入门 AWS Supply Chain - AWS Supply Chain
使用 控制台

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

入门 AWS Supply Chain

在本节中，您可以学习创建 AWS Supply Chain 实例、授予用户权限角色、登录 AWS Supply Chain Web 应用程序以及创建自定义用户权限角色。最多 AWS 账户 可以有 10 个处于活动或初始化状态的 AWS Supply Chain 实例。

主题

使用 AWS Supply Chain 控制台

注意

如果您的 AWS 账户是某个 AWS 组织的成员账户并且包含服务控制策略 (SCP)，请确保该组织向该成员账户SCP授予以下权限。如果组织的SCP策略中未包含以下权限，则 AWS Supply Chain 实例创建将失败。

要访问 AWS Supply Chain 控制台，您必须拥有一组最低权限。这些权限必须允许您列出和查看有关您的 AWS Supply Chain 资源的详细信息 AWS 账户。如果创建比必需的最低权限更为严格的基于身份的策略，对于附加了该策略的实体（用户或角色），控制台将无法按预期正常运行。

您无需为仅拨打 AWS CLI 或的用户设置最低控制台权限 AWS API。相反，只允许访问与他们尝试执行的API操作相匹配的操作。

为确保用户和角色仍然可以使用 AWS Supply Chain 控制台，还需要将 AWS Supply Chain ConsoleAccess或ReadOnly AWS 托管策略附加到实体。有关更多信息，请参阅《用户指南》中的向IAM用户添加权限。

控制台管理员需要以下权限才能成功创建和更新 AWS Supply Chain 实例。

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Action": "scn:*",
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"s3:GetObject",
				"s3:PutObject",
				"s3:ListBucket",
				"s3:CreateBucket",
				"s3:PutBucketVersioning",
				"s3:PutBucketObjectLockConfiguration",
				"s3:PutEncryptionConfiguration",
				"s3:PutBucketPolicy",
				"s3:PutLifecycleConfiguration",
				"s3:PutBucketPublicAccessBlock",
				"s3:DeleteObject",
				"s3:ListAllMyBuckets",
				"s3:PutBucketOwnershipControls",
				"s3:PutBucketNotification",
				"s3:PutAccountPublicAccessBlock",
				"s3:PutBucketLogging",
				"s3:PutBucketTagging"
			],
			"Resource": "arn:aws:s3:::aws-supply-chain-*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"cloudtrail:CreateTrail",
				"cloudtrail:PutEventSelectors",
				"cloudtrail:GetEventSelectors",
				"cloudtrail:StartLogging"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"events:DescribeRule",
				"events:PutRule",
				"events:PutTargets"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"chime:CreateAppInstance",
				"chime:DeleteAppInstance",
				"chime:PutAppInstanceRetentionSettings",
				"chime:TagResource"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"cloudwatch:PutMetricData",
				"cloudwatch:Describe*",
				"cloudwatch:Get*",
				"cloudwatch:List*"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"organizations:DescribeOrganization",
				"organizations:EnableAWSServiceAccess"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"kms:CreateGrant",
				"kms:RetireGrant",
				"kms:DescribeKey"
			],
			"Resource": key_arn,
			"Effect": "Allow"
		},
		{
			"Action": [
				"kms:ListAliases"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"iam:CreateRole",
				"iam:CreatePolicy",
				"iam:GetRole",
				"iam:PutRolePolicy",
				"iam:AttachRolePolicy",
				"iam:CreateServiceLinkedRole"
			],
			"Resource": "*",
			"Effect": "Allow"
		},
		{
			"Action": [
				"sso:StartPeregrine",
				"sso:DescribeRegisteredRegions",
				"sso:ListDirectoryAssociations",
				"sso:GetPeregrineStatus",
				"sso:GetSSOStatus",
				"sso:ListProfiles",
				"sso:GetProfile",
				"sso:AssociateProfile",
				"sso:AssociateDirectory",
				"sso:RegisterRegion",
				"sso:StartSSO",
				"sso:CreateManagedApplicationInstance",
				"sso:DeleteManagedApplicationInstance",
				"sso:GetManagedApplicationInstance",
				"sso-directory:SearchUsers"
			],
			"Resource": "*",
			"Effect": "Allow"
		}
	]
}

key_arn 指定您要用于 AWS Supply Chain 实例的密钥。有关最佳实践以及仅限您想要使用的密钥的访问权限 AWS Supply Chain，请参阅在IAM策略声明中指定KMS密钥。要表示所有KMS密钥，请单独使用通配符 (“*”)。