amazon-web-services - 基于时间框架的 IAM 用户限制

Question

我有一个要求，我必须允许 AWS IAM 用户仅在特定时间范围内的特定日期访问 AWS 控制台。谁能告诉我如何在政策中实现这一点

Answer 1

可选Condition IAM Policy 中的元素让您指定政策何时生效的条件:

In the Condition element, you build expressions in which you use Boolean operators (equal, less than, etc.) to match your condition against values in the request. Condition values can include date, time, the IP address of the requester, the ARN of the request source, the user name, user ID, and the user agent of the requester. [...] [emphasis mine]

提供的示例使用DateLessThan 条件和aws:CurrentTime 键来指定必须在2013 年6 月30 日之前收到请求 :

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "iam:*AccessKey*",
    "Resource": "arn:aws:iam::ACCOUNT-ID-WITHOUT-HYPHENS:user/*",
    "Condition": {"DateLessThan": {"aws:CurrentTime": "2013-06-30T00:00:00Z"}}
  }
}

如这里所示，不幸的是，这只适用于与绝对日期相关的条件，而不是说一个 cron 表达式或类似的东西来指定一天中的特定时间或一周中的几天:

Date conditions let you restrict access based on comparing a key to a date/time value. You use these conditions with the aws:CurrentTime key or aws:EpochTime keys. You must specify date/time values with one of the W3C implementations of the ISO 8601 date formats or in epoch (UNIX) time.

假设这实际上是您的用例，您需要使用一些自动化来包装条件管理，以根据您的要求以滚动方式更新政策中的绝对 ISO 8601 日期。