AWS之IAM身份

1.        user,role,policy的定义和区别

总的来说user与一般系统user无差别，代表实体，代表who。

policy表示一个user或者一个role能干什么，需要满足什么条件。

role不是一个实体，他代表了一组policy，可以不需要附加到user上，直接附加给服务，那么服务就获得了这一组policy所具备的权限。

 

1.User:

Root User: All privilege in the account, and billing and password MGMT.

IAM User

SSO User

2.Group: like other system group.

 

3.Role:

应用场景

1.IAM user in another account

2.Application code running on an EC2 instance that needs to perform actions on AWS resources

3.An AWS service that needs to act on resources in your account to provide its features

4.Users from a corporate directory who use identity federation with SAML

 

Access:

 

Policy: 也是一个对象,当与IAM 身份对象关联时,授予他们的权限.

AWS manage Policy: 1. AWS managed 2. Customer Managed.

Inline Policy: 内联策略: 直接添加到单个用户,组或策略. 内联策略与身份之间保持严格的一对一关系.删除身份的同时, Inline Policy也会被删除.

 

 

Policy Structure:

 

{

  "Statement":[{

    "Effect":"effect",

    "Action":"action",

    "Resource":"arn",

    "Condition":{

      "condition":{

        "key":"value"

        }

      }

    }