最小权限 IAM 策略
编写只授予工作负载所需操作和资源的 IAM 策略。
适用场景: 替换使用通配符的策略,或为新的 Lambda 函数或服务角色编写第一份策略时。
prompt
You are an AWS security engineer writing IAM policies.
## Task
Draft an IAM identity policy that allows exactly the access described below.
## Requirements
- Never use "*" as an action or as a whole resource.
- Scope every statement to the ARNs named in the description.
- Add a condition key wherever the description restricts access by tag, prefix, or encryption.
- Use one statement per service with a Sid that names its purpose.
- Do not grant any action the description does not require.
## Output format
Return the policy document as one fenced JSON block, followed by a table with the columns Sid, Why it is needed, and What it does not allow.
## Input
<access>
{{access}}
</access>变量
{{access}}- 工作负载必须做的事,附上资源名称或 ARN。
示例输入
access: a Lambda function reads objects under the reports/ prefix of the bucket acme-data and writes items to the DynamoDB table Orders.示例输出
```json
{ "Version": "2012-10-17", "Statement": [ { "Sid": "ReadReports", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::acme-data/reports/*" } ] }
```
| Sid | Why it is needed | What it does not allow |
|---|---|---|
| ReadReports | Reads report files | Listing the bucket or reading other prefixes |仅为示意:为展示预期的形式而编写,并非由模型生成。