AWS Storage Gateway, Руководство пользователя

Страница: 312 / 438

AWS Storage Gateway User Guide
Using Tags to Control Access to File Gateway Resources
],
"Effect": "Allow",
"Resource": "arn:aws:storagegateway:us-west-2:123456789012:gateway/ gateway-id /
volume/ volume-id "
},
{
"Sid": "GrantsPermissionsToUseStorageGatewayConsole",
"Action": [
"storagegateway:ListGateways"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
Example 5: Allow All Actions on Gateways with a Specific Prefix
The following policy allows a user to perform all Storage Gateway actions on gateways with names that
start with
DeptX
. The policy also allows the
DescribeSnapshots
Amazon EC2 action which is required
if you plan to describe snapshots.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowsActionsGatewayWithPrefixDeptX",
"Action": [
"storagegateway:*"
],
"Effect": "Allow",
"Resource": "arn:aws:storagegateway:us-west-2:123456789012:gateway/DeptX"
},
{
"Sid": "GrantsPermissionsToSpecifiedAction",
"Action": [
"ec2:DescribeSnapshots"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
The preceding policy works if the user to whom the policy is attached uses either the API or an AWS SDK
to access the gateway. However, if this user plans to use the AWS Storage Gateway console, you must
grant additional permissions as described in Example 3: Allow Access to a Specific Gateway (p. 303) .
Using Tags to Control Access to File Gateway
Resources
You can use AWS Identity and Access Management (IAM) policies to control access to file gateway
resources and actions based on tags. You can provide the control in two ways:
1. Control access to file gateway resources based on the tags on those resources.
2. Control what tags can be passed in an IAM request condition.
For information about how to use tags to control access, see Controlling Access Using Tags .
API Version 2013-06-30
305