权限列表

下表列出了所有 Amazon Web Services 活动、其可用操作和相关权限。

EC2 活动

活动	运营	权限
AWSConfigureRobot	GetDocumentAsync CreateDocumentAsync CreateAssociationAsync SendCommandAsync DeleteDocumentAsync	ssm:GetDocument ssm:CreateDocument ssm:CreateAssociation ssm:SendCommand ssm:DeleteDocument ssm:ListAssociations
AWS 创建实例	RunInstancesAsync CreateTagsAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:RunInstances ec2:CreateTags ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
AWS从模板创建实例	RunInstancesAsync CreateTagsAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:RunInstances ec2:CreateTags ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
AWS 获取实例	DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
AWS获取实例列表	DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
AWSRebootInstance	RebootInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:RebootInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
AWSRunPowerShell 命令	GetDocumentAsync CreateDocumentAsync CreateAssociationAsync SendCommandAsync DeleteDocumentAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ssm:GetDocument ssm:CreateDocument ssm:CreateAssociation ssm:SendCommand ssm:DeleteDocument ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages ssm:ListAssociations
AWSStartInstance	StartInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:StartInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
AWS 停止实例	StopInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:StopInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
AWS 终止实例	TerminateInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:TerminateInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages

S3 存储桶活动

活动	运营	权限
AWSConfigure 日志记录存储桶	GetACLAsync PutACLAsync PutBucketLoggingAsync	s3:GetBucketAcl s3:PutBucketAcl s3:PutBucketLogging
AWSConfigurePublicAccessBucket	PutPublicAccessBlockAsync	s3:PutBucketPublicAccessBlock
AWS 创建存储桶	DoesS3BucketExistV2Async PutBucketAsync PutBucketVersioningAsync DeleteBucketEncryptionAsync PutBucketEncryptionAsync PutBucketTaggingAsync PutPublicAccessBlockAsync ListBucketsAsync GetBucketLocationAsync GetBucketTaggingAsync GetBucketVersioningAsync GetACLAsync GetBucketLoggingAsync GetObjectLockConfigurationAsync GetPublicAccessBlockAsync GetBucketEncryptionAsync DeleteS3BucketWithObjectsAsync	s3:GetBucketAcl s3:CreateBucket s3:PutBucketObjectLockConfiguration s3:PutBucketVersioning s3:PutEncryptionConfiguration s3:PutEncryptionConfiguration s3:PutBucketTagging s3:PutBucketPublicAccessBlock s3:ListBucket s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketAcl s3:GetBucketLogging s3:GetBucketObjectLockConfiguration s3:GetBucketPublicAccessBlock s3:GetEncryptionConfiguration s3:DeleteBucket s3:DeleteObject
AWS 删除存储桶	GetBucketVersioningAsync ListVersionsAsync ListObjectsV2Async DeleteObjectsAsync DeleteBucketAsync	s3:GetBucketVersioning s3:ListBucketVersions s3:ListBucket s3:DeleteObjectVersion s3:DeleteBucket s3:ListAllMyBuckets
AWS 删除存储桶策略	DeleteBucketPolicyAsync	s3:DeleteBucketPolicy
AWS 空存储桶	GetBucketVersioningAsync ListVersionsAsync ListObjectsV2Async DeleteObjectsAsync	s3:GetBucketVersioning s3:ListBucketVersions s3:ListBucket s3:DeleteObjectVersion
AWSGetBucket	DoesS3BucketExistV2Async ListBucketsAsync GetBucketLocationAsync GetBucketTaggingAsync GetACLAsync GetBucketVersioningAsync GetBucketLoggingAsync GetObjectLockConfigurationAsync GetPublicAccessBlockAsync GetBucketEncryptionAsync	s3:GetBucketAcl （可选）s3:ListBucket s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketAcl s3:GetBucketVersioning s3:GetBucketLogging s3:GetBucketObjectLockConfiguration s3:GetBucketPublicAccessBlock s3:GetEncryptionConfiguration
AWS 获取存储桶列表	ListBucketsAsync GetBucketLocationAsync GetBucketTaggingAsync DoesS3BucketExistV2Async	s3:ListBucket s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketAcl
AWSGetBucketPolicy	GetBucketPolicyAsync	s3:GetBucketPolicy
AWS 设置存储桶策略	PutBucketPolicyAsync	s3:PutBucketPolicy
AWS 更新存储桶	DoesS3BucketExistV2Async PutBucketVersioningAsync DeleteBucketEncryptionAsync PutBucketEncryptionAsync PutBucketTaggingAsync PutPublicAccessBlockAsync	s3:GetBucketAcl s3:PutBucketVersioning s3:PutEncryptionConfiguration s3:PutEncryptionConfiguration s3:PutBucketTagging s3:PutBucketPublicAccessBlock

S3 对象活动

活动	运营	权限
AWS 复制对象	GetBucketLocationAsync CopyObjectAsync	s3:GetBucketLocation s3:GetObject s3:PutObject
AWS 删除多个对象	DeleteObjectsAsync	s3:DeleteObjectVersion s3:GetObject
AWS删除单个对象	DeleteObjectsAsync	s3:DeleteObjectVersion s3:GetObject
AWS 下载单个对象	GetObjectAsync	s3:GetObject
AWSForEachObject	ListObjectsV2Async GetObjectMetadataAsync GetBucketLocationAsync GetObjectTaggingAsync ListVersionsAsync	s3:ListBucket s3:GetObject s3:ListBucketVersions s3:GetBucketLocation s3:GetObjectTagging s3:ListBucketVersions
AWS 获取对象	GetObjectMetadataAsync GetBucketLocationAsync GetObjectTaggingAsync ListVersionsAsync	s3:ListBucketVersions s3:GetBucketLocation s3:GetObjectTagging s3:ListBucketVersions s3:GetObject
AWS 获取对象 ACL	GetACLAsync	s3:GetObjectAcl s3:GetObject
AWSSetObjectACL	GetACLAsync PutACLAsync	s3:GetObjectAcl s3:PutObjectAcl s3:GetObject
AWS 上传多个对象	UploadDirectoryAsync	s3:PutObject s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:AbortMultipartUpload s3:GetObject
AWS 上传单个对象	UploadAsync GetObjectMetadataAsync GetBucketLocationAsync GetObjectTaggingAsync ListVersionsAsync GetACLAsync PutACLAsync	s3:GetObject s3:PutObject s3:PutObjectTagging s3:PutObjectVersionTagging s3:ListBucketVersions s3:GetBucketLocation s3:GetObjectTagging s3:GetObjectVersionTagging s3:GetObjectAcl s3:PutObjectAcl s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:AbortMultipartUpload

IAM 组活动

活动	运营	权限
AWS将用户添加到组	AddUserToGroupAsync	iam:AddUserToGroup
AWS 创建组	CreateGroupAsync	iam:CreateGroup
AWS 删除组	DeleteGroupAsync GetGroupAsync RemoveUserFromGroupAsync ListGroupPoliciesAsync DeleteGroupPolicyAsync ListAttachedGroupPoliciesAsync DetachGroupPolicyAsync	iam:DeleteGroup iam:GetGroup iam:RemoveUserFromGroup iam:ListGroupPolicies iam:DeleteGroupPolicy iam:ListAttachedGroupPolicies iam:DetachGroupPolicy
AWSForEachGroup	ListGroupsAsync	iam:ListGroups
AWS 获取组	GetGroupAsync	iam:GetGroup
AWS 从组中删除用户	RemoveUserFromGroupAsync	iam:RemoveUserFromGroup
AWS 更新组	UpdateGroupAsync GetGroupAsync	iam:UpdateGroup iam:GetGroup

IAM 策略活动

活动	运营	权限
AWSAddRemoveInlinePolicy	PutGroupPolicyAsync DeleteGroupPolicyAsync PutRolePolicyAsync DeleteRolePolicyAsync PutUserPolicyAsync DeleteUserPolicyAsync	iam:PutGroupPolicy iam:DeleteGroupPolicy iam:PutRolePolicy iam:DeleteRolePolicy iam:PutUserPolicy iam:DeleteUserPolicy
AWSAttachDetachManagedPolicy	AttachGroupPolicyAsync DetachGroupPolicyAsync AttachRolePolicyAsync DetachRolePolicyAsync AttachUserPolicyAsync DetachUserPolicyAsync	iam:AttachGroupPolicy iam:DetachGroupPolicy iam:AttachRolePolicy iam:DetachRolePolicy iam:AttachUserPolicy iam:DetachUserPolicy
AWSCreateManagedPolicy	CreatePolicyAsync GetPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:CreatePolicy iam:GetPolicy iam:ListPolicyVersions iam:GetPolicyVersion
AWS 删除托管策略	ListEntitiesForPolicyAsync DetachGroupPolicyAsync DetachRolePolicyAsync DetachUserPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync DeletePolicyVersionAsync DeletePolicyAsync	iam:ListEntitiesForPolicy iam:DetachGroupPolicy iam:DetachRolePolicy iam:DetachUserPolicy iam:ListPolicyVersions iam:GetPolicyVersion iam:DeletePolicyVersion iam:DeletePolicy
AWSForEach 托管策略	ListPoliciesAsync ListPolicyTagsAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:ListPolicies iam:ListPolicyTags iam: ListPolicyVersions iam;GetPolicyVersion
AWSGetIAMIdentityInlinePolicies	ListGroupPoliciesAsync GetGroupPolicyAsync ListRolePoliciesAsync GetRolePolicyAsync ListUserPoliciesAsync GetUserPolicyAsync	iam:ListGroupPolicies iam:GetGroupPolicy iam:ListRolePolicies iam:GetRolePolicy iam:ListUserPolicies iam:GetUSerPolicy
AWSGetIAMIdentityManagedPolicies	ListAttachedGroupPoliciesAsync ListAttachedRolePoliciesAsync ListAttachedUserPoliciesAsync	iam:ListAttachedGroupPolicies iam:ListAttachedRolePolicies iam:ListAttachedUserPolicies
AWSGetIdentitiesAttachedToPolicy	ListEntitiesForPolicyAsync	iam:ListEntitiesForPolicy
AWSGetManagedPolicy	GetPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:GetPolicy iam:ListPolicyVersions iam:GetPolicyVersion
AWS 更新托管策略	UntagPolicyAsync TagPolicyAsync CreatePolicyVersionAsync SetDefaultPolicyVersionAsync DeletePolicyVersionAsync GetPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:UntagPolicy iam:TagPolicy iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:DeletePolicyVersion iam:GetPolicy iam:ListPolicyVersions iam:GetPolicyVersion

IAM 角色活动

活动	运营	权限
AWSAddRoleToInstanceProfile	AddRoleToInstanceProfileAsync GetInstanceProfileAsync RemoveRoleFromInstanceProfileAsync	iam:AddRoleToInstanceProfile iam:GetInstanceProfile iam:RemoveRoleFromInstanceProfile
AWSRemoveRoleFromInstanceProfile	RemoveRoleFromInstanceProfileAsync	iam:RemoveRoleFromInstanceProfile
AWS 创建角色	CreateRoleAsync GetRoleAsync	iam:CreateRole iam:GetRole
AWS 删除角色	DeleteRoleAsync ListInstanceProfilesForRoleAsync RemoveRoleFromInstanceProfileAsync ListRolePoliciesAsync DeleteRolePolicyAsync ListAttachedRolePoliciesAsync DetachRolePolicyAsync GetInstanceProfileAsync DeleteInstanceProfileAsync	iam:DeleteRole iam:ListInstanceProfilesForRole iam:RemoveRoleFromInstanceProfile iam:ListRolePolicies iam:DeleteRolePolicy iam:ListAttachedRolePolicies iam:DetachRolePolicy iam:GetInstanceProfile iam:DeleteInstanceProfile
AWS 获取角色	GetRoleAsync	iam:GetRole
AWS 更新角色	UpdateRoleAsync DeleteRolePermissionsBoundaryAsync PutRolePermissionsBoundaryAsync UntagRoleAsync TagRoleAsync GetRoleAsync	iam:UpdateRole iam:DeleteRolePermissionsBoundary iam:PutRolePermissionsBoundary iam:UntagRole iam:TagRole iam:GetRole
AWSForEach 角色	ListRolesAsync ListRoleTagsAsync	iam:ListRoles iam:ListRoleTags

IAM 用户活动

活动	运营	权限
AWS 更改用户密码	UpdateLoginProfileAsync AttachUserPolicyAsync	iam:UpdateLoginProfile iam:AttachUserPolicy
AWS 创建用户	CreateUserAsync CreateLoginProfileAsync AttachUserPolicyAsync CreateAccessKeyAsync	iam:CreateUser iam:CreateLoginProfile iam:AttachUserPolicy iam:CreateAccessKey
AWS 获取用户	GetUserAsync	iam:GetUser
AWS 删除用户	DeleteUserAsync DeleteLoginProfileAsync ListAccessKeysAsync DeleteAccessKeyAsync ListSigningCertificatesAsync DeleteSigningCertificateAsync ListSSHPublicKeysAsync DeleteSSHPublicKeyAsync ListServiceSpecificCredentialsAsync DeleteServiceSpecificCredentialAsync ListVirtualMFADevicesAsync DeactivateMFADeviceAsync DeleteVirtualMFADeviceAsync ListUserPoliciesAsync DeleteUserPolicyAsync ListAttachedUserPoliciesAsync DetachUserPolicyAsync ListGroupsForUserAsync RemoveUserFromGroupAsync	iam:DeleteUser iam:DeleteLoginProfile iam:ListAccessKeys iam:DeleteAccessKey iam:ListSigningCertificates iam:DeleteSigningCertificate iam:ListSSHPublicKeys iam:DeleteSSHPublicKey iam:ListServiceSpecificCredentials iam:DeleteServiceSpecificCredential iam:ListVirtualMFADevices iam:DeactivateMFADevice iam:DeleteVirtualMFADevice iam:ListUserPolicies iam:DeleteUserPolicy iam:ListAttachedUserPolicies iam:DetachUserPolicy iam:ListGroupsForUser iam:RemoveUserFromGroup
AWS 更新用户	UpdateUserAsync DeleteUserPermissionsBoundaryAsync PutUserPermissionsBoundaryAsync UntagUserAsync TagUserAsync GetUserAsync	iam:UpdateUser iam:DeleteUserPermissionsBoundary iam:PutUserPermissionsBoundary iam:UntagUser iam:TagUser iam:GetUser
AWSForEachUser	ListUsersAsync ListUserTagsAsync	iam:ListUsers iam:ListUserTags
AWSForEachUserGroup	ListGroupsForUserAsync	iam:ListGroupsForUser
AWSForEachUserInGroup	GetGroupAsync ListUserTagsAsync	iam:GetGroup iam:ListUserTags