• AWS Systems Manager CloudWatch 控制面板在 2026 年 4 月 30 日之后将不再可用。客户可以像现在一样继续使用 Amazon CloudWatch 控制台来查看、创建和管理其 Amazon CloudWatch 控制面板。有关更多信息，请参阅 [Amazon CloudWatch 控制面板文档](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html)。 # Session Manager 的 IAM policy 示例 使用此部分中的示例可帮助您创建 AWS Identity and Access Management (IAM) policy，以提供访问 Session Manager 所需的最常用权限。 **注意** 您还可以使用 AWS KMS key 策略，控制授予哪些 IAM 实体（用户或角色）和 AWS 账户 访问您的 KMS 密钥的权限。有关信息，请参阅《AWS Key Management Service 开发人员指南》中[管理 AWS KMS 资源的访问权限概览](https://docs.aws.amazon.com/kms/latest/developerguide/control-access-overview.html)和[在 AWS KMS 中使用密钥策略](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html)。** **Topics** + [Session Manager 的快速入门最终用户策略](#restrict-access-quickstart-end-user) + [（快速入门）Session Manager 管理员策略](#restrict-access-quickstart-admin) ## Session Manager 的快速入门最终用户策略 使用以下示例为 Session Manager 创建 IAM 终端用户策略。 您可以创建一个策略，允许用户仅从 Session Manager 控制台和 AWS Command Line Interface (AWS CLI)、仅从 Amazon Elastic Compute Cloud (Amazon EC2) 控制台或从这三项中启动会话。 这些策略为终端用户提供启动连接到特定托管式节点的会话以及仅结束自己的会话的功能。有关可能需要对策略进行的自定义的示例，请参阅 [Session Manager 的其他示例 IAM policy](getting-started-restrict-access-examples.md)。 在以下示例策略中，将每个*示例资源占位符*替换为您自己的信息。 从以下选项卡中进行选择，查看要提供的会话访问范围的示例策略。 ------ #### [ 会话管理器 and Fleet Manager ] 使用此示例策略使用户能够仅从 Session Manager 和 Fleet Manager 控制台启动和恢复会话。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-02573cafcfEXAMPLE", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus", "ssm:DescribeInstanceProperties", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-name" } ] } ``` ------ ------ #### [ Amazon EC2 ] 使用此示例策略使用户能够仅从 Amazon EC2 控制台启动和恢复会话。该策略不提供从 Session Manager 控制台和 AWS CLI 启动会话所需的所有权限。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-02573cafcfEXAMPLE", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:username}-*" ] } ] } ``` ------ ------ #### [ AWS CLI ] 使用此示例策略使用户能够仅从 AWS CLI 启动和恢复会话。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/i-02573cafcfEXAMPLE", "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:us-east-1:111122223333:key/key-name" } ] } ``` ------ ------ **注意** `SSM-SessionManagerRunShell` 是 Session Manager 创建的用于存储会话配置首选项的 SSM 文档的默认名称。您可以创建自定义会话文档，并在此策略中指定它。您还可以为使用 SSH 启动会话的用户指定 AWS 提供的文档 `AWS-StartSSHSession`。有关使用 SSH 支持会话所需的配置步骤的信息，请参阅[（可选）通过 Session Manager 允许和控制 SSH 连接的权限](session-manager-getting-started-enable-ssh-connections.md)。 `kms:GenerateDataKey` 权限可让您创建用于加密会话数据的数据加密密钥。如果您将为您的会话数据使用 AWS Key Management Service (AWS KMS) 加密，请将 *key-name* 替换为您要使用的 KMS 密钥的 Amazon Resource Name (ARN)，使用格式 `arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-12345EXAMPLE`。如果您不为会话数据使用 KMS 密钥加密，请从策略中删除以下内容。 ``` { "Effect": "Allow", "Action": [ "kms:GenerateDataKey" ], "Resource": "key-name" } ``` 有关使用 AWS KMS 加密会话数据的信息，请参阅 [启用会话数据的 KMS 密钥加密（控制台）](session-preferences-enable-encryption.md)。 如果用户尝试从 Amazon EC2 控制台启动会话，则需要 [https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) 权限，但 SSM Agent 必须先更新到 Session Manager 所需的最低版本。Run Command 用于向实例发送命令，以便更新代理。 ## （快速入门）Session Manager 管理员策略 使用以下示例可为 Session Manager 创建 IAM 管理员策略。 这些策略为管理员提供启动与使用 `Key=Finance,Value=WebServers` 标记的托管式节点的会话的功能，创建、更新和删除首选项的权限，以及仅结束自己的会话的权限。有关可能需要对策略进行的自定义的示例，请参阅 [Session Manager 的其他示例 IAM policy](getting-started-restrict-access-examples.md)。 您可以创建一个策略，允许管理员仅从 Session Manager 控制台和 AWS CLI、仅从 Amazon EC2 控制台或从这三项中执行这些任务。 在以下示例策略中，将每个*示例资源占位符*替换为您自己的信息。 从以下选项卡中进行选择，查看要支持的访问方案的示例策略。 ------ #### [ 会话管理器 and CLI ] 使用此示例策略使管理员能够仅从 Session Manager 控制台和 AWS CLI 执行会话相关任务。此策略不提供从 Amazon EC2 控制台执行会话相关任务所需的所有权限。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:111122223333:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/Finance": [ "WebServers" ] } } }, { "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus", "ssm:DescribeInstanceProperties", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:GetDocument", "ssm:StartSession" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" }, { "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] } ] } ``` ------ ------ #### [ Amazon EC2 ] 使用此示例策略使管理员能够仅从 Amazon EC2 控制台执行会话相关任务。该策略不提供从 Session Manager 控制台和 AWS CLI 执行会话相关任务所需的所有权限。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/tag-key": [ "tag-value" ] } } }, { "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" ] }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] } ] } ``` ------ ------ #### [ 会话管理器, CLI, and Amazon EC2 ] 使用此示例策略使管理员能够从 Session Manager 控制台、AWS CLI 和 Amazon EC2 控制台执行会话相关任务。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:StartSession", "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:us-east-1:111122223333:instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/tag-key": [ "tag-value" ] } } }, { "Effect": "Allow", "Action": ["ssmmessages:OpenDataChannel"], "Resource": ["arn:aws:ssm:*:*:session/${aws:userid}-*"] }, { "Effect": "Allow", "Action": [ "ssm:DescribeSessions", "ssm:GetConnectionStatus", "ssm:DescribeInstanceInformation", "ssm:DescribeInstanceProperties", "ec2:DescribeInstances" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:CreateDocument", "ssm:UpdateDocument", "ssm:GetDocument", "ssm:StartSession" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:document/SSM-SessionManagerRunShell" }, { "Effect": "Allow", "Action": [ "ssm:TerminateSession", "ssm:ResumeSession" ], "Resource": [ "arn:aws:ssm:*:*:session/${aws:userid}-*" ] } ] } ``` ------ ------ **注意** 如果用户尝试从 Amazon EC2 控制台启动会话，但必须发送命令以首先更新 SSM Agent，则需要 [https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) 的权限。