在 Horizon Cloud 的 AWS 訂閱中，必須有數個資源提供者處於已登錄狀態。
**附註：**此頁面列出的權限需求，僅適用於自 2601 版本起的新客戶。如需瞭解 2601 版本之前既有客戶的權限需求，請參閱知識庫文章 6001262。
在部署 Horizon Edge 之前，請確保已提供所列的 IAM 權限。Horizon Edge 部署的最後一個步驟會驗證這些資源提供者是否為已登錄狀態，如果有資源提供者未登錄，則會阻止啟動 Horizon Edge 部署。
您可以透過兩種方法提供所需的 IAM 權限。
- 使用 AWS IAM 主控台建立權限。
- 使用 AWS IAM 主控台執行以下提供的 JSON 指令碼。
建立 IAM 權限
如果您選擇手動建立權限，請直接在 AWS IAM 主控台中提供下列 JSON 原則中列出的必要 IAM 權限。
**附註：**Horizon Cloud 不會針對任何因 AWS 服務控制原則 (SCP) 或其他標籤原則而設定為必填的標籤執行強制性標籤驗證。如果您的組織強制執行 AWS 服務控制原則 (SCP) 或標籤原則，請在部署 Edge 之前確保所有必要的標籤都已套用至提供者。如果缺少原則要求的標籤，Horizon Edge、Edge Gateway 與 UAG 的部署可能會失敗。如需詳細資訊，請參閱使用 Amazon 資源標籤。
複製並使用下列 JSON 檔案
如果您選擇使用 JSON 檔案方法，請將下列 JSON 指令碼複製到 AWS IAM 主控台的原則編輯器中：
JSON 原則
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:AttachInternetGateway",
"ec2:AssociateRouteTable",
"ec2:CreateInternetGateway",
"ec2:CreateRoute",
"ec2:CreateRouteTable",
"ec2:CreateSubnet",
"ec2:CreateVpc",
"ec2:DescribeInstances",
"ec2:ModifyImageAttribute",
"ec2:RunInstances",
"ec2:TerminateInstances",
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:RebootInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:DescribeInstanceTypeOfferings",
"ec2:ModifyInstanceAttribute",
"ec2:AssociateIamInstanceProfile",
"ec2:DescribeImages",
"ec2:CreateImage",
"ec2:DeregisterImage",
"ec2:DescribeLaunchTemplateVersions",
"ec2:GetConsoleOutput",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:DescribeRouteTables",
"ec2:DescribeNetworkAcls",
"ec2:DescribeDhcpOptions",
"ec2:DescribeNetworkInterfaces",
"ec2:CreateNetworkInterface",
"ec2:AttachNetworkInterface",
"ec2:DeleteNetworkInterface",
"ec2:DisassociateAddress",
"ec2:AllocateAddress",
"ec2:AssociateAddress",
"ec2:ReleaseAddress",
"ec2:DescribeAddresses",
"ec2:DescribeInternetGateways",
"ec2:DescribeNatGateways",
"ec2:DescribeVpcAttribute",
"ec2:DescribeSnapshots",
"ec2:CreateSnapshot",
"ec2:DeleteSnapshot",
"ec2:DescribeSecurityGroups",
"ec2:CreateSecurityGroup",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress",
"ec2:RevokeSecurityGroupEgress",
"ec2:DeleteSecurityGroup",
"ec2:CreateTags",
"ec2:DeleteTags",
"ec2:DescribeTags",
"ec2:DescribeRegions",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeAccountAttributes"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"autoscaling:DescribeAutoScalingGroups"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"fsx:CreateFileSystem",
"fsx:DescribeFileSystems",
"fsx:DeleteFileSystem",
"fsx:UpdateFileSystem",
"fsx:TagResource",
"fsx:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"workspaces:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ds:*",
"ds:DescribeDirectories",
"ds:AuthorizeApplication",
"ds:UnauthorizeApplication",
"ds:UpdateAuthorizedApplication"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:TagResource",
"cloudformation:UntagResource",
"cloudformation:DescribeStackEvents",
"cloudformation:ListStackResources",
"cloudformation:GetTemplate"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resource-groups:GetGroup",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"resource-groups:UpdateGroup",
"resource-groups:Tag",
"resource-groups:Untag",
"resource-groups:GetTags",
"resource-groups:ListGroups",
"resource-groups:ListGroupResources",
"resource-groups:ListResourceTypes",
"resource-groups:AssociateResource",
"resource-groups:DisassociateResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:SetSubnets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket",
"s3:ListAllMyBuckets",
"s3:CreateBucket",
"s3:DeleteObject",
"s3:DeleteBucket",
"s3:PutBucketPolicy",
"s3:GetBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketTagging",
"s3:GetBucketLocation",
"s3:PutLifecycleConfiguration",
"s3:PutBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListAttachedUserPolicies",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:SimulatePrincipalPolicy",
"iam:ListAttachedRolePolicies",
"iam:GetInstanceProfile",
"iam:ListInstanceProfilesForRole",
"iam:TagRole",
"iam:UntagRole",
"iam:CreateServiceLinkedRole",
"iam:CreateRole",
"iam:AttachRolePolicy",
"iam:PutRolePolicy",
"iam:ListRoles",
"iam:CreatePolicy"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"tag:GetResources",
"tag:TagResources",
"tag:UntagResources"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:ListKeys",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartSession",
"ssm:CreateAssociation",
"ssm:DescribeAssociation",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:DescribeInstanceInformation",
"ssm:StartAutomationExecution",
"ssm:DescribeAutomationExecutions",
"ssm:GetAutomationExecution"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"sso:GetApplicationGrant",
"sso:ListInstances",
"sso:DescribeInstance",
"sso:DescribeApplication",
"sso:CreateApplication",
"sso:DeleteApplication",
"sso-directory:SearchUsers",
"sso:PutApplicationAuthenticationMethod",
"sso:PutApplicationAssignmentConfiguration",
"sso:PutApplicationGrant"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"application-autoscaling:PutScheduledAction",
"application-autoscaling:RegisterScalableTarget",
"application-autoscaling:DeleteScalingPolicy",
"application-autoscaling:DescribeScalingPolicies",
"application-autoscaling:PutScalingPolicy",
"application-autoscaling:DeleteScheduledAction",
"application-autoscaling:DescribeScalingActivities",
"application-autoscaling:DescribeScalableTargets",
"application-autoscaling:DescribeScheduledActions",
"application-autoscaling:DeregisterScalableTarget"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudwatch:DeleteAlarms",
"cloudwatch:DescribeAlarms",
"cloudwatch:PutMetricAlarm"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"secretsmanager:ListSecrets"
],
"Resource": "*"
}
{
"Effect": "Allow",
"Action": [
"servicequotas:GetServiceQuota"
],
"Resource": "*"
}
]
}
建立 IAM 角色
IAM 角色是一種您可以在帳戶中建立的 IAM 身分，具有特定的權限。IAM 角色與 IAM 使用者類似，都是具有權限原則的 AWS 身分，用以決定該身分在 AWS 中可以或不可以執行的操作。然而，角色並不是唯一關聯至某個使用者，而是設計成可由需要的任何人承擔。此外，角色不具備與其關聯的標準長期認證，例如密碼或存取金鑰。相反地，當您承擔角色時，會為您的角色工作階段提供臨時安全認證。
依照以下步驟，您可以在 AWS 中建立一個 IAM 角色，為角色工作階段提供臨時安全認證，以便存取 Horizon Cloud，同時確保安全存取您的 AWS 資源。如需相關資訊，請參閱 AWS 說明文件中的使用自訂信任原則建立角色。
-
在 IAM 主控台中，請在您的 AWS 帳戶內導覽至 IAM (身分識別與存取管理) 區段。
-
在左側窗格中按一下角色。
-
按一下建立角色，並選取自訂信任原則。
-
在自訂信任原則編輯器中輸入下列 JSON 原則，以定義自訂信任原則。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::211125714243:user/svc.hcs-ng-prod-svc-user" ] }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "{create a custom ExternalId}" } } }, { "Sid": "ssmRoleTrustRelationship", "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "<Customer account number>" } } } ] } -
在 IAM 主控台的新增權限區段中，新增在本主題的建立 IAM 權限區段中所定義的原則。
-
在具備上述權限的同時，請另外新增 AWS 受管理原則
AmazonSSMManagedInstanceCore，以啟用與 SSM 相關的功能。 請參閱 AWS 說明文件 AmazonSSMManagedInstanceCore。
此頁面對您有幫助嗎?