amazon-web-services - IAM 中的组和路径有什么区别？

Question

因此，可以按组和路径 对用户进行分组。如果我们有组，为什么我们需要路径？ 拥有路径的额外优势是什么？

Answer 1

我的猜测是，用户路径的使用更适合大型组织或高级用户，他们通常会依赖 CloudFormation 和/或 AWS CLI 来管理其 AWS 资源。路径的清晰度 -> https://stackoverflow.com/a/46325139/13126651

我怎么看groups v/s path .

• 可能有适用于开发组和特定用户的权限(多个)
• 我们不希望特定用户使用开发组策略，但是开发组也需要一些适用于开发用户的权限。
• 我会创建一个开发路径
• 可以通过创建策略为路径中的用户使用该特定服务来授予他们访问权限。
• 以这种方式将特定用户添加到开发路径，允许在不将他们添加到开发组的情况下授予权限。
• 如果将来需要删除开发权限，只需删除路径即可。

使用路径的示例策略

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:GetContextKeysForPrincipalPolicy",
                "iam:SimulatePrincipalPolicy"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::*:user/Department/Development/*"
        }
    ]
}

群组:

An IAM user group is a collection of IAM users. User groups let you specify permissions for multiple users, which can make it easier to manage the permissions for those users. For example, you could have a user group called Admins and give that user group the types of permissions that administrators typically need. Any user in that user group automatically has the permissions that are assigned to the user group. If a new user joins your organization and needs administrator privileges, you can assign the appropriate permissions by adding the user to that admin group

路径:

You can use a single path, or nest multiple paths as a folder structure. For example, you could use the nested path /division_abc/subdivision_xyz/product_1234/engineering/ to match your company organizational structure. You could then create a policy to allow all users in that path to access the policy simulator API.

关键区别

If you have a user and user group in the same path, IAM doesn't automatically put the user in that user group. For example, you might create a Developers user group and specify the path as /division_abc/subdivision_xyz/product_1234/engineering/. If you create a user named Bob and add the same path to him, this doesn't automatically put Bob in the Developers user group. IAM doesn't enforce any boundaries between users or user groups based on their paths.