{"id":1167,"date":"2024-11-13T17:39:03","date_gmt":"2024-11-13T09:39:03","guid":{"rendered":"https:\/\/aws-oncloudai.com\/?p=1167"},"modified":"2025-01-20T14:37:13","modified_gmt":"2025-01-20T06:37:13","slug":"aws-iam-the-key-to-securing-your-cloud-infrastructure","status":"publish","type":"post","link":"https:\/\/aws-oncloudai.com\/zh_hk\/aws-iam-the-key-to-securing-your-cloud-infrastructure\/","title":{"rendered":"AWS IAM\uff1a\u4fdd\u8b77\u96f2\u7aef\u57fa\u790e\u67b6\u69cb\u7684\u95dc\u9375"},"content":{"rendered":"<p>\u5728\u73fe\u4ee3\u6578\u4f4d\u74b0\u5883\u4e2d\uff0c\u57fa\u790e\u8a2d\u65bd\u7684\u5b89\u5168\u6027\u81f3\u95dc\u91cd\u8981\uff0c\u96f2\u7aef\u904b\u7b97\u5df2\u6210\u70ba\u8a31\u591a\u4f01\u696d\u7684\u57fa\u790e\u3002\u60a8\u53ef\u4ee5\u4f7f\u7528Amazon Web Services (AWS) \u5f37\u5927\u7684\u8eab\u5206\u548c\u5b58\u53d6\u7ba1\u7406(IAM) \u5de5\u5177\u7ba1\u7406\u4f7f\u7528\u8005\u5c0dAWS \u8cc7\u6e90\u7684\u5b58\u53d6\u3002\u6211\u5011\u5c07\u5728\u672c\u90e8\u843d\u683c\u4e2d\u6df1\u5165\u63a2\u8a0eAWS IAM \u9818\u57df\uff0c\u4e86\u89e3\u5176\u57fa\u672c\u60f3\u6cd5\u3001\u63a8\u85a6\u7a0b\u5f0f\u4ee5\u53ca\u5b83\u5982\u4f55\u5354\u52a9\u5275\u5efa\u5b89\u5168\u7684\u96f2\u7aef\u74b0\u5883\u3002\u6211\u5011Oncloud AI\u5c07\u900f\u904e\u5e6b\u52a9\u4e86\u89e3IAM\u3002<\/p>\n<h3 id=\"heading-understanding-aws-iam\" class=\"permalink-heading\">\u4e86\u89e3AWS IAM<\/h3>\n<p>\u60a8\u53ef\u4ee5\u4f7f\u7528\u7a31\u70baAWS Identity and Access Management (IAM) \u7684Web \u670d\u52d9\u5b89\u5168\u5730\u7ba1\u7406\u5c0dAWS \u8cc7\u6e90\u7684\u5b58\u53d6\u3002\u5b83\u63d0\u4f9b\u4e86\u4e00\u7a2e\u96c6\u4e2d\u8655\u7406\u8eab\u5206\u9a57\u8b49\u548c\u6388\u6b0a\u7684\u65b9\u6cd5\uff0c\u78ba\u4fdd\u53ea\u6709\u7d93\u6279\u51c6\u7684\u4f7f\u7528\u8005\u6216\u7cfb\u7d71\u624d\u80fd\u5b58\u53d6\u60a8\u7684AWS \u57fa\u790e\u67b6\u69cb\u3002 IAM \u6839\u64da\u6700\u5c0f\u7279\u6b0a\u539f\u5247\u904b\u884c\uff0c\u50c5\u70ba\u4f7f\u7528\u8005\u548c\u670d\u52d9\u63d0\u4f9b\u5c65\u884c\u8077\u8cac\u6240\u9700\u7684\u6b0a\u5229\u3002<\/p>\n<h3 id=\"heading-core-concepts-of-aws-iam\" class=\"permalink-heading\">AWS IAM \u7684\u6838\u5fc3\u6982\u5ff5<\/h3>\n<ol>\n<li>\u4f7f\u7528\u8005\u2013 IAM \u4f7f\u7528\u8005\u662f\u5177\u6709\u9023\u7d50\u6c38\u4e45\u6191\u8b49\u7684\u5be6\u9ad4\u3002\u4ed6\u5011\u53ef\u80fd\u4ee3\u8868\u9700\u8981\u5b58\u53d6AWS \u8cc7\u6e90\u7684\u500b\u4eba\u6216\u7d44\u7e54\u3002\u53ef\u6839\u64da\u9700\u8981\u70ba\u4f7f\u7528\u8005\u5efa\u7acb\u3001\u76e3\u63a7\u548c\u6388\u4e88\u6216\u522a\u9664\u6b0a\u9650\u3002<\/li>\n<li>\u7fa4\u7d44\u2013 IAM \u7fa4\u7d44\u662fIAM \u4f7f\u7528\u8005\u7684\u96c6\u5408\u3002\u60a8\u53ef\u4ee5\u5728\u7fa4\u7d44\u5c64\u7d1a\u6307\u5b9a\u6b0a\u9650\uff0c\u4e26\u6839\u64da\u9700\u8981\u65b0\u589e\u6216\u522a\u9664\u500b\u4eba\uff0c\u800c\u4e0d\u662f\u70ba\u6bcf\u500b\u4f7f\u7528\u8005\u55ae\u7368\u5b9a\u7fa9\u6b0a\u9650\u3002\u9019\u4f7f\u7ba1\u7406\u66f4\u52a0\u5bb9\u6613\uff0c\u4e26\u78ba\u4fdd\u6240\u6709\u4f7f\u7528\u8005\u90fd\u5177\u6709\u4e00\u81f4\u7684\u5b58\u53d6\u6b0a\u9650\u3002<\/li>\n<li>\u89d2\u8272\u2013 IAM \u89d2\u8272\u8207\u4f7f\u7528\u8005\u985e\u4f3c\uff0c\u4f46\u5b83\u5011\u4e0d\u8207\u7279\u5b9a\u8eab\u5206\u76f8\u95dc\u806f\u3002 EC2 \u57f7\u884c\u500b\u9ad4\u548cAWS \u670d\u52d9\u7b49\u5be6\u9ad4\u63a5\u53d7\u89d2\u8272\uff0c\u89d2\u8272\u70ba\u4ed6\u5011\u63d0\u4f9b\u5b58\u53d6\u8cc7\u6e90\u7684\u81e8\u6642\u6191\u8b49\u3002\u900f\u904e\u6d88\u9664\u5728\u5be6\u4f8b\u6216\u61c9\u7528\u7a0b\u5f0f\u4e0a\u4fdd\u5b58\u6c38\u4e45\u6191\u8b49\u7684\u9700\u8981\uff0c\u89d2\u8272\u53ef\u4ee5\u63d0\u9ad8\u5b89\u5168\u6027\u3002<\/li>\n<li>\u7b56\u7565\u2013 IAM \u898f\u5247\u6307\u5b9a\u6b0a\u9650\u4e26\u6307\u5b9a\u500b\u4eba\u3001\u5718\u9ad4\u6216\u89d2\u8272\u53ef\u4ee5\u91dd\u5c0d\u67d0\u4e9b\u8cc7\u6e90\u57f7\u884c\u7684\u6d3b\u52d5\u3002 JSON \u683c\u5f0f\u7684\u7b56\u7565\u53ef\u76f4\u63a5\u61c9\u7528\u65bc\u500b\u4eba\u3001\u5718\u9ad4\u3001\u89d2\u8272\u6216\u8cc7\u6e90\u3002<\/li>\n<\/ol>\n<p><img fetchpriority=\"high\" decoding=\"async\" class=\"wp-image-1168 aligncenter\" src=\"http:\/\/aws-oncloudai.com\/wp-content\/uploads\/2024\/11\/334c3f0d-713e-4f84-a258-0416978ff0f6-300x157.avif\" alt=\"\" width=\"573\" height=\"300\" srcset=\"https:\/\/aws-oncloudai.com\/wp-content\/uploads\/2024\/11\/334c3f0d-713e-4f84-a258-0416978ff0f6-300x157.avif 300w, https:\/\/aws-oncloudai.com\/wp-content\/uploads\/2024\/11\/334c3f0d-713e-4f84-a258-0416978ff0f6-1024x536.avif 1024w, https:\/\/aws-oncloudai.com\/wp-content\/uploads\/2024\/11\/334c3f0d-713e-4f84-a258-0416978ff0f6-768x402.avif 768w, https:\/\/aws-oncloudai.com\/wp-content\/uploads\/2024\/11\/334c3f0d-713e-4f84-a258-0416978ff0f6.avif 1524w\" sizes=\"(max-width: 573px) 100vw, 573px\" \/><\/p>\n<h3 id=\"heading-best-practices-for-aws-iam\" class=\"permalink-heading\">AWS IAM \u7684\u6700\u4f73\u5be6\u8e10<\/h3>\n<ul>\n<li>\u61c9\u7528\u6700\u5c0f\u6b0a\u9650\u6982\u5ff5\u2013 \u50c5\u5411\u4f7f\u7528\u8005\u548c\u670d\u52d9\u63d0\u4f9b\u5b8c\u6210\u5176\u6307\u6d3e\u7684\u4efb\u52d9\u6240\u9700\u7684\u5b58\u53d6\u6b0a\u9650\u3002\u61c9\u7d93\u5e38\u5be9\u67e5\u548c\u66f4\u65b0\u6b0a\u9650\uff0c\u4ee5\u6e1b\u5c11\u672a\u7d93\u6388\u6b0a\u5b58\u53d6\u7684\u53ef\u80fd\u6027\u3002<\/li>\n<li>MFA\uff08\u591a\u56e0\u7d20\u8eab\u4efd\u9a57\u8b49\uff09- \u4f7f\u7528MFA \u589e\u52a0\u984d\u5916\u7684\u4fdd\u8b77\u5c64\u3002\u70ba\u6240\u6709IAM \u4f7f\u7528\u8005\u555f\u7528MFA\u3002 MFA \u8981\u6c42\u4f7f\u7528\u8005\u9664\u4e86\u63d0\u4f9b\u6a19\u6e96\u5bc6\u78bc\u5916\uff0c\u9084\u63d0\u4f9b\u984d\u5916\u7684\u9a57\u8b49\u56e0\u7d20\uff0c\u4f8b\u5982\u786c\u9ad4\u4ee4\u724c\u6216\u57fa\u65bc\u6642\u9593\u7684\u4e00\u6b21\u6027\u5bc6\u78bc(TOTP)\u3002<\/li>\n<li>\u5b9a\u671f\u8f2a\u63db\u5b58\u53d6\u5bc6\u9470\u2013 \u5b9a\u671f\u8f2a\u63db\u5b58\u53d6\u5bc6\u9470\u3002\u5b58\u53d6\u5bc6\u9470\u7528\u65bc\u4ee5\u7a0b\u5f0f\u8a2d\u8a08\u65b9\u5f0f\u8207AWS \u9032\u884c\u901a\u4fe1\uff0c\u7531\u5b58\u53d6\u5bc6\u9470ID \u548c\u79d8\u5bc6\u5b58\u53d6\u5bc6\u9470\u7d44\u6210\u3002\u70ba\u4e86\u6e1b\u8f15\u6f5b\u5728\u5bc6\u9470\u6d29\u6f0f\u7684\u5f71\u97ff\uff0c\u8acb\u5b9a\u671f\u8f2a\u63db\u9019\u4e9b\u5bc6\u9470\u3002<\/li>\n<li>\u5c0dEC2 \u5be6\u4f8b\u4f7f\u7528IAM \u89d2\u8272\u2013 \u5c07IAM \u89d2\u8272\u6307\u6d3e\u7d66EC2 \u5be6\u4f8b\uff0c\u800c\u4e0d\u662f\u5b58\u53d6\u91d1\u9470\u3002\u900f\u904e\u4f7f\u7528\u6b64\u65b9\u6cd5\uff0c\u4e0d\u518d\u9700\u8981\u7ba1\u7406\u548c\u4fdd\u8b77\u7279\u5b9a\u57f7\u884c\u500b\u9ad4\u7684\u5b58\u53d6\u91d1\u9470\u3002<\/li>\n<li>\u555f\u7528AWS CloudTrail \u2013 \u61c9\u555f\u7528AWS CloudTrail\uff0c\u56e0\u70ba\u5b83\u63d0\u4f9b\u60a8AWS \u5e33\u6236\u4e2dAPI \u6d3b\u52d5\u7684\u5b8c\u6574\u65e5\u8a8c\u3002\u4f7f\u7528CloudTrail \u76e3\u63a7\u548c\u8ffd\u8e64\u4f7f\u7528\u8005\u884c\u70ba\uff0c\u5354\u52a9\u9032\u884c\u7a3d\u6838\u3001\u5408\u898f\u6027\u548c\u5b89\u5168\u8abf\u67e5\u3002<\/li>\n<\/ul>\n<h3 id=\"heading-conclusion\" class=\"permalink-heading\">\u7d50\u8ad6<\/h3>\n<p>AWS IAM \u63d0\u4f9b\u7d30\u7c92\u5ea6\u7684\u5b58\u53d6\u63a7\u5236\u548c\u7ba1\u7406\uff0c\u9019\u5c0d\u65bc\u4fdd\u8b77\u60a8\u7684\u96f2\u7aef\u57fa\u790e\u67b6\u69cb\u81f3\u95dc\u91cd\u8981\u3002\u5982\u679c\u60a8\u9075\u5faa\u672c\u90e8\u843d\u683c\u6587\u7ae0\u4e2d\u5efa\u8b70\u7684\u6700\u4f73\u5be6\u8e10\uff0c\u60a8\u7684AWS \u8cc7\u6e90\u53ef\u4ee5\u514d\u53d7\u672a\u7d93\u6388\u6b0a\u7684\u5b58\u53d6\u548c\u6f5b\u5728\u7684\u5b89\u5168\u98a8\u96aa\u3002\u70ba\u4e86\u7dad\u8b77\u7a69\u5b9a\u548c\u5b89\u5168\u7684\u96f2\u7aef\u74b0\u5883\u4e26\u4fdd\u8b77\u516c\u53f8\u7684\u8cc7\u6599\u548c\u8cc7\u6e90\uff0c\u5fc5\u9808\u6b63\u78ba\u5be6\u65bdIAM\u3002<\/p>\n<p>IAM \u53ea\u662f\u5b89\u5168\u96e3\u984c\u7684\u4e00\u90e8\u5206\uff0c\u56e0\u6b64\u9664\u6b64\u4ee5\u5916\u9084\u61c9\u4f7f\u7528\u7db2\u8def\u5b89\u5168\u3001\u52a0\u5bc6\u548c\u983b\u7e41\u7684\u5b89\u5168\u8a55\u4f30\u7b49\u5176\u4ed6\u5b89\u5168\u63aa\u65bd\u3002\u70ba\u4e86\u5728\u4e0d\u65b7\u8b8a\u5316\u7684\u5a01\u8105\u74b0\u5883\u4e2d\u4fdd\u8b77\u60a8\u7684AWS \u8cc7\u6e90\uff0c\u8acb\u4fdd\u6301\u8b66\u60d5\uff0c\u96a8\u6642\u4e86\u89e3\u5b89\u5168\u6700\u4f73\u5be6\u8e10\uff0c\u4e26\u4e0d\u65b7\u6539\u9032\u60a8\u7684\u5b89\u5168\u65b9\u6cd5\u3002<\/p>\n<p><b>Oncloud AI<\/b>\u8eab\u70baAWS\u4ee3\u7406\u5546\uff0c\u63d0\u4f9b\u4e9e\u99ac\u905c\u96f2\u7aef\u670d\u52d9\uff0c\u652f\u63f4\u4e9e\u99ac\u905c\u96f2\u7aef\u4f3a\u670d\u5668AWS\u4ee3\u4ed8\u3001AWS\u9077\u79fb\u3001AWS\u7dad\u904b\u8a17\u7ba1\u7b49\u670d\u52d9\uff0c\u5982\u6709\u76f8\u95dc\u9700\u6c42\u53ef\u806f\u7e6b<strong>Oncloud AI<\/strong>\u3002<\/p>","protected":false},"excerpt":{"rendered":"<p>\u5728\u73fe\u4ee3\u6578\u4f4d\u74b0\u5883\u4e2d\uff0c\u57fa\u790e\u8a2d\u65bd\u7684\u5b89\u5168\u6027\u81f3\u95dc\u91cd\u8981\uff0c\u96f2\u7aef\u904b\u7b97\u5df2\u6210\u70ba\u8a31\u591a\u4f01\u696d\u7684\u57fa\u790e\u3002\u60a8\u53ef\u4ee5\u4f7f\u7528Amazon Web Services (AWS) \u5f37\u5927\u7684\u8eab\u5206\u548c\u5b58\u53d6\u7ba1\u7406(IAM) \u5de5\u5177\u7ba1\u7406\u4f7f\u7528\u8005\u5c0dAWS \u8cc7\u6e90\u7684\u5b58\u53d6\u3002<\/p>","protected":false},"author":1,"featured_media":1169,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[65],"tags":[],"class_list":["post-1167","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technical-sharing"],"_links":{"self":[{"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/posts\/1167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/comments?post=1167"}],"version-history":[{"count":0,"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/posts\/1167\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/media\/1169"}],"wp:attachment":[{"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/media?parent=1167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/categories?post=1167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aws-oncloudai.com\/zh_hk\/wp-json\/wp\/v2\/tags?post=1167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}