IAM 策略参考
策略 JSON 结构
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowS3ReadOnly",
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::my-bucket",
"arn:aws:s3:::my-bucket/*"
]
},
{
"Sid": "DenyDeleteObjects",
"Effect": "Deny",
"Action": "s3:DeleteObject",
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}
托管策略 vs 内联策略
# 创建客户托管策略
aws iam create-policy \
--policy-name MyS3Policy \
--policy-document file://policy.json
# 为角色附加托管策略
aws iam attach-role-policy \
--role-name MyRole \
--policy-arn arn:aws:iam::123456789012:policy/MyS3Policy
# 为角色添加内联策略（不可复用）
aws iam put-role-policy \
--role-name MyRole \
--policy-name InlinePolicy \
--policy-document file://inline.json
条件键
{
"Statement": [{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-bucket/*",
"Condition": {
"StringEquals": {
"s3:x-amz-server-side-encryption": "AES256"
},
"IpAddress": {
"aws:SourceIp": ["203.0.113.0/24"]
},
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
}]
}
权限边界
# 为角色设置权限边界
aws iam put-role-permissions-boundary \
--role-name DeveloperRole \
--permissions-boundary arn:aws:iam::123456789012:policy/DeveloperBoundary
# 有效权限 = 身份策略 ∩ 权限边界
# 权限边界定义了角色能拥有的最大权限集合
服务控制策略（SCP）
# SCP 作用于 AWS Organizations 层级
# 禁止在特定区域外操作
{
"Version": "2012-10-17",
"Statement": [{
"Sid": "DenyOutsideRegions",
"Effect": "Deny",
"NotAction": ["iam:*", "sts:*", "route53:*"],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": ["us-east-1", "cn-north-1"]
}
}
}]
}
常用策略模式
| 模式 | 使用场景 |
|---|---|
Effect: Deny, Action: *, Resource: * | 显式拒绝所有（优先级最高） |
NotAction + Allow | 允许除列举操作外的所有操作 |
aws:PrincipalOrgID 条件 | 仅限组织成员访问 |
sts:AssumeRole + MFA 条件 | 扮演角色前要求 MFA |