amazon-web-services - 创建 IAM 角色并附加自定义策略

Question

我正在尝试使用 cloudformation 模板创建具有以下策略的新 IAM 角色。需要将 CW_NAMESPACE 和 LOG_GROUP_ARN 替换为实际值。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "cloudwatch:PutMetricData",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "cloudwatch:namespace": "CW_NAMESPACE"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogStreams",
        "logs:DescribeLogGroups"
      ],
      "Resource": "LOG_GROUP_ARN"
    }
  ]
}

任何有关如何使用模板自动创建角色的建议将不胜感激。

我在这里找到了这个模板...

https://cloudonaut.io/seamless-ec2-monitoring-with-the-unified-cloudwatch-agent/

Answer 1

以下是如何在 CloudFormation 模板中创建 IAM 角色的示例。

Yaml

Resources:

  LambdaLoadInventoryRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: Lambda-Load-Inventory-Role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
        - arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess
      Policies:
        - PolicyName: CWLogsPolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
                Effect: Allow

JSON

"Resources": {
    "CommonResourceRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Sid": "",
                        "Effect": "Allow",
                        "Principal": {
                            "Service": [
                                "lambda.amazonaws.com"
                            ]
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Policies": [
                {
                    "PolicyName": "LambdaPolicy",
                    "PolicyDocument": {
                        "Version": "2012-10-17",
                        "Statement": [
                            {
                                "Effect": "Allow",
                                "Action": [
                                    "logs:CreateLogGroup",
                                    "logs:CreateLogStream",
                                    "logs:PutLogEvents"
                                ],
                                "Resource": "arn:aws:logs:*:*:*"
                            },
                            {
                                "Effect": "Allow",
                                "Action": [
                                    "cloudwatch:PutMetricData"
                                ],
                                "Resource": "*",
                                "Condition": {
                                    "StringEquals": {
                                        "cloudwatch:namespace": "CW_NAMESPACE"
                                    }
                                }
                            }
                        ]
                    }
                }
            ]
        }
    }
}