本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 使用条件键
<a name="IAM.ConditionKeys"></a>

您可以指定决定 IAM 策略如何生效的条件。在中 ElastiCache，您可以使用 JSON 策略的`Condition`元素将请求上下文中的密钥与您在策略中指定的密钥值进行比较。有关更多信息，请参阅 [IAM JSON 策略元素：条件](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)。

要查看 ElastiCache 条件密钥列表，请参阅《*服务授权参考*》 ElastiCache中的 [Amazon 条件密钥](https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonelasticache.html#amazonelasticache-policy-keys)。

有关全局条件键的列表，请参阅 [AWS全局条件上下文键](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html)。

** ElastiCache 与AWS全局条件键一起使用**

当使用需要 ElastiCache的 “[主体](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html#principal-services)” 的[AWS全局条件键](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html)时，请使用*同时*包含主体:`elasticache.amazonaws.com`和`ec.amazonaws.com`的`OR`条件。

**注意**  
如果您不同时为其添加两个委托人 ElastiCache，则无法对策略中列出的任何资源正确执行预期的 “允许” 或 “拒绝” 操作。

 带有 `aws:CalledVia` 全局条件键的策略示例：

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:*", 
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringLike": {
          "aws:CalledVia": [
            "ec.amazonaws.com",
            "elasticache.amazonaws.com"
          ]
        }
      }
    }
  ]
}
```

------

## 指定条件：使用条件键
<a name="IAM.SpecifyingConditions"></a>

要实现精细控制，您需要编写 IAM 权限策略，用于指定控制某些请求上单独参数集的条件。然后，将该策略应用于您使用 IAM 控制台创建的 IAM 用户、组或角色。

要应用条件，请将条件信息添加到 IAM policy 语句。在以下示例中，您指定了条件，为创建的所有基于节点的集群使用节点类型 `cache.r5.large`。

**注意**  
要使用 `String` 类型的条件键构造 `Condition` 元素，请使用不区分大小写的条件运算符 `StringEqualsIgnoreCase` 或 `StringNotEqualsIgnoreCase` 将键与字符串值进行比较。
ElastiCache 以不区分大小写的方式处理`CacheNodeType`和`CacheParameterGroupName`的输入参数。因此，在引用这些参数的权限策略中，应使用字符串条件运算符 `StringEqualsIgnoreCase` 和 `StringNotEqualsIgnoreCase`。

下面展示了使用 Valkey 或 Redis OSS 时的权限策略示例。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "elasticache:CreateCacheCluster",
                "elasticache:CreateReplicationGroup"
            ],
            "Resource": [
                "arn:aws:elasticache:*:*:parametergroup:*",
                "arn:aws:elasticache:*:*:subnetgroup:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticache:CreateCacheCluster",
                "elasticache:CreateReplicationGroup"
            ],
            "Resource": [
                "arn:aws:elasticache:*:*:cluster:*",
                "arn:aws:elasticache:*:*:replicationgroup:*"
            ],
            "Condition": {
                "StringEquals": {
                    "elasticache:CacheNodeType": [
                        "cache.r5.large"
                    ]
                }
            }
        }
    ]
}
```

------

下面展示了使用 Memcached 时的权限策略示例。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "elasticache:CreateCacheCluster"
            ],
            "Resource": [
                "arn:aws:elasticache:*:*:parametergroup:*",
                "arn:aws:elasticache:*:*:subnetgroup:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "elasticache:CreateCacheCluster"
            ],
            "Resource": [
                "arn:aws:elasticache:*:*:cluster:*"
            ],
            "Condition": {
                "StringEquals": {
                    "elasticache:CacheNodeType": [
                        "cache.r5.large"
                    ]
                }
            }
        }
    ]
}
```

------

有关更多信息，请参阅 [为资源添加 ElastiCache 标签](Tagging-Resources.md)。

有关使用策略条件运算符的更多信息，请参阅 [ElastiCache API 权限：操作、资源和条件参考](IAM.APIReference.md)。

## 策略示例：使用条件实现精细参数控制
<a name="IAM.ExamplePolicies"></a>

本节显示了对前面列出的 ElastiCache 参数实施细粒度访问控制的策略示例。

1. **elasticacheMaximumDataStorage:**: 指定无服务器缓存的最大数据存储空间。使用提供的条件，客户不能创建存储超过特定数量数据的缓存。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
           {
               "Sid": "AllowDependentResources",
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateServerlessCache"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:serverlesscachesnapshot:*",
                   "arn:aws:elasticache:*:*:snapshot:*",
                   "arn:aws:elasticache:*:*:usergroup:*"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateServerlessCache"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:serverlesscache:*"
               ],
               "Condition": {
                   "NumericLessThanEquals": {
                       "elasticache:MaximumDataStorage": "30"
                   },
                   "StringEquals": {
                       "elasticache:DataStorageUnit": "GB"
                   }
               }
           }
       ]
   }
   ```

------

1. **ElastiCache: 最大ECPUPer秒数**：指定无服务器缓存每秒的最大 ECPU 值。根据提供的条件，客户无法创建 ECPUs 每秒执行次数超过特定次数的缓存。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
           {
               "Sid": "AllowDependentResources",
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateServerlessCache"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:serverlesscachesnapshot:*",
                   "arn:aws:elasticache:*:*:snapshot:*",
                   "arn:aws:elasticache:*:*:usergroup:*"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateServerlessCache"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:serverlesscache:*"
               ],
               "Condition": {
                   "NumericLessThanEquals": {
                       "elasticache:MaximumECPUPerSecond": "100000"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheCacheNodeType:**: 指定用户可以创建哪 NodeType些。使用提供的条件，客户可以为节点类型指定单个值或范围值。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "StringEquals": {
                       "elasticache:CacheNodeType": [
                           "cache.t2.micro",
                           "cache.t2.medium"
                       ]
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheCacheNodeType:**: 使用 Memcached，指定用户可以创建哪 NodeType些。使用提供的条件，客户可以为节点类型指定单个值或范围值。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*"
               ],
               "Condition": {
                   "StringEquals": {
                       "elasticache:CacheNodeType": [
                           "cache.t2.micro",
                           "cache.t2.medium"
                       ]
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheNumNodeGroups:**: 创建节点组少于 20 个的复制组。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
               	"elasticache:CreateReplicationGroup"
               ],
               "Resource": [
               	"arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "NumericLessThanEquals": {
                       "elasticache:NumNodeGroups": "20"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheReplicasPerNodeGroup:**: 指定每个节点的副本数在 5 到 10 之间。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "NumericGreaterThanEquals": {
                       "elasticache:ReplicasPerNodeGroup": "5"
                   },
                   "NumericLessThanEquals": {
                       "elasticache:ReplicasPerNodeGroup": "10"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticache:EngineVersion:** 指定引擎版本 5.0.6 的用法。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
        {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
              "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "StringEquals": {
                       "elasticache:EngineVersion": "5.0.6"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticache:EngineVersion:** 指定 Memcached 引擎版本 1.6.6 的用法

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
        {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*"
               ],
               "Condition": {
                   "StringEquals": {
                       "elasticache:EngineVersion": "1.6.6"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticache:EngineType:** 仅使用 Valkey 或 Redis OSS 引擎进行指定。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "StringEquals": {
                       "elasticache:EngineType": "redis"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheAtRestEncryptionEnabled:**: 指定只有在启用加密的情况下才能创建复制组。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
   
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "Bool": {
                       "elasticache:AtRestEncryptionEnabled": "true"
                   }
               }
           }
       ]
   }
   ```

------

1. **弹性疼痛:TransitEncryptionEnabled**

   1. 将[CreateReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html)操作的`elasticache:TransitEncryptionEnabled`条件键设置为，以指定只有在不使用 TLS 时才能创建复制组：`false`

------
#### [ JSON ]

****  

      ```
      {
          "Version":"2012-10-17",		 	 	 
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "elasticache:CreateReplicationGroup"
                  ],
                  "Resource": [
                      "arn:aws:elasticache:*:*:parametergroup:*",
                      "arn:aws:elasticache:*:*:subnetgroup:*"
                  ]
              },
      
              {
                  "Effect": "Allow",
                  "Action": [
                      "elasticache:CreateReplicationGroup"
                  ],
                  "Resource": [
                      "arn:aws:elasticache:*:*:replicationgroup:*"
                  ],
                  "Condition": {
                      "Bool": {
                          "elasticache:TransitEncryptionEnabled": "false"
                      }
                  }
              }
          ]
      }
      ```

------

      在[CreateReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html)操作策略`false`中将`elasticache:TransitEncryptionEnabled`条件键设置为时，只有在未使用 TLS 的情况下（也就是说，请求中不包含设置为的`TransitEncryptionEnabled`参数`true`或设置为的`TransitEncryptionMode`参数），才允许请求`required`。`CreateReplicationGroup`

   1. 将[CreateReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html)操作`elasticache:TransitEncryptionEnabled`的条件键设置为，以指定只有在使用 TLS 时才能创建复制组：`true`

------
#### [ JSON ]

****  

      ```
      {
          "Version":"2012-10-17",		 	 	 
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "elasticache:CreateReplicationGroup"
                  ],
                  "Resource": [
                      "arn:aws:elasticache:*:*:parametergroup:*",
                      "arn:aws:elasticache:*:*:subnetgroup:*"
                  ]
              },
      
              {
                  "Effect": "Allow",
                  "Action": [
                      "elasticache:CreateReplicationGroup"
                  ],
                  "Resource": [
                      "arn:aws:elasticache:*:*:replicationgroup:*"
                  ],
                  "Condition": {
                      "Bool": {
                          "elasticache:TransitEncryptionEnabled": "true"
                      }
                  }
              }
          ]
      }
      ```

------

      在[CreateReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_CreateReplicationGroup.html)操作策略`true`中将`elasticache:TransitEncryptionEnabled`条件键设置为时，只有在`CreateReplicationGroup`请求中包含设置为的参数`true`和设置为的`TransitEncryptionEnabled`参数时，`TransitEncryptionMode`才允许请求`required`。

   1. 针对 `ModifyReplicationGroup` 操作将 `elasticache:TransitEncryptionEnabled` 设置为 `true`，以指定只有在使用 TLS 时才能修改复制组：

------
#### [ JSON ]

****  

      ```
      {
          "Version":"2012-10-17",		 	 	 
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [               
                      "elasticache:ModifyReplicationGroup"
                  ],
                  "Resource": [               
                      "arn:aws:elasticache:*:*:replicationgroup:*"
                  ],
                  "Condition": {
                      "BoolIfExists": {
                          "elasticache:TransitEncryptionEnabled": "true"
                      }
                  }
              }
          ]
      }
      ```

------

      在[ModifyReplicationGroup](https://docs.aws.amazon.com/AmazonElastiCache/latest/APIReference/API_ModifyReplicationGroup.html)操作策略`true`中将`elasticache:TransitEncryptionEnabled`条件键设置为时，只有当`ModifyReplicationGroup`请求包含设置为的`TransitEncryptionMode`参数时，才允许请求`required`。也可以选择包含设置为 `true` 的 `TransitEncryptionEnabled` 参数，但在这种情况下，该设置并不是启用 TLS 所必需的。

1. **elasticacheAutomaticFailoverEnabled:**: 指定只有在启用自动故障转移的情况下才能创建复制组。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "Bool": {
                       "elasticache:AutomaticFailoverEnabled": "true"
                   }
               }
           }
       ]
   }
   ```

------

1. **ElastiCache: Multi AZEnabled**：指定在禁用多可用区的情况下无法创建复制组。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
           {
               "Effect": "Deny",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "Bool": {
                       "elasticache:MultiAZEnabled": "false"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheClusterModeEnabled:**: 指定只有在启用集群模式的情况下才能创建复制组。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "Bool": {
                       "elasticache:ClusterModeEnabled": "true"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheAuthTokenEnabled:**: 指定只有在启用身份验证令牌的情况下才能创建复制组。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
   
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "Bool": {
                       "elasticache:AuthTokenEnabled": "true"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheSnapshotRetentionLimit:**: 指定保存快照的天数（或最小/最大）。以下策略强制将备份存储至少 30 天。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
   
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup",
                   "elasticache:CreateServerlessCache"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*",
                   "arn:aws:elasticache:*:*:serverlesscache:*"
               ],
               "Condition": {
                   "NumericGreaterThanEquals": {
                       "elasticache:SnapshotRetentionLimit": "30"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticache:KmsKeyId:** 指定客户托管的AWS KMS 密钥的使用情况。

------
#### [ JSON ]

****  

   ```
   {
     "Version":"2012-10-17",		 	 	 
     "Statement": [
       {
           "Sid": "AllowDependentResources",
           "Effect": "Allow",
           "Action": [
               "elasticache:CreateServerlessCache"
           ],
           "Resource": [
               "arn:aws:elasticache:*:*:serverlesscachesnapshot:*",
               "arn:aws:elasticache:*:*:snapshot:*",
               "arn:aws:elasticache:*:*:usergroup:*"
           ]
       },
       {
           "Effect": "Allow",
           "Action": [
               "elasticache:CreateServerlessCache"
           ],
           "Resource": [
               "arn:aws:elasticache:*:*:serverlesscache:*"
           ],
           "Condition": {
               "StringEquals": {
                   "elasticache:KmsKeyId": "my-key"
               }
           }
       }
     ]
   }
   ```

------

1. **elasticacheCacheParameterGroupName:**: 指定一个非默认参数组，其中包含来自集群上某个组织的特定参数。您还可以为参数组指定命名模式，或阻止删除特定参数组名称。以下是限制仅使用 “my-org-param-group” 的示例。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
   
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:CreateReplicationGroup"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ],
               "Condition": {
                   "StringEquals": {
                       "elasticache:CacheParameterGroupName": "my-org-param-group"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheCacheParameterGroupName:**: 使用 Memcached，使用集群上来自组织的特定参数来指定一个非默认参数组。您还可以为参数组指定命名模式，或阻止删除特定参数组名称。以下是限制仅使用 “my-org-param-group” 的示例。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
   
            {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*"
               ]
           },
   
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*"
               ],
               "Condition": {
                   "StringEquals": {
                       "elasticache:CacheParameterGroupName": "my-org-param-group"
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticacheCreateCacheCluster:**: 如果请求标签`Project`缺失或不等于`Dev`、`QA`或，则拒绝`CreateCacheCluster`执行操作。`Prod`

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
             {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:parametergroup:*",
                   "arn:aws:elasticache:*:*:subnetgroup:*",
                   "arn:aws:elasticache:*:*:securitygroup:*",
                   "arn:aws:elasticache:*:*:replicationgroup:*"
               ]
           },
           {
               "Effect": "Deny",
               "Action": [
                   "elasticache:CreateCacheCluster"
               ],
               "Resource": [
                   "arn:aws:elasticache:*:*:cluster:*"
               ],
               "Condition": {
                   "Null": {
                       "aws:RequestTag/Project": "true"
                   }
               }
           },
           {
               "Effect": "Allow",
               "Action": [
                   "elasticache:CreateCacheCluster",
                   "elasticache:AddTagsToResource"
               ],
               "Resource": "arn:aws:elasticache:*:*:cluster:*",
               "Condition": {
                   "StringEquals": {
                       "aws:RequestTag/Project": [
                           "Dev",
                           "Prod",
                           "QA"
                       ]
                   }
               }
           }
       ]
   }
   ```

------

1. **elasticache:CacheNodeType: 允许`CreateCacheCluster`使用 cache** .r5.large 或 `cacheNodeType` cache.r6g.4xlarge 和 tag。`Project=XYZ`

------
#### [ JSON ]

****  

   ```
   {
     "Version":"2012-10-17",		 	 	 
     "Statement": [
         {
         "Effect": "Allow",
         "Action": [
           "elasticache:CreateCacheCluster",
           "elasticache:CreateReplicationGroup"
         ],
         "Resource": [
           "arn:aws:elasticache:*:*:parametergroup:*",
           "arn:aws:elasticache:*:*:subnetgroup:*"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "elasticache:CreateCacheCluster"
         ],
         "Resource": [
           "arn:aws:elasticache:*:*:cluster:*"
         ],
         "Condition": {
           "StringEqualsIfExists": {
             "elasticache:CacheNodeType": [
               "cache.r5.large",
               "cache.r6g.4xlarge"
             ]
           },
           "StringEquals": {
             "aws:RequestTag/Project": "XYZ"
           }
         }
       }
     ]
   }
   ```

------

1. **elasticache:CacheNodeType: 允许`CreateCacheCluster`使用 cache** .r5.large 或 `cacheNodeType` cache.r6g.4xlarge 和 tag。`Project=XYZ`

------
#### [ JSON ]

****  

   ```
   {
     "Version":"2012-10-17",		 	 	 
     "Statement": [
         {
         "Effect": "Allow",
         "Action": [
           "elasticache:CreateCacheCluster"
         ],
         "Resource": [
           "arn:aws:elasticache:*:*:parametergroup:*",
           "arn:aws:elasticache:*:*:subnetgroup:*"
         ]
       },
       {
         "Effect": "Allow",
         "Action": [
           "elasticache:CreateCacheCluster"
         ],
         "Resource": [
           "arn:aws:elasticache:*:*:cluster:*"
         ],
         "Condition": {
           "StringEqualsIfExists": {
             "elasticache:CacheNodeType": [
               "cache.r5.large",
               "cache.r6g.4xlarge"
             ]
           },
           "StringEquals": {
             "aws:RequestTag/Project": "XYZ"
           }
         }
       }
     ]
   }
   ```

------

**注意**  
在创建策略以将标签和其他条件键一起强制执行时，由于使用 `--tags` 参数创建请求的额外 `elasticache:AddTagsToResource` 策略要求，条件键元素可能需要条件 `IfExists`。