AWS管理员权限设置

ststcheung

已于 2023-05-24 11:51:32 修改

阅读量273

点赞数

文章标签： aws 云计算

于 2023-05-20 16:20:16 首次发布

本文链接：https://blog.csdn.net/ststcheung/article/details/130782803

版权

该JSON定义了一个AWS权限策略，禁止访问IAM、账单相关操作，同时允许其他所有权限作为管理员。策略包括阻止IAM管理、组织信息查看、账单成本查询，但允许创建和删除服务链接角色、列出角色和查看组织描述。

摘要由CSDN通过智能技术生成

通过json建立AWS权限策略，达到效果为：

1、无IAM权限

2、无账单成本查看权限

3、其他可以为管理员权限

4、权限区域不限制

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "NotAction": [
                "iam:*",
                "organizations:*",
                "account:*",
                "aws-portal:*Billing",
                "aws-portal:*Usage",
                "aws-portal:*PaymentMethods",
                "budgets:ViewBudget",
                "budgets:ModifyBudget",
                "ce:UpdatePreferences",
                "ce:CreateReport",
                "ce:UpdateReport",
                "ce:DeleteReport",
                "ce:CreateNotificationSubscription",
                "ce:UpdateNotificationSubscription",
                "ce:DeleteNotificationSubscription",
                "cur:DescribeReportDefinitions",
                "cur:PutReportDefinition",
                "cur:ModifyReportDefinition",
                "cur:DeleteReportDefinition",
                "purchase-orders:*PurchaseOrders"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole",
                "iam:DeleteServiceLinkedRole",
                "iam:ListRoles",
                "organizations:DescribeOrganization",
                "account:ListRegions"
            ],
            "Resource": "*"
        }
    ]
}