为本地服务器创建角色以代入 AWS CodeDeploy

Question

我正在按照找到 here 的教程来使用带有 CodeDeploy 的本地服务器。我对前几个步骤有点困惑。当我为本地服务器创建角色以承担时，我应该选择什么作为将使用该角色的服务（在控制台中）？我明白这个角色应该有什么政策，允许对所有资源采取行动s3:Get 和s3:List。为了提供更多信息，我想使用aws-codedeploy-session-helper 工具为我定期刷新会话凭证，该工具使用的 IAM 用户的策略如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow", 
      "Action": [
        "iam:CreateAccessKey",
        "iam:CreateUser",
        "iam:DeleteAccessKey",
        "iam:DeleteUser",
        "iam:DeleteUserPolicy",
        "iam:ListAccessKeys",
        "iam:ListUserPolicies",
        "iam:PutUserPolicy",
        "iam:GetUser",
        "iam:AddRoleToInstanceProfile",
        "iam:CreateInstanceProfile",
        "iam:CreateRole",
        "iam:DeleteInstanceProfile",
        "iam:DeleteRole",
        "iam:DeleteRolePolicy",
        "iam:GetInstanceProfile",
        "iam:GetRole",
        "iam:GetRolePolicy",
        "iam:ListInstanceProfilesForRole",
        "iam:ListRolePolicies",
        "iam:ListRoles",
        "iam:PassRole",
        "iam:PutRolePolicy",
        "iam:RemoveRoleFromInstanceProfile",
        "autoscaling:*",
        "codedeploy:*",
        "ec2:*",
        "lambda:*",
        "elasticloadbalancing:*", 
        "s3:*"
      ],
      "Resource": "*"
    }
  ]
}

Answer 1

您需要允许本地服务器调用 STS 承担角色 API，因此服务应该“STS”

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "sts:AssumeRole",
    "Resource": "arn:aws:iam::<ACCOUNT-ID>:role/<ROLENAME>"
  }
}

然后在 IAM 角色中，为服务器添加“信任”策略。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<ACCOUNT-ID>:user/<USER-NAME>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}