角色和策略

下表描述了 CloudFormation 模板创建的 IAM 角色和策略：

表格 1. IAM 角色

角色	操作
CopyRole This role is used to copy objects between S3 buckets. It is a copy of the https://github.com/aws-quickstart/lambda-copyzips AWS repository initially used for the AWS QuickStart. 文件：copy-zips.template.yaml	s3:GetObject s3:PutObject s3:DeleteObject
ACMCertificateRole The purpose of this role is to create and verify an ACM certificate using DNS validation and Route 53. It is a copy of the https://github.com/aws-quickstart/quickstart-aws-acm-certificate AWS repository used for the AWS QuickStart. 文件：quickstart-aws-acm-certificate.template.yml	acm:RequestCertificate acm:DescribeCertificate acm:DeleteCertificate route53:ChangeResourceRecordSets
VPCFlowLogsRole This role serves as the value of the DeliverLogsPermissionArn parameter in the AWS::EC2::FlowLog resource type. Is it a copy of the https://github.com/aws-quickstart/quickstart-aws-vpc QuickStart repository. 文件：aws-vpc.template.yaml	logs:CreateLogStream logs:PutLogEvents logs:DescribeLogGroups logs:DescribeLogStreams
AutomationAssumeRole 此角色用于各种 SSM 文档 (AWS::SSM::Document)，其用途如下： AgentRemoveInstanceDocument：从集群中删除代理实例； ServerRemoveInstanceDocument：从集群中删除服务器实例； RegisterAiCenter：将 AI Center 服务注册到 Orchestrator； OnDemandBackup：创建 Automation Suite 集群的快照； OnDemandRestoreDocument：从给定快照还原 Automation Suite 集群； GetBackupList：获取 Automation Suite 集群的可用快照列表； UpdateAMIDocument：更新调整组的 AMI。 AutomationAssumeRole allows full access to Amazon SSN. For more information, see AmazonSSMFullAccess. 文件：ec2-management.template.yaml	autoscaling:CompleteLifecycleAction autoscaling:RecordLifecycleActionHeartbeat autoscaling:UpdateAutoScalingGroup ssm:SendCommand autoscaling:DescribeAutoScalingGroups ssm:PutParameter ssm:GetParameter logs:PutLogEvents logs:DescribeLogStreams logs:DescribeLogGroups logs:CreateLogStream logs:CreateLogGroup ec2:DescribeImages ec2:DescribeLaunchTemplates ec2:DescribeLaunchTemplateVersions iam:PassRole ec2:CreateLaunchTemplateVersion ec2:RunInstances states:StartExecution states:DescribeExecution
StateMachinesAssumeRole 此角色用于 OnDemandRestoreStateMachine 资源 (AWS::StepFunctions::StateMachine)。此资源用于还原操作。 StateMachinesAssumeRole allows full access to Amazon SSN. For more information, see AmazonSSMFullAccess. 文件：ec2-management.template.yaml	使用 AmazonSSMFullAccess 托管策略。
EventsBridgeAssumeRole 此角色用于以下事件规则 (AWS::Events::Rule)： AsRobotsTerminateEventRule AgentTerminateEventRule ServerTerminateEventRule 这些规则适用于终止生命周期操作。 文件：ec2-management.template.yaml	ssm:StartautomationExecution iam:PassRole
ObjectStorageBucketsCleanupLambdaRole 此角色用于 ObjectStorageBucketsCleanupFunction lambda 函数，并为对象存储提供实用程序。 文件：external-storage.template.yaml	s3:GetAccelerateConfiguration s3:GetBucketLocation s3:GetBucketVersioning s3:ListBucket s3:ListBucketVersions s3:ListBucketMultipartUploads s3:DeleteObject s3:DeleteObjectVersion logs:CreateLogGroup logs:CreateLogStream logs:PutLogEvents xray:PutTraceSegments
ServiceFabricIamRole 以下资源中引用了此角色： ServiceFabricInstanceProfile (AWS::IAM::InstanceProfile) 以下策略 (AWS::IAM::Policy)：LogsAccessPolicy、LifecycleHookActionsPolicy、Ec2QueryPolicy、QuickstartS3IAMPolicy、InputJsonSecretPolicy、KubeconfigSecretPolicy、InstallerDownloadUrlParameterPolicy、ExternalStorageAccessPolicy。 文件：uipath-sf.template.yaml	使用 AmazonSSMManagedInstanceCore 托管策略。
AsgProcessModificationRole 此角色用于在创建 CF 堆栈期间修改 ASG 流程。 文件：uipath-sf.template.yaml	autoscaling:ResumeProcesses autoscaling:SuspendProcesses logs:CreateLogGroup logs:CreateLogStream logs:PutLogEvents
FindAmiLambdaRole 此角色由 FindAMIFunction Lambda 函数使用。 文件：uipath-sf.template.yaml	ec2:DescribeImages logs:CreateLogGroup logs:CreateLogStream logs:PutLogEvents xray:PutTraceSegments
CreateInputJsonLambdaRole 此角色由 CreateInputJsonFunction Lambda 函数使用。该函数为 Automation Suite 安装创建配置文件。 文件：uipath-sf.template.yaml	secretsmanager:GetSecretValue secretsmanager:PutSecretValue autoscaling:DescribeAutoScalingGroups autoscaling:DescribeAutoScalingInstances logs:CreateLogGroup logs:CreateLogStream logs:PutLogEvents xray:PutTraceSegments ec2:DescribeImages ec2:DescribeInstanceTypes ec2:DescribeInstanceTypeOfferings
ComputeResourceSizeLambdaRole 此角色由 ComputeResourceSizeFunction Lambda 函数使用。该函数验证资源的输入是否符合硬件要求。 文件：uipath-sf.template.yaml	autoscaling:DescribeAutoScalingGroups autoscaling:DescribeAutoScalingInstances ec2:DescribeInstances ec2:DescribeInstanceTypeOfferings ec2:DescribeInstanceTypes ec2:DescribeImages ec2:RunInstances ec2:CreateTags cloudformation:DescribeStacks logs:CreateLogGroup logs:CreateLogStream logs:PutLogEvents xray:PutTraceSegments

表 2. IAM 策略

Policy	操作
LogsAccessPolicy 日志访问策略。	logs:PutLogEvents logs:DescribeLogStreams logs:DescribeLogGroups logs:CreateLogStream logs:CreateLogGroup cloudwatch:PutMetricData xray:PutTraceSegments
LifecycleHookActionsPolicy 生命周期挂钩访问策略。	autoscaling:CompleteLifecycleAction
Ec2QueryPolicy EC2 和 ASG 访问策略。	ec2:DescribeVolumes ec2:DescribeTags ec2:DescribeInstances autoscaling:DescribeAutoScalingInstances autoscaling:DescribeAutoScalingGroups ec2:DescribeImages ec2:DescribeInstanceTypes ec2:DescribeInstanceTypeOfferings
QuickstartS3IAMPolicy 用于访问 QS S3 存储桶的策略。	s3:GetObject
InputJsonSecretPolicy 允许访问密码管理器的策略。	secretsmanager:GetSecretValue secretsmanager:PutSecretValue
KubeconfigSecretPolicy 允许访问密码管理器的策略。	secretsmanager:GetSecretValue secretsmanager:PutSecretValue
InstallerDownloadUrlParameterPolicy 允许访问 SSM 参数的策略。	ssm:GetParameter
ExternalStorageAccessPolicy 允许访问外部存储的策略。	s3:GetBucketAcl s3:GetBucketCORS s3:GetBucketLocation s3:GetBucketNotification s3:GetBucketPolicy s3:PutBucketPolicy s3:DeleteBucketPolicy s3:GetBucketVersioning s3:ListBucket s3:ListBucketMultipartUploads s3:PutBucketAcl s3:PutBucketCORS s3:*Object s3:*ObjectAcl s3:*ObjectAttributes s3:*ObjectVersion s3:*ObjectVersionTagging s3:AbortMultipartUpload s3:ListMultipartUploadParts s3:ListAllMyBuckets