最近更新时间:2024.05.09 17:38:05
首次发布时间:2024.04.23 18:45:29
如果火山引擎提供的系统预设策略不满足您的需求,您可通过创建自定义策略,遵循最小授权原则,进行更精细化的权限管控,以提升IAM身份对主账号下资源的安全访问。本文为您介绍日常场景中常见的云服务器ECS相关的自定义策略示例,供您参考。
自定义策略语法中策略元素配置的详细介绍,请参见IAM策略语法。
说明
Deny的优先级高于Allow,当身份对某些操作存在Deny权限时,再次赋予这些操作的Allow权限将无法生效,需要将相应的Deny声明去除或更改为Allow。
{ "Statement": [ { "Effect": "Deny", "Action": [ "ecs:DeleteInstance", "ecs:DeleteInstances" ], "Resource": [ "*" ] } ] }
{ "Statement": [ { "Effect": "Deny", "Action": [ "ecs:Delete" ], "Resource": [ "trn:ecs:*:200000000X:instance/i-yczzpbpgqoqc6ilc****,i-yczv4tg64gqc6iks****" ] } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:RunInstances" ], "Resource": [ "*" ] } ] }
{ "Statement": [ { "Effect": "Deny", "Action": [ "ecs:ModifyInstanceAttribute" ], "Resource": [ "*" ] } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:*" ], "Resource": [ "trn:ecs:*:200000000X:instance/i-yczzpbpgqoqc6ilc****" ] } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:Desceibe" ], "Resource": [ "*" ] } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:*" ], "Resource": [ "*" ], "Condition": { "IpAddress": { "volc:SourceIp": [ "210.22.XX.XX" ] } } } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:*" ], "Resource": [ "*" ], "Condition": { "StringEquals": { "volc:ResourceTag/ecs": [ "use" ] } } } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:CreateTags", "ecs:DeleteTags", "ecs:DescribeTags" ], "Resource": [ "*" ] } ] }
{ "Statement": [ { "Effect": "Deny", "Action": [ "ecs:DeleteKeyPairs" ], "Resource": [ "*" ] } ] }
{ "Statement":[ { "Effect":"Allow", "Action":[ "vpc:AllocateEipAddress", "vpc:DescribeEipAddresses", "vpc:AssociateEipAddress" ], "Resource":["*"] } ] }
{ "Statement": [ { "Effect": "Allow", "Action": [ "ecs:Describe*", "ecs:ModifyCommand", "ecs:InvokeCommand" ], "Resource": [ "trn:ecs:cn-beijing:210001*****:command/cmd-ycn5dc9qf9l8j0v*****", "trn:ecs:cn-beijing:210001*****:command/cmd-tsx0gy9rslp90k3z*****" ] } ] }
更多示例请参见自定义策略示例。