Skip to main content
Cloud Volumes ONTAP
所有云提供商
  • Amazon Web Services
  • Google Cloud
  • Microsoft Azure
  • 所有云提供商
简体中文版经机器翻译而成,仅供参考。如与英语版出现任何冲突,应以英语版为准。

为Cloud Volumes ONTAP 设置IAM角色

贡献者

必须将具有所需权限的IAM角色附加到每个Cloud Volumes ONTAP 节点。HA调解器也是如此。让BlueXP为您创建IAM角色最简单、但您可以使用自己的角色。

此任务为可选任务。创建Cloud Volumes ONTAP 工作环境时、默认选项是让BlueXP为您创建IAM角色。如果贵企业的安全策略要求您自己创建IAM角色、请执行以下步骤。

备注 AWS机密云中需要提供您自己的IAM角色。 "了解如何在C2S中部署Cloud Volumes ONTAP"
步骤
  1. 转到AWS IAM控制台。

  2. 创建包含以下权限的IAM策略:

    • Cloud Volumes ONTAP 节点的基本策略

      标准区域
      {
      	"Version": "2012-10-17",
      	"Statement": [{
      			"Action": "s3:ListAllMyBuckets",
      			"Resource": "arn:aws:s3:::*",
      			"Effect": "Allow"
      		}, {
      			"Action": [
      				"s3:ListBucket",
      				"s3:GetBucketLocation"
      			],
      			"Resource": "arn:aws:s3:::fabric-pool-*",
      			"Effect": "Allow"
      		}, {
      			"Action": [
      				"s3:GetObject",
      				"s3:PutObject",
      				"s3:DeleteObject"
      			],
      			"Resource": "arn:aws:s3:::fabric-pool-*",
      			"Effect": "Allow"
      		}
      	]
      }
      GovCloud (美国)地区
      {
          "Version": "2012-10-17",
          "Statement": [{
              "Action": "s3:ListAllMyBuckets",
              "Resource": "arn:aws-us-gov:s3:::*",
              "Effect": "Allow"
          }, {
              "Action": [
                  "s3:ListBucket",
                  "s3:GetBucketLocation"
              ],
              "Resource": "arn:aws-us-gov:s3:::fabric-pool-*",
              "Effect": "Allow"
          }, {
              "Action": [
                  "s3:GetObject",
                  "s3:PutObject",
                  "s3:DeleteObject"
              ],
              "Resource": "arn:aws-us-gov:s3:::fabric-pool-*",
              "Effect": "Allow"
          }]
      }
      顶级机密区域
      {
          "Version": "2012-10-17",
          "Statement": [{
              "Action": "s3:ListAllMyBuckets",
              "Resource": "arn:aws-iso:s3:::*",
              "Effect": "Allow"
          }, {
              "Action": [
                  "s3:ListBucket",
                  "s3:GetBucketLocation"
              ],
              "Resource": "arn:aws-iso:s3:::fabric-pool-*",
              "Effect": "Allow"
          }, {
              "Action": [
                  "s3:GetObject",
                  "s3:PutObject",
                  "s3:DeleteObject"
              ],
              "Resource": "arn:aws-iso:s3:::fabric-pool-*",
              "Effect": "Allow"
          }]
      }
      秘密区域
      {
          "Version": "2012-10-17",
          "Statement": [{
              "Action": "s3:ListAllMyBuckets",
              "Resource": "arn:aws-iso-b:s3:::*",
              "Effect": "Allow"
          }, {
              "Action": [
                  "s3:ListBucket",
                  "s3:GetBucketLocation"
              ],
              "Resource": "arn:aws-iso-b:s3:::fabric-pool-*",
              "Effect": "Allow"
          }, {
              "Action": [
                  "s3:GetObject",
                  "s3:PutObject",
                  "s3:DeleteObject"
              ],
              "Resource": "arn:aws-iso-b:s3:::fabric-pool-*",
              "Effect": "Allow"
          }]
      }
    • Cloud Volumes ONTAP 节点的备份策略

      如果您计划对Cloud Volumes ONTAP 系统使用BlueXP备份和恢复、则节点的IAM角色必须包括以下第二个策略。

    标准区域
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "s3:ListBucket",
                    "s3:GetBucketLocation"
                ],
                "Resource": "arn:aws:s3:::netapp-backup*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
                    "s3:ListAllMyBuckets",
                    "s3:PutObjectTagging",
                    "s3:GetObjectTagging",
                    "s3:RestoreObject",
                    "s3:GetBucketObjectLockConfiguration",
                    "s3:GetObjectRetention",
                    "s3:PutBucketObjectLockConfiguration",
                    "s3:PutObjectRetention"
                ],
                "Resource": "arn:aws:s3:::netapp-backup*/*",
                "Effect": "Allow"
            }
        ]
    }
    GovCloud (美国)地区
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "s3:ListBucket",
                    "s3:GetBucketLocation"
                ],
                "Resource": "arn:aws-us-gov:s3:::netapp-backup*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
                    "s3:ListAllMyBuckets",
                    "s3:PutObjectTagging",
                    "s3:GetObjectTagging",
                    "s3:RestoreObject",
                    "s3:GetBucketObjectLockConfiguration",
                    "s3:GetObjectRetention",
                    "s3:PutBucketObjectLockConfiguration",
                    "s3:PutObjectRetention"
                ],
                "Resource": "arn:aws-us-gov:s3:::netapp-backup*/*",
                "Effect": "Allow"
            }
        ]
    }
    顶级机密区域
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "s3:ListBucket",
                    "s3:GetBucketLocation"
                ],
                "Resource": "arn:aws-iso:s3:::netapp-backup*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
                    "s3:ListAllMyBuckets",
                    "s3:PutObjectTagging",
                    "s3:GetObjectTagging",
                    "s3:RestoreObject",
                    "s3:GetBucketObjectLockConfiguration",
                    "s3:GetObjectRetention",
                    "s3:PutBucketObjectLockConfiguration",
                    "s3:PutObjectRetention"
                ],
                "Resource": "arn:aws-iso:s3:::netapp-backup*/*",
                "Effect": "Allow"
            }
        ]
    }
    秘密区域
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": [
                    "s3:ListBucket",
                    "s3:GetBucketLocation"
                ],
                "Resource": "arn:aws-iso-b:s3:::netapp-backup*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "s3:GetObject",
                    "s3:PutObject",
                    "s3:DeleteObject",
                    "s3:ListAllMyBuckets",
                    "s3:PutObjectTagging",
                    "s3:GetObjectTagging",
                    "s3:RestoreObject",
                    "s3:GetBucketObjectLockConfiguration",
                    "s3:GetObjectRetention",
                    "s3:PutBucketObjectLockConfiguration",
                    "s3:PutObjectRetention"
                ],
                "Resource": "arn:aws-iso-b:s3:::netapp-backup*/*",
                "Effect": "Allow"
            }
        ]
    }
    • HA 调解器

      {
      	"Version": "2012-10-17",
      	"Statement": [{
      			"Effect": "Allow",
      			"Action": [
      				"ec2:AssignPrivateIpAddresses",
      				"ec2:CreateRoute",
      				"ec2:DeleteRoute",
      				"ec2:DescribeNetworkInterfaces",
      				"ec2:DescribeRouteTables",
      				"ec2:DescribeVpcs",
      				"ec2:ReplaceRoute",
      				"ec2:UnassignPrivateIpAddresses",
                      "sts:AssumeRole",
                      "ec2:DescribeSubnets"
      			],
      			"Resource": "*"
      		}
      	]
      }
  3. 创建IAM角色并将您创建的策略附加到该角色。

结果

现在、您可以在创建新的Cloud Volumes ONTAP 工作环境时选择IAM角色。