amazon-web-services - AWS——我如何知道什么在使用服务相关角色？

Question

在我的 AWS 控制台(IAM -> 访问管理 -> 角色)中，我注意到所有角色列表中有一个服务相关角色。

我如何确定哪些 AWS 资源可以担任此服务相关角色。我问是因为我正在审核系统并试图了解其他地方可能正在使用的权限。有人(不知道是谁)出于某种原因创建了它。我想弄清楚原因。

我如何知道什么在使用这个服务相关角色？

Answer 1

服务相关角色是设计使然，供一个特定的 AWS 服务使用。在 IAM 服务的 AWS 管理控制台中，您可以单击角色并查看“摘要”。摘要包含一个路径 属性，如下所示:/aws-service-role/access-analyzer.amazonaws.com/。

在此示例中，您可以看到使用此角色的服务称为访问分析器。

您可以在文档中获取有关该特定服务的服务相关角色的信息。 [1]
导航到“安全、身份和合规性服务”部分 -> 搜索“IAM 访问分析器”行，然后单击表格“服务相关角色”列中的链接是。链接的文档通常会告诉您为什么 AWS 设置这个特定的服务链接角色以及它包含哪些权限。

有关服务相关角色的一般信息由 IAM 文档“服务相关角色”[2] 和 IAM“故障排除”指南 [3] 提供。

如果您想知道您帐户中最后一次使用特定服务相关角色的时间，请使用访问分析器 [4]。

AWS 官方博客 [5] 中目前有 3 篇关于主题服务相关角色的帖子。其中两个可能与您的问题有关:

• 博客文章“使用 AWS CloudTrail 提高 AWS 服务代表您执行的操作的透明度“[6] 详细介绍了如何监控角色执行的操作。我猜这也是@jellycsc 的回答所建议的过程。

  博文摘录[6]:

  In this blog post, I demonstrate how to view CloudTrail logs so that you can more easily monitor and audit AWS services performing actions on your behalf. First, I show how AWS creates a service-linked role in your account automatically when you configure an AWS service that supports service-linked roles. Next, I show how you can view the policies of a service-linked role that grants an AWS service permission to perform actions on your behalf. Finally, I use the configured AWS service to perform an action and show you how the action appears in your CloudTrail logs.

• 博客文章“当您不再需要 AWS 服务代表您执行操作时，现在使用 AWS IAM 删除服务相关角色”[7] 作出以下声明:

  When you delete a service-linked role, the linked service no longer has the permissions to perform actions on your behalf. To ensure your AWS services continue to function as expected when you delete a service-linked role, IAM validates that you no longer have resources that require the service-linked role to function properly. This prevents you from inadvertently revoking permissions required by an AWS service to manage your existing AWS resources and helps you maintain your resources in a consistent state. If there are any resources in your account that require the service-linked role, you will receive an error when you attempt to delete the service-linked role, and the service-linked role will remain in your account. If you do not have any resources that require the service-linked role, you can delete the service-linked role and IAM will remove the service-linked role from your account.

引用资料

[1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html#admin_svcs
[2] https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#create-service-linked-role
[3] https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_roles.html#troubleshoot_roles_new-role-appeared
[4] https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_access-advisor.html?icmpid=docs_iam_console
[5] https://aws.amazon.com/de/blogs/security/tag/service-linked-roles/
[6] https://aws.amazon.com/de/blogs/security/get-greater-transparency-into-actions-aws-services-perform-on-your-behalf-by-using-aws-cloudtrail/
[7] https://aws.amazon.com/de/blogs/security/now-use-aws-iam-to-delete-a-service-linked-role-when-you-no-longer-require-an-aws-service-to-perform-actions-on-your-behalf/