{"id":1791,"date":"2025-01-09T13:58:24","date_gmt":"2025-01-09T05:58:24","guid":{"rendered":"https:\/\/www.fanyamin.com\/wordpress\/?p=1791"},"modified":"2025-01-09T13:58:24","modified_gmt":"2025-01-09T05:58:24","slug":"whats-aws-iam-and-how-it-works","status":"publish","type":"post","link":"https:\/\/www.fanyamin.com\/wordpress\/?p=1791","title":{"rendered":"What&#8217;s AWS IAM and how it works"},"content":{"rendered":"<h3><strong>AWS IAM \u662f\u4ec0\u4e48\uff1f<\/strong><\/h3>\n<p><strong>AWS Identity and Access Management (IAM)<\/strong> \u662f Amazon Web Services \u63d0\u4f9b\u7684\u4e00\u9879\u670d\u52a1\uff0c\u7528\u4e8e <strong>\u7ba1\u7406\u8bbf\u95ee AWS \u8d44\u6e90\u7684\u6743\u9650<\/strong>\u3002\u901a\u8fc7 IAM\uff0c\u4f60\u53ef\u4ee5\u5b9a\u4e49\u8c01\u53ef\u4ee5\u8bbf\u95ee\u54ea\u4e9b\u8d44\u6e90\uff0c\u4ee5\u53ca\u5141\u8bb8\u4ed6\u4eec\u8fdb\u884c\u4ec0\u4e48\u64cd\u4f5c\u3002<\/p>\n<hr \/>\n<h3><strong>AWS IAM \u7684\u7528\u9014<\/strong><\/h3>\n<ol>\n<li>\n<p><strong>\u7528\u6237\u7ba1\u7406<\/strong>:<\/p>\n<ul>\n<li>\u521b\u5efa\u548c\u7ba1\u7406 AWS \u7528\u6237\u548c\u7ec4\u3002<\/li>\n<li>\u4e3a\u7528\u6237\u5206\u914d\u767b\u5f55\u51ed\u8bc1\u548c\u6743\u9650\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u8bbf\u95ee\u63a7\u5236<\/strong>:<\/p>\n<ul>\n<li>\u901a\u8fc7\u7b56\u7565 (Policy) \u63a7\u5236\u7528\u6237\u6216\u670d\u52a1\u7684\u6743\u9650\u3002<\/li>\n<li>\u5b9e\u73b0\u6700\u5c0f\u6743\u9650\u539f\u5219\uff08\u4ec5\u8d4b\u4e88\u7528\u6237\u5b8c\u6210\u4efb\u52a1\u6240\u9700\u7684\u6700\u4f4e\u6743\u9650\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u5b89\u5168\u8ba4\u8bc1<\/strong>:<\/p>\n<ul>\n<li>\u63d0\u4f9b\u591a\u56e0\u7d20\u8ba4\u8bc1 (MFA)\u3002<\/li>\n<li>\u4f7f\u7528\u8bbf\u95ee\u5bc6\u94a5\u548c\u4e34\u65f6\u51ed\u8bc1\u652f\u6301\u7a0b\u5e8f\u5316\u8bbf\u95ee\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u8de8\u8d26\u6237\u8bbf\u95ee<\/strong>:<\/p>\n<ul>\n<li>\u4f7f\u7528\u89d2\u8272\u5141\u8bb8\u7528\u6237\u6216\u670d\u52a1\u5728\u591a\u4e2a AWS \u8d26\u6237\u95f4\u8bbf\u95ee\u8d44\u6e90\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u4e0e\u670d\u52a1\u96c6\u6210<\/strong>:<\/p>\n<ul>\n<li>\u4e3a EC2 \u5b9e\u4f8b\u3001Lambda \u51fd\u6570\u7b49\u5206\u914d\u89d2\u8272\uff0c\u6388\u6743\u8fd9\u4e9b\u670d\u52a1\u8bbf\u95ee\u5176\u4ed6 AWS \u670d\u52a1\uff08\u5982 S3\u3001DynamoDB\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<hr \/>\n<h3><strong>AWS IAM \u7684\u5de5\u4f5c\u539f\u7406<\/strong><\/h3>\n<p>IAM \u7684\u6838\u5fc3\u5de5\u4f5c\u673a\u5236\u57fa\u4e8e\u4ee5\u4e0b\u51e0\u4e2a\u6982\u5ff5\uff1a<\/p>\n<h4><strong>1. \u5173\u952e\u5b9e\u4f53<\/strong><\/h4>\n<ul>\n<li>\n<p><strong>\u7528\u6237 (User)<\/strong>:<\/p>\n<ul>\n<li>\u662f\u4e00\u4e2a\u552f\u4e00\u7684\u8eab\u4efd\uff0c\u7528\u4e8e\u4ee3\u8868\u4e00\u4e2a\u4eba\u6216\u5e94\u7528\u7a0b\u5e8f\u3002<\/li>\n<li>\u7528\u6237\u53ef\u4ee5\u6709\u8bbf\u95ee\u5bc6\u94a5 (Access Key)\u3001\u5bc6\u7801\u6216 MFA\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u7ec4 (Group)<\/strong>:<\/p>\n<ul>\n<li>\u662f\u7528\u6237\u7684\u96c6\u5408\uff0c\u7528\u4e8e\u7edf\u4e00\u7ba1\u7406\u6743\u9650\u3002<\/li>\n<li>\u7528\u6237\u7ee7\u627f\u7ec4\u7684\u7b56\u7565\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u89d2\u8272 (Role)<\/strong>:<\/p>\n<ul>\n<li>\u662f\u4e00\u4e2a\u4e34\u65f6\u8eab\u4efd\uff0c\u7528\u4e8e\u5141\u8bb8\u5b9e\u4f53\uff08\u5982\u7528\u6237\u3001\u5e94\u7528\u7a0b\u5e8f\u6216 AWS \u670d\u52a1\uff09\u8bbf\u95ee\u8d44\u6e90\u3002<\/li>\n<li>\u4f7f\u7528\u4fe1\u4efb\u7b56\u7565\u5b9a\u4e49\u8c01\u53ef\u4ee5\u5047\u8bbe\u8be5\u89d2\u8272\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u7b56\u7565 (Policy)<\/strong>:<\/p>\n<ul>\n<li>\u662f\u4e00\u4e2a JSON \u6587\u6863\uff0c\u5b9a\u4e49\u5141\u8bb8\u6216\u62d2\u7edd\u7684\u6743\u9650\u3002<\/li>\n<li>\u7c7b\u578b\uff1a<\/li>\n<li><strong>\u6258\u7ba1\u7b56\u7565<\/strong>\uff08AWS \u63d0\u4f9b\u6216\u7528\u6237\u5b9a\u4e49\u7684\u53ef\u590d\u7528\u7b56\u7565\uff09\u3002<\/li>\n<li><strong>\u5185\u8054\u7b56\u7565<\/strong>\uff08\u76f4\u63a5\u9644\u52a0\u5230\u4e00\u4e2a\u7528\u6237\u3001\u7ec4\u6216\u89d2\u8272\u7684\u7b56\u7565\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4><strong>2. \u6743\u9650\u8bc4\u4f30<\/strong><\/h4>\n<p>IAM \u7684\u6743\u9650\u901a\u8fc7 <strong>\u7b56\u7565\u8bc4\u4f30\u673a\u5236<\/strong> \u786e\u5b9a\u3002<\/p>\n<ul>\n<li>\n<p><strong>\u663e\u5f0f\u5141\u8bb8\u4f18\u5148<\/strong>:<\/p>\n<ul>\n<li>\u5982\u679c\u7b56\u7565\u660e\u786e\u5141\u8bb8\u67d0\u4e2a\u64cd\u4f5c\uff0c\u7528\u6237\/\u89d2\u8272\u5c31\u53ef\u4ee5\u6267\u884c\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u663e\u5f0f\u62d2\u7edd\u4f18\u5148<\/strong>:<\/p>\n<ul>\n<li>\u5982\u679c\u7b56\u7565\u660e\u786e\u62d2\u7edd\u67d0\u4e2a\u64cd\u4f5c\uff0c\u5373\u4f7f\u6709\u5141\u8bb8\u7684\u7b56\u7565\uff0c\u4e5f\u4f1a\u88ab\u62d2\u7edd\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4><strong>3. \u4fe1\u4efb\u5173\u7cfb<\/strong><\/h4>\n<ul>\n<li>IAM \u89d2\u8272\u5141\u8bb8\u901a\u8fc7 <strong>AssumeRole<\/strong> API \u8c03\u7528\u88ab\u5176\u4ed6\u5b9e\u4f53\uff08\u7528\u6237\u3001\u670d\u52a1\u6216\u5916\u90e8\u8d26\u6237\uff09\u4e34\u65f6\u4f7f\u7528\u3002<\/li>\n<li>\u4fe1\u4efb\u7b56\u7565\u5b9a\u4e49\u8c01\u53ef\u4ee5\u5047\u8bbe\u89d2\u8272\u3002<\/li>\n<\/ul>\n<h4><strong>4. IAM \u4e34\u65f6\u51ed\u8bc1<\/strong><\/h4>\n<ul>\n<li>AWS \u63d0\u4f9b\u4e34\u65f6\u51ed\u8bc1\uff08\u901a\u8fc7 STS \u670d\u52a1\uff09\u4f9b\u89d2\u8272\u6216\u4f1a\u8bdd\u4f7f\u7528\u3002<\/li>\n<li>\u4e34\u65f6\u51ed\u8bc1\u7684\u6709\u6548\u65f6\u95f4\u8f83\u77ed\uff0c\u589e\u5f3a\u4e86\u5b89\u5168\u6027\u3002<\/li>\n<\/ul>\n<hr \/>\n<h3><strong>IAM \u7684\u5178\u578b\u5de5\u4f5c\u6d41\u7a0b<\/strong><\/h3>\n<ol>\n<li>\n<p><strong>\u521b\u5efa\u7528\u6237\u6216\u89d2\u8272<\/strong>:<\/p>\n<ul>\n<li>\u4e3a\u7528\u6237\u521b\u5efa\u552f\u4e00\u8eab\u4efd\uff0c\u6216\u5b9a\u4e49\u5141\u8bb8\u670d\u52a1\u8bbf\u95ee\u7684\u89d2\u8272\u3002<\/li>\n<li>\u4f8b\u5982\uff0c\u4e3a\u5f00\u53d1\u8005\u5206\u914d\u6743\u9650\u8bbf\u95ee S3 \u5b58\u50a8\u6876\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u5b9a\u4e49\u548c\u9644\u52a0\u7b56\u7565<\/strong>:<\/p>\n<ul>\n<li>\u7f16\u5199\u7b56\u7565\uff0c\u660e\u786e\u5141\u8bb8\u6216\u62d2\u7edd\u7684\u64cd\u4f5c\u3002<\/li>\n<li>\u4f8b\u5982\uff0c\u5141\u8bb8\u5f00\u53d1\u8005\u53ea\u8bfb S3 \u6587\u4ef6\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u6388\u6743\u8bbf\u95ee\u8d44\u6e90<\/strong>:<\/p>\n<ul>\n<li>IAM \u6839\u636e\u9644\u52a0\u7684\u7b56\u7565\uff0c\u8bc4\u4f30\u8bf7\u6c42\u662f\u5426\u88ab\u5141\u8bb8\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u4e34\u65f6\u51ed\u8bc1\u6216\u5bc6\u94a5\u9a8c\u8bc1<\/strong>:<\/p>\n<ul>\n<li>\u7528\u6237\u6216\u670d\u52a1\u5411 AWS \u53d1\u9001 API \u8bf7\u6c42\uff0c\u9644\u52a0\u5bc6\u94a5\u6216\u4e34\u65f6\u51ed\u8bc1\u3002<\/li>\n<li>IAM \u9a8c\u8bc1\u51ed\u8bc1\u7684\u6709\u6548\u6027\uff0c\u5e76\u6839\u636e\u7b56\u7565\u54cd\u5e94\u662f\u5426\u5141\u8bb8\u64cd\u4f5c\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<hr \/>\n<h3><strong>\u4f18\u52bf<\/strong><\/h3>\n<ol>\n<li>\n<p><strong>\u5b89\u5168\u6027<\/strong>:<\/p>\n<ul>\n<li>\u63d0\u4f9b\u7cbe\u7ec6\u7c92\u5ea6\u7684\u8bbf\u95ee\u63a7\u5236\uff0c\u51cf\u5c11\u66b4\u9732\u9762\u3002<\/li>\n<li>\u652f\u6301 MFA\uff0c\u63d0\u9ad8\u8d26\u6237\u5b89\u5168\u6027\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u7075\u6d3b\u6027<\/strong>:<\/p>\n<ul>\n<li>\u652f\u6301\u8de8\u8d26\u6237\u548c\u8de8\u670d\u52a1\u7684\u8bbf\u95ee\u63a7\u5236\u3002<\/li>\n<li>\u652f\u6301\u901a\u8fc7\u89d2\u8272\u5b9e\u73b0\u65e0\u5bc6\u7801\u8bbf\u95ee\u3002<\/li>\n<\/ul>\n<\/li>\n<li>\n<p><strong>\u5ba1\u8ba1\u548c\u76d1\u63a7<\/strong>:<\/p>\n<ul>\n<li>\u4e0e AWS CloudTrail \u96c6\u6210\uff0c\u8bb0\u5f55 IAM \u7528\u6237\u548c\u89d2\u8272\u7684\u64cd\u4f5c\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<hr \/>\n<h3><strong>\u793a\u4f8b\uff1a\u5141\u8bb8\u7528\u6237\u53ea\u8bfb S3 \u7684\u7b56\u7565<\/strong><\/h3>\n<p>\u4ee5\u4e0b\u662f\u4e00\u4e2a\u7b56\u7565\u7684 JSON \u6587\u6863\uff0c\u5141\u8bb8\u7528\u6237\u5bf9 S3 \u5b58\u50a8\u6876\u6267\u884c\u53ea\u8bfb\u64cd\u4f5c\uff1a<\/p>\n<pre><code class=\"language-json\">{\n  &quot;Version&quot;: &quot;2012-10-17&quot;,\n  &quot;Statement&quot;: [\n    {\n      &quot;Effect&quot;: &quot;Allow&quot;,\n      &quot;Action&quot;: [\n        &quot;s3:GetObject&quot;,\n        &quot;s3:ListBucket&quot;\n      ],\n      &quot;Resource&quot;: [\n        &quot;arn:aws:s3:::example-bucket&quot;,\n        &quot;arn:aws:s3:::example-bucket\/*&quot;\n      ]\n    }\n  ]\n}<\/code><\/pre>\n<hr \/>\n<h3><strong>\u603b\u7ed3<\/strong><\/h3>\n<p>AWS IAM \u662f AWS \u5b89\u5168\u6a21\u578b\u7684\u6838\u5fc3\u7ec4\u4ef6\uff0c\u8d1f\u8d23\u7528\u6237\u3001\u89d2\u8272\u548c\u6743\u9650\u7ba1\u7406\uff0c\u786e\u4fdd AWS \u8d44\u6e90\u5728\u4e0d\u540c\u573a\u666f\u4e0b\u7684\u8bbf\u95ee\u5b89\u5168\u3002\u7406\u89e3 IAM \u7684\u6982\u5ff5\u548c\u5de5\u4f5c\u539f\u7406\uff0c\u6709\u52a9\u4e8e\u8bbe\u8ba1\u5b89\u5168\u3001\u5408\u89c4\u7684 AWS \u67b6\u6784\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>AWS IAM \u662f\u4ec0\u4e48\uff1f AWS Identity and Access Management (IAM) \u662f Amazon Web Services \u63d0\u4f9b\u7684\u4e00\u9879\u670d\u52a1\uff0c\u7528\u4e8e \u7ba1\u7406\u8bbf\u95ee AWS \u8d44\u6e90\u7684\u6743\u9650\u3002\u901a\u8fc7 IAM\uff0c\u4f60\u53ef\u4ee5\u5b9a\u4e49\u8c01\u53ef\u4ee5\u8bbf\u95ee\u54ea\u4e9b\u8d44\u6e90\uff0c\u4ee5\u53ca\u5141\u8bb8\u4ed6\u4eec\u8fdb\u884c\u4ec0\u4e48\u64cd\u4f5c\u3002 AWS IAM \u7684\u7528\u9014 \u7528\u6237\u7ba1\u7406: \u521b\u5efa\u548c\u7ba1\u7406 AWS \u7528\u6237\u548c\u7ec4\u3002 \u4e3a\u7528\u6237\u5206\u914d\u767b\u5f55\u51ed\u8bc1\u548c\u6743\u9650\u3002 \u8bbf\u95ee\u63a7\u5236: \u901a\u8fc7\u7b56\u7565 (Policy) \u63a7\u5236\u7528\u6237\u6216\u670d\u52a1\u7684\u6743\u9650\u3002 \u5b9e\u73b0\u6700\u5c0f\u6743\u9650\u539f\u5219\uff08\u4ec5\u8d4b\u4e88\u7528\u6237\u5b8c\u6210\u4efb\u52a1\u6240\u9700\u7684\u6700\u4f4e\u6743\u9650\uff09\u3002 \u5b89\u5168\u8ba4\u8bc1: \u63d0\u4f9b\u591a\u56e0\u7d20\u8ba4\u8bc1 (MFA)\u3002 \u4f7f\u7528\u8bbf\u95ee\u5bc6\u94a5\u548c\u4e34\u65f6\u51ed\u8bc1\u652f\u6301\u7a0b\u5e8f\u5316\u8bbf\u95ee\u3002 \u8de8\u8d26\u6237\u8bbf\u95ee: \u4f7f\u7528\u89d2\u8272\u5141\u8bb8\u7528\u6237\u6216\u670d\u52a1\u5728\u591a\u4e2a AWS \u8d26\u6237\u95f4\u8bbf\u95ee\u8d44\u6e90\u3002 \u4e0e\u670d\u52a1\u96c6\u6210: \u4e3a EC2 \u5b9e\u4f8b\u3001Lambda \u51fd\u6570\u7b49\u5206\u914d\u89d2\u8272\uff0c\u6388\u6743\u8fd9\u4e9b\u670d\u52a1\u8bbf\u95ee\u5176\u4ed6 AWS \u670d\u52a1\uff08\u5982 S3\u3001DynamoDB\uff09\u3002 AWS IAM \u7684\u5de5\u4f5c\u539f\u7406 IAM \u7684\u6838\u5fc3\u5de5\u4f5c\u673a\u5236\u57fa\u4e8e\u4ee5\u4e0b\u51e0\u4e2a\u6982\u5ff5\uff1a 1. \u5173\u952e\u5b9e\u4f53 \u7528\u6237 [&hellip;] <a class=\"read-more\" href=\"https:\/\/www.fanyamin.com\/wordpress\/?p=1791\" title=\"Permanent Link to: What&#8217;s AWS IAM and how it works\">&rarr;Read&nbsp;more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1791","post","type-post","status-publish","format-standard","hentry","category-5"],"_links":{"self":[{"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1791"}],"collection":[{"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1791"}],"version-history":[{"count":1,"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1791\/revisions"}],"predecessor-version":[{"id":1792,"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/1791\/revisions\/1792"}],"wp:attachment":[{"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fanyamin.com\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}