要获得与亚马逊 Timestream 类似的功能 LiveAnalytics，可以考虑适用于 InfluxDB 的亚马逊 Timestream。适用于 InfluxDB 的 Amazon Timestream 提供简化的数据摄取和个位数毫秒级的查询响应时间，以实现实时分析。点击[此处](https://docs.aws.amazon.com//timestream/latest/developerguide/timestream-for-influxdb.html)了解更多信息。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# Amazon Timestream 查看 LiveAnalytics 基于身份的策略示例
<a name="security_iam_id-based-policy-examples"></a>

默认情况下，IAM 用户和角色无权为 LiveAnalytics 资源创建或修改 Timestream。他们也无法使用 AWS 管理控制台、CQLSH 或 AWS API 执行任务。 AWS CLI IAM 管理员必须创建 IAM 策略，以便为用户和角色授予权限以对所需的指定资源执行特定的 API 操作。然后，管理员必须将这些策略附加到需要这些权限的 IAM 用户或组。

要了解如何使用这些示例 JSON 策略文档创建 IAM 基于身份的策略，请参阅*《IAM 用户指南》*中的 [在 JSON 选项卡上创建策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html#access_policies_create-json-editor)。

**Topics**
+ [策略最佳实践](#security_iam_service-with-iam-policy-best-practices)
+ [使用控制台的 Timestrea LiveAnalytics m](#security_iam_id-based-policy-examples-console)
+ [允许用户查看他们自己的权限](#security_iam_id-based-policy-examples-view-own-permissions)
+ [Timestream 中的常见操作 LiveAnalytics](#security_iam_id-based-policy-examples-common-operations)
+ [基于标签的 LiveAnalytics 资源访问时间流](#security_iam_id-based-policy-examples-tags)
+ [计划查询](#security_iam_id-based-policy-examples-sheduledqueries)

## 策略最佳实践
<a name="security_iam_service-with-iam-policy-best-practices"></a>

基于身份的策略决定了某人是否可以创建、访问或删除您账户中的 LiveAnalytics 资源的 Timestream。这些操作可能会使 AWS 账户产生成本。创建或编辑基于身份的策略时，请遵循以下指南和建议：
+ **开始使用 AWS 托管策略并转向最低权限权限** — 要开始向用户和工作负载授予权限，请使用为许多常见用例授予权限的*AWS 托管策略*。它们在你的版本中可用 AWS 账户。我们建议您通过定义针对您的用例的 AWS 客户托管策略来进一步减少权限。有关更多信息，请参阅《IAM 用户指南》**中的 [AWS 托管策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)或[工作职能的AWS 托管策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html)。
+ **应用最低权限**：在使用 IAM 策略设置权限时，请仅授予执行任务所需的权限。为此，您可以定义在特定条件下可以对特定资源执行的操作，也称为*最低权限许可*。有关使用 IAM 应用权限的更多信息，请参阅《IAM 用户指南》**中的 [IAM 中的策略和权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html)。
+ **使用 IAM 策略中的条件进一步限制访问权限**：您可以向策略添加条件来限制对操作和资源的访问。例如，您可以编写策略条件来指定必须使用 SSL 发送所有请求。如果服务操作是通过特定的方式使用的，则也可以使用条件来授予对服务操作的访问权限 AWS 服务，例如 CloudFormation。有关更多信息，请参阅《IAM 用户指南》**中的 [IAM JSON 策略元素：条件](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)。
+ **使用 IAM Access Analyzer 验证您的 IAM 策略，以确保权限的安全性和功能性**：IAM Access Analyzer 会验证新策略和现有策略，以确保策略符合 IAM 策略语言（JSON）和 IAM 最佳实践。IAM Access Analyzer 提供 100 多项策略检查和可操作的建议，以帮助您制定安全且功能性强的策略。有关更多信息，请参阅《IAM 用户指南》**中的[使用 IAM Access Analyzer 验证策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-policy-validation.html)。
+ **需要多重身份验证 (MFA**)-如果 AWS 账户您的场景需要 IAM 用户或根用户，请启用 MFA 以提高安全性。若要在调用 API 操作时需要 MFA，请将 MFA 条件添加到您的策略中。有关更多信息，请参阅《IAM 用户指南》**中的[使用 MFA 保护 API 访问](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_configure-api-require.html)。

有关 IAM 中的最佳实操的更多信息，请参阅《IAM 用户指南》**中的 [IAM 中的安全最佳实践](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)。

## 使用控制台的 Timestrea LiveAnalytics m
<a name="security_iam_id-based-policy-examples-console"></a>

Timestream LiveAnalytics 版不需要特定权限即可访问适用于控制台的 Amazon Timestream LiveAnalytics 。您至少需要具有只读权限才能列出和查看有关您 AWS 账户中 LiveAnalytics 资源的时间流的详细信息。如果您创建的基于身份的策略比所需的最低权限更严格，则无法为具有该策略的实体（IAM 用户或角色）正常运行控制台。

## 允许用户查看他们自己的权限
<a name="security_iam_id-based-policy-examples-view-own-permissions"></a>

该示例说明了您如何创建策略，以允许 IAM 用户查看附加到其用户身份的内联和托管式策略。此策略包括在控制台上或使用 AWS CLI 或 AWS API 以编程方式完成此操作的权限。

```
{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "ViewOwnUserInfo",
            "Effect": "Allow",
            "Action": [
                "iam:GetUserPolicy",
                "iam:ListGroupsForUser",
                "iam:ListAttachedUserPolicies",
                "iam:ListUserPolicies",
                "iam:GetUser"
            ],
            "Resource": ["arn:aws:iam::*:user/${aws:username}"]
        },
        {
            "Sid": "NavigateInConsole",
            "Effect": "Allow",
            "Action": [
                "iam:GetGroupPolicy",
                "iam:GetPolicyVersion",
                "iam:GetPolicy",
                "iam:ListAttachedGroupPolicies",
                "iam:ListGroupPolicies",
                "iam:ListPolicyVersions",
                "iam:ListPolicies",
                "iam:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}
```

## Timestream 中的常见操作 LiveAnalytics
<a name="security_iam_id-based-policy-examples-common-operations"></a>

以下是允许在 Timestream 中进行常见操作的 IAM 策略示例 LiveAnalytics。

**Topics**
+ [允许所有操作](#security_iam_id-based-policy-examples-common-operations.all)
+ [允许 SELECT 操作](#security_iam_id-based-policy-examples-common-operations.select)
+ [允许对多个资源进行 SELECT 操作](#security_iam_id-based-policy-examples-common-operations.select-multiple-resources)
+ [允许元数据操作](#security_iam_id-based-policy-examples-common-operations.metadata)
+ [允许 INSERT 操作](#security_iam_id-based-policy-examples-common-operations.insert)
+ [允许 CRUD 操作](#security_iam_id-based-policy-examples-common-operations.crud)
+ [在没有指定资源的情况下取消查询并选择数据](#security_iam_id-based-policy-examples-common-operations.cancel-selectvalues)
+ [创建、描述、删除和描述数据库](#security_iam_id-based-policy-examples-common-operations.cddd)
+ [按标签 `{"Owner": "${username}"}` 限制列出的数据库](#security_iam_id-based-policy-examples-common-operations.list-by-tag)
+ [列出数据库中的所有表](#security_iam_id-based-policy-examples-common-operations.list-all-tables)
+ [在表上创建、描述、删除、更新和选择](#security_iam_id-based-policy-examples-common-operations.cddus-table)
+ [按表限制查询](#security_iam_id-based-policy-examples-common-operations.limit-query-table)

### 允许所有操作
<a name="security_iam_id-based-policy-examples-common-operations.all"></a>

以下是允许在 Timestream 中进行所有操作的示例策略。 LiveAnalytics

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:*"
            ],
            "Resource": "*"
        }
    ]
}
```

------

### 允许 SELECT 操作
<a name="security_iam_id-based-policy-examples-common-operations.select"></a>

以下示例策略允许对特定资源执行 `SELECT` 风格的查询。

**注意**  
将 `<account_ID>` 替换为您的 Amazon 账户 ID。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:Select",
                "timestream:DescribeTable",
                "timestream:ListMeasures"
            ],
            "Resource": "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/DevOps"
        },
        {
            "Effect": "Allow",
            "Action": [
                "timestream:DescribeEndpoints",
                "timestream:SelectValues",
                "timestream:CancelQuery"
            ],
            "Resource": "*"
        }
    ]
}
```

------

### 允许对多个资源进行 SELECT 操作
<a name="security_iam_id-based-policy-examples-common-operations.select-multiple-resources"></a>

以下示例策略允许对多个资源执行 `SELECT` 风格的查询。

**注意**  
将 `<account_ID>` 替换为您的 Amazon 账户 ID。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:Select",
                "timestream:DescribeTable",
                "timestream:ListMeasures"
            ],
            "Resource": [
                "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/DevOps",
                "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/DevOps1",
                "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/DevOps2"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "timestream:DescribeEndpoints",
                "timestream:SelectValues",
                "timestream:CancelQuery"
            ],
            "Resource": "*"
        }
    ]
}
```

------

### 允许元数据操作
<a name="security_iam_id-based-policy-examples-common-operations.metadata"></a>

以下示例策略允许用户执行元数据查询，但不允许用户执行在 Timestream 中读取或写入实际数据的操作。 LiveAnalytics

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:DescribeEndpoints",
                "timestream:DescribeTable",
                "timestream:ListMeasures",
                "timestream:SelectValues",
                "timestream:ListTables",
                "timestream:ListDatabases",
                "timestream:CancelQuery"
            ],
            "Resource": "*"
        }
    ]
}
```

------

### 允许 INSERT 操作
<a name="security_iam_id-based-policy-examples-common-operations.insert"></a>

以下示例策略允许用户对账户 `<account_id>` 内的 `database/sampleDB/table/DevOps` 执行 `INSERT` 操作。

**注意**  
将 `<account_ID>` 替换为您的 Amazon 账户 ID。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": [
                "timestream:WriteRecords"
            ],
            "Resource": [
                "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/DevOps"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "timestream:DescribeEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}
```

------

### 允许 CRUD 操作
<a name="security_iam_id-based-policy-examples-common-operations.crud"></a>

以下示例策略允许用户在 Timestream 中为执行 CRUD 操作。 LiveAnalytics

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:DescribeEndpoints",
                "timestream:CreateTable",
                "timestream:DescribeTable",
                "timestream:CreateDatabase",
                "timestream:DescribeDatabase",
                "timestream:ListTables",
                "timestream:ListDatabases",
                "timestream:DeleteTable",
                "timestream:DeleteDatabase",
                "timestream:UpdateTable",
                "timestream:UpdateDatabase"
            ],
            "Resource": "*"
        }
    ]
}
```

------

### 在没有指定资源的情况下取消查询并选择数据
<a name="security_iam_id-based-policy-examples-common-operations.cancel-selectvalues"></a>

以下示例策略允许用户取消查询并对不需要指定资源的数据执行 `Select` 查询：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:SelectValues",
                "timestream:CancelQuery"
            ],
            "Resource": "*"
        }
    ]
}
```

------

### 创建、描述、删除和描述数据库
<a name="security_iam_id-based-policy-examples-common-operations.cddd"></a>

以下示例策略允许用户创建、描述、删除和描述数据库 `sampleDB`：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:CreateDatabase",
                "timestream:DescribeDatabase",
                "timestream:DeleteDatabase",
                "timestream:UpdateDatabase"
            ],
            "Resource": "arn:aws:timestream:us-east-1:111122223333:database/sampleDB"
        }
    ]
}
```

------

### 按标签 `{"Owner": "${username}"}` 限制列出的数据库
<a name="security_iam_id-based-policy-examples-common-operations.list-by-tag"></a>

以下策略示例允许用户列出所有标有键值对 `{"Owner": "${username}"}` 的数据库：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:ListDatabases"
            ],
            "Resource": "arn:aws:timestream:us-east-1:111122223333:database/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Owner": "${aws:username}"
                }
            }
        }
    ]
}
```

------

### 列出数据库中的所有表
<a name="security_iam_id-based-policy-examples-common-operations.list-all-tables"></a>

以下示例策略用于列出数据库 `sampleDB` 中的所有表：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:ListTables"
            ],
            "Resource": "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/"
        }
    ]
}
```

------

### 在表上创建、描述、删除、更新和选择
<a name="security_iam_id-based-policy-examples-common-operations.cddus-table"></a>

以下示例策略允许用户创建表、描述表、删除表、更新表以及对数据库 `sampleDB` 中的表 `DevOps` 执行 `Select` 查询：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:CreateTable",
                "timestream:DescribeTable",
                "timestream:DeleteTable",
                "timestream:UpdateTable",
                "timestream:Select"
            ],
            "Resource": "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/DevOps"
        }
    ]
}
```

------

### 按表限制查询
<a name="security_iam_id-based-policy-examples-common-operations.limit-query-table"></a>

以下示例策略允许用户查询数据库 `DevOps` 中除 `sampleDB` 之外的所有表：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:Select"
            ],
            "Resource": "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "timestream:Select"
            ],
            "Resource": "arn:aws:timestream:us-east-1:111122223333:database/sampleDB/table/DevOps"
        }
    ]
}
```

------

## 基于标签的 LiveAnalytics 资源访问时间流
<a name="security_iam_id-based-policy-examples-tags"></a>

您可以使用基于身份的策略中的条件来控制基于标签的 LiveAnalytics 资源对 Timestream 的访问权限。本章节提供了一些示例。

以下示例说明如何创建一个策略，该策略授予用户查看表的权限（如果表的 `Owner` 包含该用户的用户名的值）。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "ReadOnlyAccessTaggedTables",
            "Effect": "Allow",
            "Action": "timestream:Select",
            "Resource": "arn:aws:timestream:us-east-2:111122223333:database/mydatabase/table/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Owner": "${aws:username}"
                }
            }
        }
    ]
}
```

------

您可以将该策略附加到您账户中的 IAM 用户。如果名为的用户`richard-roe`尝试查看 LiveAnalytics 表的时间流，则必须对该表进行标记`Owner=richard-roe`或`owner=richard-roe`。否则，他将被拒绝访问。条件标签键 `Owner` 匹配 `Owner` 和 `owner`，因为条件键名称不区分大小写。有关更多信息，请参阅 *IAM 用户指南* 中的 [IAM JSON 策略元素：条件](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)。

如果请求中传递的标签具有键 `Owner` 和值 `username`，则以下策略授予用户创建带标签的表的权限：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "CreateTagTableUser",
            "Effect": "Allow",
            "Action": [
                "timestream:CreateTable",
                "timestream:TagResource"
            ],
            "Resource": "arn:aws:timestream:us-east-2:111122223333:database/mydatabase/table/*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:RequestTag/Owner": "${aws:username}"
                }
            }
        }
    ]
}
```

------

以下策略允许在 `env` 标签设置为 `dev` 或 `test` 的任何数据库上使用 `DescribeDatabase` API：

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "AllowDescribe",
            "Effect": "Allow",
            "Action": [
                "timestream:DescribeEndpoints",
                "timestream:DescribeDatabase"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AllowTagAccessForDevResources",
            "Effect": "Allow",
            "Action": [
                "timestream:TagResource"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:RequestTag/env": [
                        "test",
                        "dev"
                    ]
                }
            }
        }
    ]
}
```

------

此策略使用 `Condition` 键来允许将键 `env` 且值为 `test`、`qa` 或 `dev` 的标签添加到资源中。

## 计划查询
<a name="security_iam_id-based-policy-examples-sheduledqueries"></a>

### 列出、删除、更新、执行 ScheduledQuery
<a name="security_iam_id-based-policy-examples-sheduledqueries-alloperations"></a>

以下策略示例允许用户列出、删除、更新和执行计划查询。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "timestream:DeleteScheduledQuery",
                "timestream:ExecuteScheduledQuery",
                "timestream:UpdateScheduledQuery",
                "timestream:ListScheduledQueries",
                "timestream:DescribeEndpoints"
            ],
            "Resource": "*"
        }
    ]
}
```

------

### CreateScheduledQuery 使用客户管理的 KMS 密钥
<a name="security_iam_id-based-policy-examples-sheduledqueries-create"></a>

以下示例策略允许用户创建使用客户托管的 KMS 密钥加密的计划查询; *<keyid for ScheduledQuery>*。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::123456789012:role/ScheduledQueryExecutionRole"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "timestream:CreateScheduledQuery",
                "timestream:DescribeEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:DescribeKey",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:us-west-2:123456789012:key/<keyid for ScheduledQuery>",
            "Effect": "Allow"
        }
    ]
}
```

------

### DescribeScheduledQuery 使用客户管理的 KMS 密钥
<a name="security_iam_id-based-policy-examples-sheduledqueries-describe"></a>

以下示例策略允许用户描述使用客户托管的 KMS 密钥创建的计划查询; *<keyid for ScheduledQuery>*。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": [
                "timestream:DescribeScheduledQuery",
                "timestream:DescribeEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": "arn:aws:kms:us-west-2:123456789012:key/<keyid for ScheduledQuery>",
            "Effect": "Allow"
        }
    ]
}
```

------

### 执行角色权限（使用客户托管的 KMS 密钥实现计划查询，使用 SSE-KMS 进行错误报告）
<a name="security_iam_id-based-policy-examples-sheduledqueries-execrole"></a>

将以下示例策略附加到 `CreateScheduledQuery` API `ScheduledQueryExecutionRoleArn` 参数中指定的 IAM 角色，该角色使用客户托管的 KMS 密钥实现计划查询以及 `SSE-KMS` 加密进行错误报告。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Action": [
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:us-west-2:123456789012:key/<keyid for ScheduledQuery>",
            "Effect": "Allow"
        },
        {
            "Action": [
                "kms:Decrypt"
            ],
            "Resource": [
                "arn:aws:kms:us-west-2:123456789012:key/<keyid for database-1>",
                "arn:aws:kms:us-west-2:123456789012:key/<keyid for database-n>",
                "arn:aws:kms:us-west-2:123456789012:key/<keyid for ScheduledQuery>"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "sns:Publish"
            ],
            "Resource": [
                "arn:aws:sns:us-west-2:123456789012:scheduled-query-notification-topic-*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "timestream:Select",
                "timestream:SelectValues",
                "timestream:WriteRecords"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:PutObject",
                "s3:GetBucketAcl"
            ],
            "Resource": [
                "arn:aws:s3:::scheduled-query-error-bucket",
                "arn:aws:s3:::scheduled-query-error-bucket/*"
            ],
            "Effect": "Allow"
        }
    ]
}
```

------

### 执行角色信任关系
<a name="security_iam_id-based-policy-examples-sheduledqueries-exectrust"></a>

以下是 `CreateScheduledQuery` API `ScheduledQueryExecutionRoleArn` 参数中指定的 IAM 角色的信任关系。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "timestream.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

------

### 允许访问在账户内创建的所有计划查询
<a name="security_iam_id-based-policy-examples-sheduledqueries-accountid"></a>

将以下示例策略附加到 `CreateScheduledQuery` API `ScheduledQueryExecutionRoleArn` 参数中指定的 IAM 角色，以允许访问在账户中创建的所有计划查询*Account\$1ID*。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "timestream.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "Account_ID"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:timestream:us-west-2:111122223333:scheduled-query/*"
                }
            }
        }
    ]
}
```

------

### 允许访问所有带特定名称的计划查询
<a name="security_iam_id-based-policy-examples-sheduledqueries-queryname"></a>

将以下示例策略附加到 `CreateScheduledQuery` API `ScheduledQueryExecutionRoleArn` 参数中指定的 IAM 角色，以允许访问账户内名称以开头*Scheduled\$1Query\$1Name*的所有计划查询*Account\$1ID*。

------
#### [ JSON ]

****  

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "timestream.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "Account_ID"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:timestream:us-west-2:111122223333:scheduled-query/Scheduled_Query_Name*"
                }
            }
        }
    ]
}
```

------