本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # AWSTransformApplicationECSDeploymentPolicy **描述**：启用 AWS 转换，使用 Fargate 将应用程序部署到亚马逊弹性容器服务 (ECS)。它授予预置、配置和管理在 ECS 上运行应用程序所需的底层基础架构的权限。 `AWSTransformApplicationECSDeploymentPolicy` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 您可以将 `AWSTransformApplicationECSDeploymentPolicy` 附加到您的用户、组和角色。 ## 策略详细信息 + **类型**：服务角色策略 + **创建时间**：2025 年 9 月 29 日 22:49 UTC + **编辑时间：世界标准时间** 2026 年 2 月 12 日 18:02 + **ARN**: `arn:aws:iam::aws:policy/service-role/AWSTransformApplicationECSDeploymentPolicy` ## 策略版本 **策略版本：**v6（默认） 此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Action" : "cloudformation:CreateStack", "Resource" : "arn:aws:cloudformation:*:*:stack/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:RequestTag/CreatedBy" : "AWSTransform" } } }, { "Effect" : "Allow", "Action" : [ "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource" : "arn:aws:cloudformation:*:*:stack/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:ResourceTag/CreatedBy" : "AWSTransform" } } }, { "Effect" : "Allow", "Action" : [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents" ], "Resource" : "arn:aws:cloudformation:*:*:stack/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Allow", "Action" : "ecs:CreateCluster", "Resource" : "arn:aws:ecs:*:*:cluster/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:RequestTag/CreatedBy" : "AWSTransform" } } }, { "Effect" : "Allow", "Action" : [ "ecs:UpdateCluster", "ecs:DeleteCluster" ], "Resource" : "arn:aws:ecs:*:*:cluster/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "ecs:ResourceTag/CreatedBy" : "AWSTransform" } } }, { "Effect" : "Allow", "Action" : "ecs:RegisterTaskDefinition", "Resource" : "arn:aws:ecs:*:*:task-definition/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:RequestTag/CreatedBy" : "AWSTransform" } } }, { "Effect" : "Allow", "Action" : "ecs:RunTask", "Resource" : "arn:aws:ecs:*:*:task-definition/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:ResourceTag/CreatedBy" : "AWSTransform" }, "ArnLike" : { "ecs:cluster" : "arn:aws:ecs:*:*:cluster/AWSTransform*" } } }, { "Effect" : "Allow", "Action" : "ecs:ListTasks", "Resource" : "arn:aws:ecs:*:*:container-instance/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ArnLike" : { "ecs:cluster" : "arn:aws:ecs:*:*:cluster/AWSTransform*" } } }, { "Effect" : "Allow", "Action" : "ecs:DescribeTasks", "Resource" : "arn:aws:ecs:*:*:task/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ArnLike" : { "ecs:cluster" : "arn:aws:ecs:*:*:cluster/AWSTransform*" } } }, { "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/AWSTransform-Deploy-ECS-Task-Role", "arn:aws:iam::*:role/AWSTransform-Deploy-ECS-Execution-Role" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "iam:PassedToService" : [ "ecs-tasks.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:GetRolePolicy", "iam:ListRolePolicies", "iam:ListAttachedRolePolicies" ], "Resource" : [ "arn:aws:iam::*:role/AWSTransform-Deploy-ECS-Task-Role", "arn:aws:iam::*:role/AWSTransform-Deploy-ECS-Execution-Role" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Allow", "Action" : "ecs:CreateService", "Resource" : "arn:aws:ecs:*:*:service/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:RequestTag/CreatedBy" : "AWSTransform" } } }, { "Effect" : "Allow", "Action" : [ "ecs:UpdateService", "ecs:DeleteService" ], "Resource" : "arn:aws:ecs:*:*:service/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "ecs:ResourceTag/CreatedBy" : "AWSTransform" } } }, { "Effect" : "Allow", "Action" : [ "ecs:TagResource", "ecs:UntagResource" ], "Resource" : [ "arn:aws:ecs:*:*:cluster/AWSTransform*", "arn:aws:ecs:*:*:task-definition/AWSTransform*", "arn:aws:ecs:*:*:service/AWSTransform*", "arn:aws:ecs:*:*:task/AWSTransform*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "ResourceName", "CreatedBy", "TransformationType" ] } } }, { "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:TagResource" ], "Resource" : "arn:aws:logs:*:*:log-group:/aws/ecs/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:RequestTag/CreatedBy" : "AWSTransform" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "ResourceName", "CreatedBy", "TransformationType" ] } } }, { "Effect" : "Allow", "Action" : [ "logs:DeleteLogGroup", "logs:PutRetentionPolicy" ], "Resource" : "arn:aws:logs:*:*:log-group:/aws/ecs/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Allow", "Action" : "logs:UntagResource", "Resource" : "arn:aws:logs:*:*:log-group:/aws/ecs/AWSTransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "ResourceName", "CreatedBy", "TransformationType" ] } } }, { "Effect" : "Allow", "Action" : "logs:GetLogEvents", "Resource" : "arn:aws:logs:*:*:log-group:/aws/ecs/AWSTransform*:log-stream:*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Allow", "Action" : [ "ecr:CreateRepository", "ecr:TagResource" ], "Resource" : "arn:aws:ecr:*:*:repository/awstransform*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:RequestTag/CreatedBy" : "AWSTransform" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "ResourceName", "CreatedBy", "TransformationType" ] } } }, { "Effect" : "Allow", "Action" : [ "ecs:DescribeClusters", "ecs:DescribeServices", "ec2:DescribeSecurityGroups", "ec2:DescribeNetworkInterfaces", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:ListTagsForResource" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : "arn:aws:iam::*:role/aws-service-role/ecs.amazonaws.com/AWSServiceRoleForECS", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "ecs.amazonaws.com" } } }, { "Effect" : "Allow", "Action" : [ "kms:CreateGrant" ], "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "Bool" : { "kms:GrantIsForAWSResource" : "true" }, "StringLike" : { "kms:ViaService" : [ "ecr.*.amazonaws.com" ], "kms:EncryptionContext:aws:ecr:arn" : "*" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "kms:GrantConstraintType" : "EncryptionContextSubset" }, "ForAllValues:StringEquals" : { "kms:GrantOperations" : [ "Decrypt", "GenerateDataKey" ] } } } ] } ``` ## 了解详情 + [在 IAM Identity Center 中使用 AWS 托管策略创建权限集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [添加和删除 IAM 身份权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM policy 版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略，转向最低权限权限](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)