AWSServiceRoleForAmazonEKSNodegroup - AWS 受管政策

本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。

AWSServiceRoleForAmazonEKSNodegroup

說明:管理客戶帳戶中節點群組所需的權限。這些與管理下列資源相關的原則: AutoscalingGroups SecurityGroups、 LaunchTemplates 和 InstanceProfiles。

AWSServiceRoleForAmazonEKSNodegroupAWS 受管理的策略

使用此政策

此原則附加至服務連結角色,可讓服務代表您執行動作。您無法將此政策連接至使用者、群組或角色。

政策詳情

  • 類型:服務連結角色原則

  • 創作時間:二零一九年十一月七日 UTC

  • 編輯時間:二 ○ 二四年八月二十一日,下午五十一日 UTC

  • ARN: arn:aws:iam::aws:policy/aws-service-role/AWSServiceRoleForAmazonEKSNodegroup

政策版本

策略版本:v9(預設值)

原則的預設版本是定義原則權限的版本。當具有策略的使用者或角色發出要求以存取 AWS 資源時,請 AWS 檢查原則的預設版本,以決定是否允許該要求。

JSON政策文件

{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "SharedSecurityGroupRelatedPermissions", "Effect" : "Allow", "Action" : [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource" : "*", "Condition" : { "StringLike" : { "ec2:ResourceTag/eks" : "*" } } }, { "Sid" : "EKSCreatedSecurityGroupRelatedPermissions", "Effect" : "Allow", "Action" : [ "ec2:RevokeSecurityGroupIngress", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:DescribeInstances", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup" ], "Resource" : "*", "Condition" : { "StringLike" : { "ec2:ResourceTag/eks:nodegroup-name" : "*" } } }, { "Sid" : "LaunchTemplateRelatedPermissions", "Effect" : "Allow", "Action" : [ "ec2:DeleteLaunchTemplate", "ec2:CreateLaunchTemplateVersion" ], "Resource" : "*", "Condition" : { "StringLike" : { "ec2:ResourceTag/eks:nodegroup-name" : "*" } } }, { "Sid" : "AutoscalingRelatedPermissions", "Effect" : "Allow", "Action" : [ "autoscaling:UpdateAutoScalingGroup", "autoscaling:DeleteAutoScalingGroup", "autoscaling:TerminateInstanceInAutoScalingGroup", "autoscaling:CompleteLifecycleAction", "autoscaling:PutLifecycleHook", "autoscaling:PutNotificationConfiguration", "autoscaling:EnableMetricsCollection", "autoscaling:PutScheduledUpdateGroupAction", "autoscaling:ResumeProcesses", "autoscaling:SuspendProcesses" ], "Resource" : "arn:aws:autoscaling:*:*:*:autoScalingGroupName/eks-*" }, { "Sid" : "AllowAutoscalingToCreateSLR", "Effect" : "Allow", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "autoscaling.amazonaws.com" } }, "Action" : "iam:CreateServiceLinkedRole", "Resource" : "*" }, { "Sid" : "AllowASGCreationByEKS", "Effect" : "Allow", "Action" : [ "autoscaling:CreateOrUpdateTags", "autoscaling:CreateAutoScalingGroup" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:TagKeys" : [ "eks", "eks:cluster-name", "eks:nodegroup-name" ] } } }, { "Sid" : "AllowPassRoleToAutoscaling", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "*", "Condition" : { "StringEquals" : { "iam:PassedToService" : "autoscaling.amazonaws.com" } } }, { "Sid" : "AllowPassRoleToEC2", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "*", "Condition" : { "StringEqualsIfExists" : { "iam:PassedToService" : [ "ec2.amazonaws.com" ] } } }, { "Sid" : "PermissionsToManageResourcesForNodegroups", "Effect" : "Allow", "Action" : [ "iam:GetRole", "ec2:CreateLaunchTemplate", "ec2:DescribeInstances", "iam:GetInstanceProfile", "ec2:DescribeLaunchTemplates", "autoscaling:DescribeAutoScalingGroups", "ec2:CreateSecurityGroup", "ec2:DescribeLaunchTemplateVersions", "ec2:RunInstances", "ec2:DescribeSecurityGroups", "ec2:GetConsoleOutput", "ec2:DescribeRouteTables", "ec2:DescribeSubnets", "ec2:DescribeCapacityReservations" ], "Resource" : "*" }, { "Sid" : "PermissionsToCreateAndManageInstanceProfiles", "Effect" : "Allow", "Action" : [ "iam:CreateInstanceProfile", "iam:DeleteInstanceProfile", "iam:RemoveRoleFromInstanceProfile", "iam:AddRoleToInstanceProfile" ], "Resource" : "arn:aws:iam::*:instance-profile/eks-*" }, { "Sid" : "PermissionsToManageEKSAndKubernetesTags", "Effect" : "Allow", "Action" : [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : [ "eks", "eks:cluster-name", "eks:nodegroup-name", "kubernetes.io/cluster/*" ] } } } ] }

進一步了解