简体中文版经机器翻译而成,仅供参考。如与英语版出现任何冲突,应以英语版为准。
为Cloud Volumes ONTAP 设置IAM角色
贡献者
必须将具有所需权限的IAM角色附加到每个Cloud Volumes ONTAP 节点。HA调解器也是如此。让BlueXP为您创建IAM角色最简单、但您可以使用自己的角色。
此任务为可选任务。创建Cloud Volumes ONTAP 工作环境时、默认选项是让BlueXP为您创建IAM角色。如果贵企业的安全策略要求您自己创建IAM角色、请执行以下步骤。
|
AWS机密云中需要提供您自己的IAM角色。 "了解如何在C2S中部署Cloud Volumes ONTAP"。 |
步骤
-
转到AWS IAM控制台。
-
创建包含以下权限的IAM策略:
-
Cloud Volumes ONTAP 节点的基本策略
标准区域{ "Version": "2012-10-17", "Statement": [{ "Action": "s3:ListAllMyBuckets", "Resource": "arn:aws:s3:::*", "Effect": "Allow" }, { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::fabric-pool-*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": "arn:aws:s3:::fabric-pool-*", "Effect": "Allow" } ] }
GovCloud (美国)地区{ "Version": "2012-10-17", "Statement": [{ "Action": "s3:ListAllMyBuckets", "Resource": "arn:aws-us-gov:s3:::*", "Effect": "Allow" }, { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws-us-gov:s3:::fabric-pool-*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": "arn:aws-us-gov:s3:::fabric-pool-*", "Effect": "Allow" }] }
顶级机密区域{ "Version": "2012-10-17", "Statement": [{ "Action": "s3:ListAllMyBuckets", "Resource": "arn:aws-iso:s3:::*", "Effect": "Allow" }, { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws-iso:s3:::fabric-pool-*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": "arn:aws-iso:s3:::fabric-pool-*", "Effect": "Allow" }] }
秘密区域{ "Version": "2012-10-17", "Statement": [{ "Action": "s3:ListAllMyBuckets", "Resource": "arn:aws-iso-b:s3:::*", "Effect": "Allow" }, { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws-iso-b:s3:::fabric-pool-*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": "arn:aws-iso-b:s3:::fabric-pool-*", "Effect": "Allow" }] }
-
Cloud Volumes ONTAP 节点的备份策略
如果您计划对Cloud Volumes ONTAP 系统使用BlueXP备份和恢复、则节点的IAM角色必须包括以下第二个策略。
标准区域{ "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::netapp-backup*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListAllMyBuckets", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:RestoreObject", "s3:GetBucketObjectLockConfiguration", "s3:GetObjectRetention", "s3:PutBucketObjectLockConfiguration", "s3:PutObjectRetention" ], "Resource": "arn:aws:s3:::netapp-backup*/*", "Effect": "Allow" } ] }
GovCloud (美国)地区{ "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws-us-gov:s3:::netapp-backup*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListAllMyBuckets", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:RestoreObject", "s3:GetBucketObjectLockConfiguration", "s3:GetObjectRetention", "s3:PutBucketObjectLockConfiguration", "s3:PutObjectRetention" ], "Resource": "arn:aws-us-gov:s3:::netapp-backup*/*", "Effect": "Allow" } ] }
顶级机密区域{ "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws-iso:s3:::netapp-backup*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListAllMyBuckets", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:RestoreObject", "s3:GetBucketObjectLockConfiguration", "s3:GetObjectRetention", "s3:PutBucketObjectLockConfiguration", "s3:PutObjectRetention" ], "Resource": "arn:aws-iso:s3:::netapp-backup*/*", "Effect": "Allow" } ] }
秘密区域{ "Version": "2012-10-17", "Statement": [ { "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws-iso-b:s3:::netapp-backup*", "Effect": "Allow" }, { "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListAllMyBuckets", "s3:PutObjectTagging", "s3:GetObjectTagging", "s3:RestoreObject", "s3:GetBucketObjectLockConfiguration", "s3:GetObjectRetention", "s3:PutBucketObjectLockConfiguration", "s3:PutObjectRetention" ], "Resource": "arn:aws-iso-b:s3:::netapp-backup*/*", "Effect": "Allow" } ] }
-
HA 调解器
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "ec2:AssignPrivateIpAddresses", "ec2:CreateRoute", "ec2:DeleteRoute", "ec2:DescribeNetworkInterfaces", "ec2:DescribeRouteTables", "ec2:DescribeVpcs", "ec2:ReplaceRoute", "ec2:UnassignPrivateIpAddresses", "sts:AssumeRole", "ec2:DescribeSubnets" ], "Resource": "*" } ] }
-
-
创建IAM角色并将您创建的策略附加到该角色。
结果
现在、您可以在创建新的Cloud Volumes ONTAP 工作环境时选择IAM角色。