:*" ], "Resource": "*" }, { "Sid": "AllowEC2DescribeActions", "Effect": "Allow", "Action": [ "ec2:DescribeInstanceStatus", "ec2:DescribeInstances", "ec2:DescribeRegions" ], "Resource": "*" }, { "Sid": "CfnAccess", "Effect": "Allow", "Action": [ "cloudformation:ListStacks", "cloudformation:ListStackSets", "cloudformation:ListStackInstances", "cloudformation:ListStackSetOperations", "cloudformation:ListStackSetOperationResults", "cloudformation:DescribeStacks", "cloudformation:DescribeStackSet", "cloudformation:DescribeStackSetOperation", "cloudformation:DescribeOrganizationsAccess", "cloudformation:DescribeStackInstance", "cloudformation:DetectStackSetDrift", "cloudformation:ListStackInstanceResourceDrifts" ], "Resource": "*" }, { "Sid": "OrgsReadOnly", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListRoots", "organizations:ListParents", "organizations:ListOrganizationalUnitsForParent", "organizations:DescribeOrganizationalUnit", "organizations:ListAWSServiceAccessForOrganization" ], "Resource": "*" }, { "Sid": "AllowKMSOperations", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerManaged": "true" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Sid": "AllowReadS3BucketFromOrganization", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis*", "Condition": { "StringEquals": { "aws:ResourceOrgId": "${aws:PrincipalOrgId}" } } }, { "Sid": "AllowReadS3BucketFromSingleAccount", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": [ "arn:aws:iam::*:role/AWS-SSM-DiagnosisAdminRole*", "arn:aws:iam::*:role/AWS-SSM-DiagnosisExecutionRole*", "arn:aws:iam::*:role/AWS-SSM-RemediationAdminRole*", "arn:aws:iam::*:role/AWS-SSM-RemediationExecutionRole*" ], "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" } } }, { "Sid": "IamReadOnly", "Effect": "Allow", "Action": "iam:GetRole", "Resource": [ "arn:aws:iam::*:role/AWS-QuickSetup-*", "arn:aws:iam::*:role/service-role/AWS-QuickSetup-*" ] } ] }
Amazon Systems Manager 控制台操作员只读策略
您可以创建一个如以下示例所示的 IAM 策略，并将该策略附加到您的 IAM 身份。此策略授予使用 Systems Manager 的只读访问权限。
-
ssm：允许主体访问 Systems Manager 只读 API。 -
ssm-quicksetup：允许主体读取其Quick Setup配置。 -
cloudformation：允许主体读取其Quick Setup堆栈。 -
iam:GetRole：允许主体在使用 Systems Manager 时获取Quick Setup角色的特定角色信息。 -
ec2:DescribeRegions：允许 Systems Manager 确定已启用的 Amazon Web Services 区域。 -
organizations：允许主体在以组织身份载入 Systems Manager 时读取 Amazon Organizations 中组织的结构。 -
s3：允许主体列出并获取在 Systems Manager 载入过程中创建的 Amazon S3 存储桶中的对象。
权限详细信息
该策略包含以下权限。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:Describe*", "ssm:Get*", "ssm:List*", "ssm-quicksetup:List*", "ssm-quicksetup:Get*", "cloudformation:Describe*", "cloudformation:Get*", "cloudformation:List*", "iam:GetRole", "ec2:DescribeRegions", "organizations:Describe*", "organizations:List*" ], "Resource": "*" }, { "Sid": "AllowKMSOperations", "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceTag/SystemsManagerManaged": "true" }, "ArnLike": { "kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::do-not-delete-ssm-diagnosis-*" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" }, "Bool": { "aws:ViaAWSService": "true" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis*", "Condition": { "StringEquals": { "aws:ResourceOrgId": "${aws:PrincipalOrgId}" } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::do-not-delete-ssm-diagnosis*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }