在 Horizon Cloud 的 AWS 帐户中，一些资源提供程序必须处于已注册状态。
**注意：**此页面中列出的权限要求特定于从版本 2601 开始使用的新客户。对于版本 2601 之前的现有客户，请参阅知识库文章 6001262 以了解相关的权限要求。
确保在部署 Horizon Edge 之前提供了列出的 IAM 权限。Horizon Edge 部署的最后一步验证这些资源提供程序是否处于已注册状态，如果未注册某个资源提供程序，则会禁止启动 Horizon Edge 部署。
您可以通过两种方法来提供必要的 IAM 权限。
- 通过使用 AWS IAM 控制台来创建权限。
- 通过使用 AWS IAM 控制台来运行下面包含的 JSON 脚本。
创建 IAM 权限
如果选择手动创建权限，请直接在 AWS IAM 控制台中提供以下 JSON 策略中列出的所需 IAM 权限。
**注意：**Horizon Cloud 不会使用 AWS 服务控制策略 (SCP) 或其他标记策略对任何强制标记执行强制标记验证。如果您的组织强制实施 AWS 服务控制策略 (SCP) 或标记策略，请确保在部署 Edge 之前将所有必需标记应用于提供程序。如果缺少策略规定的标记，Horizon Edge、Edge 网关和 UAG 部署可能会失败。有关更多信息，请参阅使用 Amazon 资源标记。
复制并使用以下 JSON 文件
如果选择使用 JSON 文件方法，请将下面的 JSON 脚本复制到 AWS IAM 控制台的策略编辑器中：
JSON 策略
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AttachInternetGateway",
"ec2:AssociateRouteTable",
"ec2:CreateInternetGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:DescribeInstances",
"ec2:ModifyImageAttribute",
"ec2:RunInstances",
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:RebootInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstanceTypeOfferings",
"ec2:ModifyInstanceAttribute",
"ec2:AssociateIamInstanceProfile",
"ec2:DescribeImages",
"ec2:CreateImage",
"ec2:DeregisterImage",
"ec2:DescribeLaunchTemplateVersions",
"ec2:GetConsoleOutput",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeRouteTables",
"ec2:DescribeNetworkAcls",
"ec2:DescribeDhcpOptions",
"ec2:DescribeNetworkInterfaces",
"ec2:CreateNetworkInterface",
"ec2:AttachNetworkInterface",
"ec2:DeleteNetworkInterface",
"ec2:DisassociateAddress",
"ec2:AllocateAddress",
"ec2:AssociateAddress",
"ec2:ReleaseAddress",
"ec2:DescribeAddresses",
"ec2:DescribeInternetGateways",
"ec2:DescribeNatGateways",
"ec2:DescribeVpcAttribute",
"ec2:DescribeSnapshots",
"ec2:CreateSnapshot",
"ec2:DeleteSnapshot",
"ec2:DescribeSecurityGroups",
"ec2:CreateSecurityGroup",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup",
"ec2:CreateTags",
"ec2:DeleteTags",
"ec2:DescribeTags",
"ec2:DescribeRegions",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeAccountAttributes"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"fsx:CreateFileSystem",
"fsx:DescribeFileSystems",
"fsx:DeleteFileSystem",
"fsx:UpdateFileSystem",
"fsx:TagResource",
"fsx:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"workspaces:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ds:*",
"ds:DescribeDirectories",
"ds:AuthorizeApplication",
"ds:UnauthorizeApplication",
"ds:UpdateAuthorizedApplication"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:TagResource",
"cloudformation:UntagResource",
"cloudformation:DescribeStackEvents",
"cloudformation:ListStackResources",
"cloudformation:GetTemplate"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resource-groups:GetGroup",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"resource-groups:UpdateGroup",
"resource-groups:Tag",
"resource-groups:Untag",
"resource-groups:GetTags",
"resource-groups:ListGroups",
"resource-groups:ListGroupResources",
"resource-groups:ListResourceTypes",
"resource-groups:AssociateResource",
"resource-groups:DisassociateResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:SetSubnets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket",
"s3:ListAllMyBuckets",
"s3:CreateBucket",
"s3:DeleteObject",
"s3:DeleteBucket",
"s3:PutBucketPolicy",
"s3:GetBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketTagging",
"s3:GetBucketLocation",
"s3:PutLifecycleConfiguration",
"s3:PutBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListAttachedUserPolicies",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:SimulatePrincipalPolicy",
"iam:ListAttachedRolePolicies",
"iam:GetInstanceProfile",
"iam:ListInstanceProfilesForRole",
"iam:TagRole",
"iam:UntagRole",
"iam:CreateServiceLinkedRole",
"iam:CreateRole",
"iam:AttachRolePolicy",
"iam:PutRolePolicy",
"iam:ListRoles",
"iam:CreatePolicy"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"tag:GetResources",
"tag:TagResources",
"tag:UntagResources"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:ListKeys",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartSession",
"ssm:CreateAssociation",
"ssm:DescribeAssociation",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:DescribeInstanceInformation",
"ssm:StartAutomationExecution",
"ssm:DescribeAutomationExecutions",
"ssm:GetAutomationExecution"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"sso:GetApplicationGrant",
"sso:ListInstances",
"sso:DescribeInstance",
"sso:DescribeApplication",
"sso:CreateApplication",
"sso:DeleteApplication",
"sso-directory:SearchUsers",
"sso:PutApplicationAuthenticationMethod",
"sso:PutApplicationAssignmentConfiguration",
"sso:PutApplicationGrant"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"application-autoscaling:PutScheduledAction",
"application-autoscaling:RegisterScalableTarget",
"application-autoscaling:DeleteScalingPolicy",
"application-autoscaling:DescribeScalingPolicies",
"application-autoscaling:PutScalingPolicy",
"application-autoscaling:DeleteScheduledAction",
"application-autoscaling:DescribeScalingActivities",
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScheduledActions",
"application-autoscaling:DeregisterScalableTarget"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms",
"cloudwatch:PutMetricAlarm"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"secretsmanager:ListSecrets"
],
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"servicequotas:GetServiceQuota"
],
"Resource": "*"
}
]
}
创建 IAM 角色
IAM 角色是可以在帐户中创建的具有特定权限的 IAM 身份。IAM 角色与 IAM 用户类似，因为它是 AWS 身份，具有用于确定该身份在 AWS 中能做什么和不能做什么的权限策略。然而，角色并不是与一个人员唯一关联，而是旨在由任何需要它的人员担任。此外，角色没有标准的长期凭据，如与其关联的密码或访问密钥。当您担任某个角色时，它而是会为您提供角色会话的临时安全凭据。
通过执行以下步骤，您可以在 AWS 中创建一个 IAM 角色，该角色将为您的角色会话提供临时安全凭据，从而允许访问 Horizon Cloud，同时确保对 AWS 资源的安全访问。如需了解相关信息，请参阅 AWS 文档中的使用自定义信任策略创建角色。
-
在 IAM 控制台中，导航到 AWS 帐户中的 IAM（身份和访问管理）部分。
-
单击左侧窗格中的角色。
-
单击创建角色，然后选择自定义信任策略。
-
通过在自定义信任策略编辑器中输入以下 JSON 策略，定义自定义信任策略。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::211125714243:user/svc.hcs-ng-prod-svc-user" ] }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "{create a custom ExternalId}" } } }, { "Sid": "ssmRoleTrustRelationship", "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<Customer account number>" } } } ] } -
在 IAM 控制台的添加权限部分中，添加在本主题的创建 IAM 权限一节中定义的策略。
-
对于上述权限，还需添加 AWS 管理的策略
AmazonSSMManagedInstanceCore以启用 SSM 相关功能。 请参阅 AWS 文档 AmazonSSMManagedInstanceCore。
此页面对您有帮助吗?