AWS Storage Gateway, Руководство пользователя

Страница: 305 / 438

AWS Storage Gateway User Guide
Overview of Managing Access
• Attach a permissions policy to a user or a group in your account – An account administrator can
use a permissions policy that is associated with a particular user to grant permissions for that user to
create an Storage Gateway resource, such as a gateway, volume, or tape.
• Attach a permissions policy to a role (grant cross-account permissions) – You can attach an
identity-based permissions policy to an IAM role to grant cross-account permissions. For example,
the administrator in Account A can create a role to grant cross-account permissions to another AWS
account (for example, Account B) or an AWS service as follows:
1. Account A administrator creates an IAM role and attaches a permissions policy to the role that
grants permissions on resources in Account A.
2. Account A administrator attaches a trust policy to the role identifying Account B as the principal
who can assume the role.
3. Account B administrator can then delegate permissions to assume the role to any users in Account
B. Doing this allows users in Account B to create or access resources in Account A. The principal
in the trust policy can also be an AWS service principal if you want to grant an AWS service
permissions to assume the role.
For more information about using IAM to delegate permissions, see Access Management in the IAM
User Guide .
The following is an example policy that grants permissions to all
List*
actions on all resources. This
action is a read-only action. Thus, the policy doesn't allow the user to change the state of the resources.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAllListActionsOnAllResources",
"Effect": "Allow",
"Action": [
"storagegateway:List*"
],
"Resource": "*"
}
]
}
For more information about using identity-based policies with Storage Gateway, see Using Identity-
Based Policies (IAM Policies) for Storage Gateway (p. 299) . For more information about users, groups,
roles, and permissions, see Identities (Users, Groups, and Roles in the IAM User Guide .
Resource-Based Policies
Other services, such as Amazon S3, also support resource-based permissions policies. For example, you
can attach a policy to an S3 bucket to manage access permissions to that bucket. Storage Gateway
doesn't support resource-based policies.
Specifying Policy Elements: Actions, Effects, Resources, and
Principals
For each Storage Gateway resource (see Storage Gateway API Permissions: Actions, Resources, and
Conditions Reference (p. 309) ), the service defines a set of API operations (see Actions ). To grant
permissions for these API operations, Storage Gateway defines a set of actions that you can specify in
a policy. For example, for the Storage Gateway gateway resource, the following actions are defined:
ActivateGateway
,
DeleteGateway
, and
DescribeGatewayInformation
. Note that, performing an
API operation can require permissions for more than one action.
The following are the most basic policy elements:
API Version 2013-06-30
298