账户访问权限管理器中的安全性
本节介绍特定于账户访问权限管理器的安全信息。本节对 IAM 和 AWS STS 中的安全性 中的信息进行了补充，后者涵盖了适用于 IAM 整体的各个安全主题。
账户访问权限管理器的身份和访问权限管理
以下各节介绍您执行以下操作时所需的权限：
-
在组织管理账户中管理账户访问权限管理器
-
使用委托管理员账户管理账户访问权限管理器
使用组织管理账户管理账户访问权限管理器
要管理 AWS 组织管理账户中的账户访问权限管理器设置，您需要以下权限：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AAMCreateApplication", "Effect": "Allow", "Action": "account-access:CreateApplication", "Resource": "*" }, { "Sid": "AAMApplicationAndEntitlementManagement", "Effect": "Allow", "Action": [ "account-access:CreateEntitlement", "account-access:DeleteApplication", "account-access:DeleteEntitlement", "account-access:GetApplication", "account-access:GetEntitlement", "account-access:ListEntitlements", "account-access:ListTagsForResource", "account-access:TagResource", "account-access:UntagResource" ], "Resource": "arn:aws:account-access:*:111122223333:application/*" }, { "Sid": "AAMListApplications", "Effect": "Allow", "Action": "account-access:ListApplications", "Resource": "*" }, { "Sid": "DependentIdentityCenterActions", "Effect": "Allow", "Action": [ "sso:CreateApplication", "sso:DeleteApplication", "sso:DescribeApplication", "sso:DescribeInstance", "sso:DescribeRegion", "sso:ListInstances", "sso:PutApplicationAccessScope", "sso:PutApplicationAssignmentConfiguration", "sso:PutApplicationAuthenticationMethod", "sso:PutApplicationGrant" ], "Resource": "*" }, { "Sid": "DependentIdentityStoreActions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMemberships", "sso-directory:DescribeGroup", "sso-directory:DescribeGroups", "sso-directory:DescribeUser", "sso-directory:DescribeUsers", "sso-directory:ListGroupsForUser", "sso-directory:ListMembersInGroup", "sso-directory:SearchGroups", "sso-directory:SearchUsers" ], "Resource": "*" }, { "Sid": "DependentOrganizationsActions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListRoots" ], "Resource": "*" }, { "Sid": "DependentKMSActions", "Effect": "Allow", "Action": "kms:Decrypt", "Resource": "*" }, { "Sid": "CreateServiceLinkedRole", "Effect": "Allow", "Action": "iam:CreateServiceLinkedRole", "Resource": "arn:aws:iam::111122223333:role/aws-service-role/account-access.amazonaws.com/AWSServiceRoleForAccountAccessManager", "Condition": { "StringEquals": { "iam:AWSServiceName": "account-access.amazonaws.com" } } } ] }
可选：要按标签限制 account-access:CreateApplication，将 AAMCreateApplication 语句替换为：
{ "Sid": "AAMCreateApplicationConstrainedByTag", "Effect": "Allow", "Action": "account-access:CreateApplication", "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/Environment": "Production" }, "ForAllValues:StringEquals": { "aws:TagKeys": [ "Environment" ] } } }
可选：要管理和注册账户访问权限管理器的委托管理员，添加：
{ "Sid": "ManageDelegatedAdministrator", "Effect": "Allow", "Action": [ "organizations:DeregisterDelegatedAdministrator", "organizations:RegisterDelegatedAdministrator" ], "Resource": "*", "Condition": { "StringEquals": { "organizations:ServicePrincipal": "account-access.amazonaws.com" } } }
要在不管理账户访问权限管理器设置的情况下，通过 AWS 组织管理账户向员工用户和组分配 IAM 角色，您需要以下权限：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AAMManageEntitlementsOnly", "Effect": "Allow", "Action": [ "account-access:CreateEntitlement", "account-access:DeleteEntitlement", "account-access:GetApplication", "account-access:GetEntitlement", "account-access:ListEntitlements" ], "Resource": "arn:aws:account-access:*:111122223333:application/*" }, { "Sid": "AAMListApplications", "Effect": "Allow", "Action": "account-access:ListApplications", "Resource": "*" }, { "Sid": "DependentIdentityCenterActions", "Effect": "Allow", "Action": "sso:ListInstances", "Resource": "*" }, { "Sid": "DependentIdentityStoreActions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMemberships", "sso-directory:DescribeGroup", "sso-directory:DescribeGroups", "sso-directory:DescribeUser", "sso-directory:DescribeUsers", "sso-directory:ListGroupsForUser", "sso-directory:ListMembersInGroup", "sso-directory:SearchGroups", "sso-directory:SearchUsers" ], "Resource": "*" }, { "Sid": "DependentOrganizationsActions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListRoots" ], "Resource": "*" } ] }
在委托管理员账户中管理账户访问权限管理器
要使用组织管理账户管理账户访问权限管理器设置，您需要以下权限：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AAMDelegatedAdminManagement", "Effect": "Allow", "Action": [ "account-access:CreateEntitlement", "account-access:DeleteEntitlement", "account-access:GetApplication", "account-access:GetEntitlement", "account-access:ListEntitlements", "account-access:ListTagsForResource", "account-access:TagResource", "account-access:UntagResource" ], "Resource": "arn:aws:account-access:*:111122223333:application/*" }, { "Sid": "AAMListApplications", "Effect": "Allow", "Action": "account-access:ListApplications", "Resource": "*" }, { "Sid": "DependentIdentityCenterActions", "Effect": "Allow", "Action": [ "sso:DescribeApplication", "sso:DescribeInstance", "sso:DescribeRegion", "sso:ListInstances" ], "Resource": "*" }, { "Sid": "DependentIdentityStoreActions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMemberships", "sso-directory:DescribeGroup", "sso-directory:DescribeGroups", "sso-directory:DescribeUser", "sso-directory:DescribeUsers", "sso-directory:ListGroupsForUser", "sso-directory:ListMembersInGroup", "sso-directory:SearchGroups", "sso-directory:SearchUsers" ], "Resource": "*" }, { "Sid": "DependentOrganizationsActions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListRoots" ], "Resource": "*" } ] }
要在不管理账户访问权限管理器设置的情况下，使用委托管理账户向员工用户和组分配 IAM 角色，您需要以下权限：
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AAMManageEntitlementsOnly", "Effect": "Allow", "Action": [ "account-access:CreateEntitlement", "account-access:DeleteEntitlement", "account-access:GetApplication", "account-access:GetEntitlement", "account-access:ListEntitlements" ], "Resource": "arn:aws:account-access:*:111122223333:application/*" }, { "Sid": "AAMListApplications", "Effect": "Allow", "Action": "account-access:ListApplications", "Resource": "*" }, { "Sid": "DependentIdentityCenterActions", "Effect": "Allow", "Action": "sso:ListInstances", "Resource": "*" }, { "Sid": "DependentIdentityStoreActions", "Effect": "Allow", "Action": [ "identitystore:DescribeGroup", "identitystore:DescribeUser", "identitystore:ListGroupMemberships", "sso-directory:DescribeGroup", "sso-directory:DescribeGroups", "sso-directory:DescribeUser", "sso-directory:DescribeUsers", "sso-directory:ListGroupsForUser", "sso-directory:ListMembersInGroup", "sso-directory:SearchGroups", "sso-directory:SearchUsers" ], "Resource": "*" }, { "Sid": "DependentOrganizationsActions", "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "organizations:ListAccountsForParent", "organizations:ListAWSServiceAccessForOrganization", "organizations:ListDelegatedAdministrators", "organizations:ListOrganizationalUnitsForParent", "organizations:ListRoots" ], "Resource": "*" } ] }
账户访问权限管理器中的数据保护
本节对 AWS Identity and Access Management 中的数据保护一节的信息进行了补充，并提供特定于账户访问权限管理器的其他详细信息。
IAM Identity Center 用户和组数据的使用
账户访问权限管理器使用来自 IAM Identity Center 的用户和组数据来管理账户分配。但是，账户访问权限管理器仅存储和记录 AWS 生成的标识符（用户 ID 和组 ID），不存储或记录用户名、电子邮件地址或其他个人属性。
账户访问权限管理器中的日志记录和监控
账户访问权限管理器使用自己的 API 命名空间 (account-access)，并通过 CloudTrail 记录 API 调用。
有关 CloudTrail 的更多信息，请参阅《AWS CloudTrail 用户指南》https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html。
