用户访问RD的增强监控的IAM POILCY

Question

我正在尝试创建一个IAM用户，该用户将拥有最少特权，以便能够查看特定RDS数据库的增强监视。我创建了一个角色（增强的监视），并将托管策略附加了：“ AmazonrdsenHancedMonitoringrole”。该角色使用Passrole许可将RDS数据库传递给RDS数据库。我正在附加到此IAM用户的策略如下：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "cloudwatch:PutMetricData",
            "rds:*",
            "cloudwatch:GetMetricData",
            "iam:ListRoles",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:DeleteAnomalyDetector",
            "cloudwatch:ListMetrics",
            "cloudwatch:DescribeAnomalyDetectors",
            "cloudwatch:ListMetricStreams",
            "cloudwatch:DescribeAlarmsForMetric",
            "cloudwatch:ListDashboards",
            "ec2:*",
            "cloudwatch:PutAnomalyDetector",
            "cloudwatch:GetMetricWidgetImage"
        ],
        "Resource": "*"
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "iam:GetRole",
            "iam:PassRole",
            "cloudwatch:*"
        ],
        "Resource": [
            "arn:aws:cloudwatch:*:accountnumber:insight-rule/*",
            "arn:aws:iam::accountnumber:role/Enhanced-Monitoring",
            "arn:aws:rds:us-east-1:accountnumber:db:dbidentifier"
        ]


      }
    ]
}

如您所见，我几乎给了该用户的所有许可，但是我仍然在IAM用户RDS仪表板上获得“未授权”错误，以进行增强监视，尽管CloudWatch日志正常显示。

Answer 1

我设法通过修改策略来解决错误。由于增强的监视使用了CloudWatch日志，因此我添加了一个只读的CloudWatch日志策略（CloudWatchLogsReadonLyAccess）。提到了此政策在这里/a>在AWS文档中。我还添加了RDS控制台建议的CloudWatch：GetMetricData权限。现在的总体策略现在也更加紧凑：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::account_number:role/Enhanced-Monitoring"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "rds:*",
                "logs:Describe*",
                "logs:List*",
                "logs:StartQuery",
                "ec2:*",
                "iam:ListRoles",
                "logs:StopQuery",
                "logs:TestMetricFilter",
                "logs:FilterLogEvents",
                "logs:Get*",
                "cloudwatch:GetMetricData"
            ],
            "Resource": "*"
        }
    ]
}

设置现在正常工作。