在 Horizon Cloud 的 AWS 帐户中，一些资源提供程序必须处于已注册状态。
确保在部署 Horizon Edge 之前提供了列出的 IAM 权限。Horizon Edge 部署的最后一步验证这些资源提供程序是否处于已注册状态，如果未注册某个资源提供程序，则会禁止启动 Horizon Edge 部署。
您可以通过两种方法来提供必要的 IAM 权限。
- 通过使用 AWS IAM 控制台来创建权限。
- 通过使用 AWS IAM 控制台来运行下面包含的 JSON 脚本。
创建 IAM 权限
如果选择手动创建权限，则必须在 AWS IAM 控制台中提供以下所需的 IAM 权限：
-
ec2:- 所有权限 -
workspaces:- 所有权限 -
fsx:- 所有权限 -
ds:DescribeDirectories, AuthorizeApplication, UnauthorizeApplication, UpdateAuthorizedApplication -
cloudformation:CreateStack, UpdateStack, DeleteStack, DescribeStacks, TagResource, UntagResource, DescribeStackEvents, ListStackResources, GetTemplate -
resource-groups:GetGroup, CreateGroup, DeleteGroup, UpdateGroup Tag, GetTags, ListGroups, ListGroupResources, ListResourceTypes, AssociateResource, DisassociateResource -
elasticloadbalancing:AddTags, RemoveTags, RegisterTargets, DeregisterTargets, DescribeTargetHealth, CreateListener, DeleteListener, DescribeListeners, CreateTargetGroup, DeleteTargetGroup, ModifyTargetGroup, DescribeTargetGroups, CreateLoadBalancer, DeleteLoadBalancer, DescribeLoadBalancers, ModifyLoadBalancerAttributes, ModifyTargetGroupAttributes, SetSubnets -
s3:GetObject, PutObject, ListBucket, ListAllMyBuckets, CreateBucket, DeleteObject, DeleteBucket, PutBucketPolicy, GetBucketPolicy, DeleteBucketPolicy, PutBucketTagging, GetBucketLocation, PutLifecycleConfiguration, PutBucketPublicAccessBlock, PutEncryptionConfiguration -
iam:GetRole, PassRole, CreateRole, GetPolicy, PutRolePolicy, GetPolicyVersion, ListAttachedUserPolicies, GetInstanceProfile, CreateInstanceProfile, DeleteInstanceProfile, CreateServiceLinkedRole, AddRoleToInstanceProfile, RemoveRoleFromInstanceProfile, SimulatePrincipalPolicy, DeleteRole, AttachRolePolicy, DetachRolePolicy, TagRole, UntagRole -
tag:GetResources, TagResources, UntagResources -
kms:Encrypt, Decrypt, ReEncrypt, GenerateDataKey, DescribeKey, ListKeys, ListAliases -
ssm:SendCommand, StartSession, CreateAssociation, DescribeAssociation, GetCommandInvocation, ListCommandInvocations, DescribeInstanceInformation
**注意：**Horizon Cloud 不会使用 AWS 服务控制策略 (SCP) 或其他标记策略对任何强制标记执行强制标记验证。如果您的组织强制实施 AWS 服务控制策略 (SCP) 或标记策略，请确保在部署 Edge 之前将所有必需标记应用于提供程序。如果缺少策略规定的标记，Horizon Edge、Edge 网关和 UAG 部署可能会失败。有关更多信息，请参阅使用 Amazon 资源标记。
复制并使用以下 JSON 文件
如果选择使用 JSON 文件方法，请将下面的 JSON 脚本复制到 AWS IAM 控制台的策略编辑器中：
JSON 脚本
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "workspaces:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "fsx:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ds:DescribeDirectories",
"ds:AuthorizeApplication",
"ds:UnauthorizeApplication",
"ds:UpdateAuthorizedApplication"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:TagResource",
"cloudformation:UntagResource",
"cloudformation:DescribeStackEvents",
"cloudformation:ListStackResources",
"cloudformation:GetTemplate"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resource-groups:GetGroup",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"resource-groups:UpdateGroup",
"resource-groups:Tag",
"resource-groups:Untag",
"resource-groups:GetTags",
"resource-groups:ListGroups",
"resource-groups:ListGroupResources",
"resource-groups:ListResourceTypes",
"resource-groups:AssociateResource",
"resource-groups:DisassociateResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:SetSubnets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket",
"s3:ListAllMyBuckets",
"s3:CreateBucket",
"s3:DeleteObject",
"s3:DeleteBucket",
"s3:PutBucketPolicy",
"s3:GetBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketTagging",
"s3:GetBucketLocation",
"s3:PutLifecycleConfiguration",
"s3:PutBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole",
"iam:CreateRole",
"iam:GetPolicy",
"iam:PutRolePolicy",
"iam:GetPolicyVersion",
"iam:ListAttachedUserPolicies",
"iam:GetInstanceProfile",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:CreateServiceLinkedRole",
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:SimulatePrincipalPolicy",
"iam:DeleteRole",
"iam:AttachRolePolicy",
"iam:DetachRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"tag:GetResources",
"tag:TagResources",
"tag:UntagResources"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:ListKeys",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartSession",
"ssm:CreateAssociation",
"ssm:DescribeAssociation",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:DescribeInstanceInformation"
],
"Resource": "*"
}
]
}创建 IAM 角色
IAM 角色是可以在帐户中创建的具有特定权限的 IAM 身份。IAM 角色与 IAM 用户类似，因为它是 AWS 身份，具有用于确定该身份在 AWS 中能做什么和不能做什么的权限策略。然而，角色并不是与一个人员唯一关联，而是旨在由任何需要它的人员担任。此外，角色没有标准的长期凭据，如与其关联的密码或访问密钥。当您担任某个角色时，它而是会为您提供角色会话的临时安全凭据。
通过执行以下步骤，您可以在 AWS 中创建一个 IAM 角色，该角色将为您的角色会话提供临时安全凭据，从而允许访问 Horizon Cloud，同时确保对 AWS 资源的安全访问。
- 在 IAM 控制台中，导航到 AWS 帐户中的 IAM（身份和访问管理）部分。
- 单击左侧窗格中的角色。
- 单击创建角色，然后选择自定义信任策略。
- 通过在自定义信任策略编辑器中输入以下 JSON 脚本，定义自定义信任策略。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::211125714243:user/svc.hcs-ng-prod-svc-user"
]
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "{create a custom ExternalId}"
}
}
}
]
}
此页面对您有帮助吗?