在 Horizon Cloud 的 AWS 訂閱中，必須有數個資源提供者處於已登錄狀態。
在部署 Horizon Edge 之前，請確保已提供所列的 IAM 權限。Horizon Edge 部署的最後一個步驟會驗證這些資源提供者是否為已登錄狀態，如果有資源提供者未登錄，則會阻止啟動 Horizon Edge 部署。
您可以透過兩種方法提供所需的 IAM 權限。
- 使用 AWS IAM 主控台手動建立權限。
- 使用 AWS IAM 主控台執行以下提供的 JSON 指令碼。
建立 IAM 權限
如果您選擇手動建立權限，則必須在 AWS IAM 主控台中提供下列必要的 IAM 權限：
-
ec2:- 所有權限 -
workspaces:- 所有權限 -
fsx:- 所有權限 -
ds:DescribeDirectories, AuthorizeApplication, UnauthorizeApplication, UpdateAuthorizedApplication -
cloudformation:CreateStack, UpdateStack, DeleteStack, DescribeStacks, TagResource, UntagResource, DescribeStackEvents, ListStackResources, GetTemplate -
resource-groups:GetGroup, CreateGroup, DeleteGroup, UpdateGroup Tag, GetTags, ListGroups, ListGroupResources, ListResourceTypes, AssociateResource, DisassociateResource -
elasticloadbalancing:AddTags, RemoveTags, RegisterTargets, DeregisterTargets, DescribeTargetHealth, CreateListener, DeleteListener, DescribeListeners, CreateTargetGroup, DeleteTargetGroup, ModifyTargetGroup, DescribeTargetGroups, CreateLoadBalancer, DeleteLoadBalancer, DescribeLoadBalancers, ModifyLoadBalancerAttributes, ModifyTargetGroupAttributes, SetSubnets -
s3:GetObject, PutObject, ListBucket, ListAllMyBuckets, CreateBucket, DeleteObject, DeleteBucket, PutBucketPolicy, GetBucketPolicy, DeleteBucketPolicy, PutBucketTagging, GetBucketLocation, PutLifecycleConfiguration, PutBucketPublicAccessBlock, PutEncryptionConfiguration -
iam:GetRole, PassRole, CreateRole, GetPolicy, PutRolePolicy, GetPolicyVersion, ListAttachedUserPolicies, GetInstanceProfile, CreateInstanceProfile, DeleteInstanceProfile, CreateServiceLinkedRole, AddRoleToInstanceProfile, RemoveRoleFromInstanceProfile, SimulatePrincipalPolicy, DeleteRole, AttachRolePolicy, DetachRolePolicy, TagRole, UntagRole -
tag:GetResources, TagResources, UntagResources -
kms:Encrypt, Decrypt, ReEncrypt, GenerateDataKey, DescribeKey, ListKeys, ListAliases -
ssm:SendCommand, StartSession, CreateAssociation, DescribeAssociation, GetCommandInvocation, ListCommandInvocations, DescribeInstanceInformation
**附註：**Horizon Cloud 不會針對任何因 AWS 服務控制原則 (SCP) 或其他標籤原則而設定為必填的標籤執行強制性標籤驗證。如果您的組織強制執行 AWS 服務控制原則 (SCP) 或標籤原則，請在部署 Edge 之前確保所有必要的標籤都已套用至提供者。如果缺少原則要求的標籤，Horizon Edge、Edge Gateway 與 UAG 的部署可能會失敗。如需詳細資訊，請參閱使用 Amazon 資源標籤。
複製並使用下列 JSON 檔案
如果您選擇使用 JSON 檔案方法，請將以下 JSON 指令碼複製到 AWS IAM 主控台的原則編輯器中：
JSON 指令碼
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "workspaces:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "fsx:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ds:DescribeDirectories",
"ds:AuthorizeApplication",
"ds:UnauthorizeApplication",
"ds:UpdateAuthorizedApplication"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:TagResource",
"cloudformation:UntagResource",
"cloudformation:DescribeStackEvents",
"cloudformation:ListStackResources",
"cloudformation:GetTemplate"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resource-groups:GetGroup",
"resource-groups:CreateGroup",
"resource-groups:DeleteGroup",
"resource-groups:UpdateGroup",
"resource-groups:Tag",
"resource-groups:Untag",
"resource-groups:GetTags",
"resource-groups:ListGroups",
"resource-groups:ListGroupResources",
"resource-groups:ListResourceTypes",
"resource-groups:AssociateResource",
"resource-groups:DisassociateResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"elasticloadbalancing:AddTags",
"elasticloadbalancing:RemoveTags",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:CreateListener",
"elasticloadbalancing:DeleteListener",
"elasticloadbalancing:DescribeListeners",
"elasticloadbalancing:CreateTargetGroup",
"elasticloadbalancing:DeleteTargetGroup",
"elasticloadbalancing:ModifyTargetGroup",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:CreateLoadBalancer",
"elasticloadbalancing:DeleteLoadBalancer",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:ModifyLoadBalancerAttributes",
"elasticloadbalancing:ModifyTargetGroupAttributes",
"elasticloadbalancing:SetSubnets"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket",
"s3:ListAllMyBuckets",
"s3:CreateBucket",
"s3:DeleteObject",
"s3:DeleteBucket",
"s3:PutBucketPolicy",
"s3:GetBucketPolicy",
"s3:DeleteBucketPolicy",
"s3:PutBucketTagging",
"s3:GetBucketLocation",
"s3:PutLifecycleConfiguration",
"s3:PutBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"iam:GetRole",
"iam:PassRole",
"iam:CreateRole",
"iam:GetPolicy",
"iam:PutRolePolicy",
"iam:GetPolicyVersion",
"iam:ListAttachedUserPolicies",
"iam:GetInstanceProfile",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:CreateServiceLinkedRole",
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:SimulatePrincipalPolicy",
"iam:DeleteRole",
"iam:AttachRolePolicy",
"iam:DetachRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListInstanceProfilesForRole"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"tag:GetResources",
"tag:TagResources",
"tag:UntagResources"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:ReEncrypt*",
"kms:GenerateDataKey*",
"kms:DescribeKey",
"kms:ListKeys",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ssm:SendCommand",
"ssm:StartSession",
"ssm:CreateAssociation",
"ssm:DescribeAssociation",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:DescribeInstanceInformation"
],
"Resource": "*"
}
]
}建立 IAM 角色
IAM 角色是一種您可以在帳戶中建立的 IAM 身分，具有特定的權限。IAM 角色與 IAM 使用者類似，都是具有權限原則的 AWS 身分，用以決定該身分在 AWS 中可以或不可以執行的操作。然而，角色並不是唯一關聯至某個使用者，而是設計成可由需要的任何人承擔。此外，角色不具備與其關聯的標準長期認證，例如密碼或存取金鑰。相反地，當您承擔角色時，會為您的角色工作階段提供臨時安全認證。
依照以下步驟，您可以在 AWS 中建立一個 IAM 角色，為角色工作階段提供臨時安全認證，以便存取 Horizon Cloud，同時確保安全存取您的 AWS 資源。
- 在 IAM 主控台中，導覽至您的 AWS 帳戶的 IAM (身分識別與存取管理) 區域。
- 在左側窗格中按一下角色。
- 按一下建立角色，並選取自訂信任原則。
- 在自訂信任原則編輯器中輸入下列 JSON 指令碼，以定義自訂信任原則。
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::211125714243:user/svc.hcs-ng-prod-svc-user"
]
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "{create a custom ExternalId}"
}
}
}
]
}
此頁面對您有幫助嗎?