本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
适用于 Amazon Q 开发者的基于身份的政策示例
以下示例 IAM 策略控制各种 Amazon Q 开发者操作的权限。使用它们来允许或拒绝 Amazon Q 开发者访问您的用户、角色或群组。
有关您可以通过策略控制的所有 Amazon Q 权限的列表，请参阅Amazon Q 开发者权限参考。
注意
以下示例策略授予使用 Amazon Q Developer 功能的权限，但用户可能需要额外的权限才能通过订阅 Amazon Q Developer Pro 来访问 Amazon Q。有关更多信息，请参阅 允许用户通过订阅 Amazon Q Developer Pro 来访问 Amazon Q。
您可以使用以下书面政策，也可以为要使用的各个 Amazon Q 功能添加权限。有关您可以创建的允许访问特定功能的策略示例，请参阅适用于 Amazon Q 开发者的基于身份的政策示例。
有关使用 Amazon Q 配置 IAM 权限的更多信息，请参阅使用政策管理对 Amazon Q 开发者的访问权限。
有关这些权限的功能的更多信息，请参阅Amazon Q 开发者权限参考。
为 Amazon Q 开发者专业版订阅创建管理员
以下政策授权用户查看和管理 Amazon Q Developer 的订阅以及使用 Amazon Q 订阅控制台。
注意
前codewhisperer缀是与 Amazon Q Developer 合并的服务的旧名称。有关更多信息，请参阅 Amazon Q 开发者重命名-变更摘要。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "organizations:ListAWSServiceAccessForOrganization", "organizations:DisableAWSServiceAccess", "organizations:EnableAWSServiceAccess", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso:ListApplications", "sso:ListInstances", "sso:DescribeRegisteredRegions", "sso:GetSharedSsoConfiguration", "sso:DescribeInstance", "sso:CreateApplication", "sso:PutApplicationAuthenticationMethod", "sso:PutApplicationAssignmentConfiguration", "sso:PutApplicationGrant", "sso:PutApplicationAccessScope", "sso:DescribeApplication", "sso:DeleteApplication", "sso:GetSSOStatus", "sso:CreateApplicationAssignment", "sso:DeleteApplicationAssignment" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso-directory:DescribeUsers", "sso-directory:DescribeGroups", "sso-directory:SearchGroups", "sso-directory:SearchUsers", "sso-directory:DescribeGroup", "sso-directory:DescribeUser", "sso-directory:DescribeDirectory" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "signin:ListTrustedIdentityPropagationApplicationsForConsole", "signin:CreateTrustedIdentityPropagationApplicationForConsole" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codewhisperer:ListProfiles", "codewhisperer:CreateProfile", "codewhisperer:DeleteProfile" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "user-subscriptions:ListClaims", "user-subscriptions:ListUserSubscriptions", "user-subscriptions:CreateClaim", "user-subscriptions:DeleteClaim", "user-subscriptions:UpdateClaim" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "q:CreateAssignment", "q:DeleteAssignment" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/user-subscriptions.amazonaws.com/AWSServiceRoleForUserSubscriptions" ] } ] }
为 Amazon Q Developer Pro 创建管理员
以下政策允许用户采取与 Amazon Q 开发者相关的所有管理操作，包括访问 Amazon Q 开发者控制台。但是，根据企业的结构，您可以选择将这些权力分配给多个角色。
您可能需要两个策略中的一个才能采取与 Amazon Q 开发者相关的管理操作并使用 Amazon Q 开发者控制台。对于 Amazon Q 开发人员的新管理员，请使用以下政策：
注意
前codewhisperer缀是与 Amazon Q Developer 合并的服务的旧名称。有关更多信息，请参阅 Amazon Q 开发者重命名-变更摘要。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sso-directory:GetUserPoolInfo" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso:DescribeRegisteredRegions", "sso:GetSSOStatus" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:CreateGrant", "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey*", "kms:RetireGrant", "kms:DescribeKey" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:UpdateAccountConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/q.amazonaws.com/AWSServiceRoleForAmazonQDeveloper" ] }, { "Effect": "Allow", "Action": [ "codewhisperer:UpdateProfile", "codewhisperer:ListProfiles", "codewhisperer:TagResource", "codewhisperer:UnTagResource", "codewhisperer:ListTagsForResource", "codewhisperer:CreateProfile" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics" ], "Resource": [ "*" ] } ] }
对于旧版 Amazon CodeWhisperer 个人资料，以下策略将允许 IAM 委托人管理 CodeWhisperer 应用程序。
注意
前codewhisperer缀是与 Amazon Q Developer 合并的服务的旧名称。有关更多信息，请参阅 Amazon Q 开发者重命名-变更摘要。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sso-directory:SearchUsers", "sso-directory:SearchGroups", "sso-directory:GetUserPoolInfo", "sso-directory:DescribeDirectory", "sso-directory:ListMembersInGroup" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:ListRoles" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "pricing:GetProducts" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sso:AssociateProfile", "sso:DisassociateProfile", "sso:GetProfile", "sso:ListProfiles", "sso:ListApplicationInstances", "sso:GetApplicationInstance", "sso:CreateManagedApplicationInstance", "sso:GetManagedApplicationInstance", "sso:ListProfileAssociations", "sso:GetSharedSsoConfiguration", "sso:ListDirectoryAssociations", "sso:DescribeRegisteredRegions", "sso:GetSsoConfiguration", "sso:GetSSOStatus", "sso:ListProfiles" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "identitystore:ListUsers", "identitystore:ListGroups" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "organizations:DescribeAccount", "organizations:DescribeOrganization" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "kms:ListAliases", "kms:CreateGrant", "kms:Encrypt", "kms:Decrypt", "kms:GenerateDataKey*", "kms:RetireGrant", "kms:DescribeKey" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "codeguru-security:UpdateAccountConfiguration" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": [ "arn:aws:iam::*:role/aws-service-role/q.amazonaws.com/AWSServiceRoleForAmazonQDeveloper" ] }, { "Effect": "Allow", "Action": [ "codewhisperer:UpdateProfile", "codewhisperer:ListProfiles", "codewhisperer:TagResource", "codewhisperer:UnTagResource", "codewhisperer:ListTagsForResource", "codewhisperer:CreateProfile" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "cloudwatch:GetMetricData", "cloudwatch:ListMetrics" ], "Resource": [ "*" ] } ] }
注意
如果您使用的是自定义，那么您的 Amazon Q 开发者管理员将需要额外的权限。有关更多信息，请参阅自定义的先决条件。
要了解有关 IAM 策略的更多信息，请参阅 IAM 用户指南中的访问管理。
在 AWS 网站上为 Amazon Q 添加 IAM 权限
要在 AWS 应用程序和网站上使用 Amazon Q 开发者功能，您必须附加相应的 AWS Identity and Access Management (IAM) 权限。以下是您可以用来访问 AWS 应用程序和网站上大多数 Amazon Q 功能的策略示例：
注意
Amazon Q 功能的可用性取决于您使用 Amazon Q 的环境。有关可在何处访问该功能以及使用该功能所需的特定权限的更多信息，请参阅您要使用的功能的主题。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "q:SendMessage", "q:StartConversation", "q:GetConversation", "q:ListConversations", "q:GetIdentityMetaData", "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult", "q:PassRequest" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "ce:GetCostAndUsage" ], "Resource": [ "*" ] }, { "Effect": "Allow", "Action": [ "sts:setContext" ], "Resource": [ "arn:aws:sts::*:self" ] } ] }
允许用户通过订阅 Amazon Q Developer Pro 来访问 Amazon Q
以下示例策略授予在订阅 Amazon Q Developer Pro 时使用 Amazon Q 的权限。如果没有这些权限，用户只能访问 Amazon Q 的免费套餐。要与 Amazon Q 聊天或使用其他 Amazon Q 功能，用户需要额外的权限，例如本节示例策略所授予的权限。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowGetIdentity", "Effect": "Allow", "Action": [ "q:GetIdentityMetaData" ], "Resource": "*" }, { "Sid": "AllowSetTrustedIdentity", "Effect": "Allow", "Action": [ "sts:SetContext" ], "Resource": "arn:aws:sts::*:self" } ] }
允许用户与 Amazon Q 聊天
以下示例策略授予在控制台中与 Amazon Q 聊天的权限。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQConversationAccess", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations" ], "Resource": "*" } ] }
允许用户使用 Amazon Q 诊断控制台错误
以下示例策略授予使用 Amazon Q 诊断控制台错误的权限。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQTroubleshooting", "Effect": "Allow", "Action": [ "q:StartTroubleshootingAnalysis", "q:GetTroubleshootingResults", "q:StartTroubleshootingResolutionExplanation", "q:UpdateTroubleshootingCommandResult" ], "Resource": "*" } ] }
允许 Amazon Q 代表您执行操作
以下示例策略授予与 Amazon Q 聊天的权限，并允许 Amazon Q 代表您执行操作。Amazon Q 仅有权执行您的 IAM 身份有权执行的操作。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAmazonQPassRequest", "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest" ], "Resource": "*" } ] }
拒绝 Amazon Q 代表您执行特定操作的权限
以下示例策略授予与 Amazon Q 聊天的权限，并允许 Amazon Q 代表您执行您的 IAM 身份有权执行的任何操作，Amazon EC2 操作除外。该策略使用aws:CalledVia全局条件密钥指定只有在 Amazon Q 调用 Amazon EC2 操作时才会被拒绝。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "ec2:*" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": ["q.amazonaws.com"] } } } ] }
允许 Amazon Q 代表您执行特定操作
以下示例策略授予与 Amazon Q 聊天的权限，并允许 Amazon Q 代表您执行您的 IAM 身份有权执行的任何操作，但 Amazon EC2 操作除外。此政策授予您的 IAM 身份执行任何 Amazon EC2 操作的权限，但仅允许 Amazon Q 执行该ec2:describeInstances操作。该策略使用aws:CalledVia全局条件密钥来指定 Amazon Q 只能调用ec2:describeInstances，不允许调用任何其他 Amazon EC2 操作。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:*" ], "Resource": "*", "Condition": { "ForAnyValue:StringNotEquals": { "aws:CalledVia": ["q.amazonaws.com"] } } }, { "Effect": "Allow", "Action": [ "ec2:describeInstances" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": ["q.amazonaws.com"] } } } ] }
允许 Amazon Q 在特定地区代表您执行操作
以下示例策略授予与 Amazon Q 聊天的权限，并允许 Amazon Q 在代表您执行操作时仅拨打us-east-1和us-west-2地区的电话。Amazon Q 无法拨打任何其他地区的电话。有关如何指定可以拨打哪些区域的更多信息，请参阅《AWS Identity and Access Management 用户指南》RequestedRegion中的 a ws:。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "q:StartConversation", "q:SendMessage", "q:GetConversation", "q:ListConversations", "q:PassRequest" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestedRegion": [ "us-east-1", "us-west-2" ] } } } ] }
拒绝 Amazon Q 代表您执行操作的权限
以下示例政策阻止 Amazon Q 代表您执行操作。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAmazonQPassRequest", "Effect": "Deny", "Action": [ "q:PassRequest" ], "Resource": "*" } ] }
拒绝访问 Amazon Q
以下示例策略拒绝所有使用 Amazon Q 的权限。
注意
拒绝访问 Amazon Q 不会禁用 AWS 控制台、 AWS 网站、 AWS 文档页面或 Amazon Q 图标或聊天面板 AWS Console Mobile Application。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAmazonQFullAccess", "Effect": "Deny", "Action": [ "q:*" ], "Resource": "*" } ] }
允许用户查看他们的权限
该示例说明了您如何创建策略，以允许 IAM 用户查看附加到其用户身份的内联和托管策略。此策略包括在控制台上或使用 AWS CLI 或 AWS API 以编程方式完成此操作的权限。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "ViewOwnUserInfo", "Effect": "Allow", "Action": [ "iam:GetUserPolicy", "iam:ListGroupsForUser", "iam:ListAttachedUserPolicies", "iam:ListUserPolicies", "iam:GetUser" ], "Resource": ["arn:aws:iam::*:user/${aws:username}"] }, { "Sid": "NavigateInConsole", "Effect": "Allow", "Action": [ "iam:GetGroupPolicy", "iam:GetPolicyVersion", "iam:GetPolicy", "iam:ListAttachedGroupPolicies", "iam:ListGroupPolicies", "iam:ListPolicyVersions", "iam:ListPolicies", "iam:ListUsers" ], "Resource": "*" } ] }
