获取 AWS 登录详细信息

如需使用 AWS 启用云，您需要在激活 Incredibuild Cloud 期间提供以下几个登录详细信息。

• Role ARN– 新角色创建时自动生成的角色 Amazon 资源名称 (ARN)。有关 Amazon Resource Names (ARN) 的更多信息，请参阅 AWS 文档。

• External ID – 您输入的外部 ID 将作为条件进入到新角色的 Trust Relationships设置中。有关 External ID 的更多信息，请参阅 AWS 文档。

要生成这些登录详细信息，您需要执行以下流程：

注意：仅具有 Administrator Access 策略和 Programmatic Access 类型的 IAM 用户需要进行这些流程。这些流程在 2021 年 11 月进行过验证，但在此之后 AWS 应用流程可能已发生变化。

创建 Custom AWS Policy

1. 在 AWS Management Console 中的Find Services 框中输入：IAM：

   

2. 在 IAM 页面中，点击 Policies 选项：

   

3. 在Policies 页面中，点击 Create policy 按钮：

   

4. 在第一个 Create Policy 页面中，点击 JSON 选项卡：

5. 根据您的环境输入以下代码。

   • 如果您想将自定义角色附加到您的云虚拟机，请使用下面的 “Custom VM Role” 选项，并指定您在 AWS 中创建的角色。您还需要在 Cloud Settings 中指定角色。

   • 在隐私政策中，您必须用您的帐户详细信息替换一些代码。

   • 如果您不确定使用哪一个，您应使用具有自定义虚拟机角色的公共网络策略。

   • 如果您计划使用 Private Link，也可添加 ec2:DescribeVpcEndpoints 权限。

   无自定义虚拟机角色的公共网络策略

   复制

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "servicequotas:ListServices",
                   "ec2:AuthorizeSecurityGroupIngress",
                   "ec2:DeleteSubnet",
                   "ec2:DescribeInstances",
                   "ec2:RequestSpotInstances",
                   "ec2:CreateVpc",
                   "ec2:RequestSpotFleet",
                   "ec2:AttachInternetGateway",
                   "ec2:DescribeSpotInstanceRequests",
                   "servicequotas:GetServiceQuota",
                   "ec2:ModifySubnetAttribute",
                   "ec2:DescribeInternetGateways",
                   "ec2:ModifySpotFleetRequest",
                   "ec2:DescribeNetworkInterfaces",
                   "ec2:StartInstances",
                   "ec2:CreateRoute",
                   "ec2:CreateInternetGateway",
                   "ec2:CreateSecurityGroup",
                   "ec2:DeleteInternetGateway",
                   "ec2:ModifyInstanceAttribute",
                   "ec2:DescribeRouteTables",
                   "servicequotas:ListServiceQuotas",
                   "ec2:DescribeCapacityReservations",
                   "ec2:TerminateInstances",
                   "ec2:DescribeLaunchTemplates",
                   "ec2:CreateTags",
                   "ec2:RunInstances",
                   "ec2:CreateFleet",
                   "ec2:DetachInternetGateway",
                   "ec2:StopInstances",
                   "ec2:DescribeSecurityGroups",
                   "ec2:CreateLaunchTemplateVersion",
                   "ec2:RevokeSecurityGroupIngress",
                   "ec2:DescribeImages",
                   "ec2:CancelSpotInstanceRequests",
                   "ec2:CreateLaunchTemplate",
                   "ec2:DescribeSecurityGroupRules",
                   "ec2:DescribeVpcs",
                   "ec2:DeleteSecurityGroup",
                   "ec2:DeleteVpc",
                   "ec2:CreateSubnet",
                   "ec2:DescribeSubnets",
                   "ec2:DescribeAvailabilityZones",
                   "ec2:DescribeInstanceTypeOfferings"
               ],
               "Resource": "*"
           },
    {
                "Effect": "Allow",
               "Action": "iam:CreateServiceLinkedRole",
               "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/*",
               "Condition": {
                   "StringLike": {
                       "iam:AWSServiceName": "spot.amazonaws.com"
                   }
               }
           },
           {
               "Sid": "VisualEditor1",
               "Effect": "Allow",
               "Action": "iam:CreateServiceLinkedRole",
               "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fleet.amazonaws.com/*",
               "Condition": {
                   "StringLike": {
                       "iam:AWSServiceName": "ec2fleet.amazonaws.com"
                   }
               }
           },
           {
               "Sid": "VisualEditor2",
               "Effect": "Allow",
               "Action": [
                   "iam:AttachRolePolicy",
                   "iam:PutRolePolicy"
               ],
               "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fleet.amazonaws.com/*"
           }
       ]
   }

   无自定义虚拟机角色的私人网络策略

   将 "youraccountnumber" 和 "vpcid" 替换为您的帐户信息。

   复制

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "Subnets",
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeSubnets"
               ],
               "Resource": "*"
           },
           {
               "Sid": "Vpc",
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeInternetGateways",
                   "ec2:DescribeVpcs"
               ],
               "Resource": "*"
           },
           {
               "Sid": "Images",
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeImages"
               ],
               "Resource": "*"
           },
           {
               "Sid": "Tags",
               "Effect": "Allow",
               "Action": [
                   "ec2:CreateTags"
               ],
               "Resource": "*"
           },
           {
               "Sid": "LaunchTemplatesRead",
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeLaunchTemplates"
               ],
               "Resource": "*"
           },
           {
               "Sid": "LaunchTemplatesCreate",
               "Effect": "Allow",
               "Action": [
                   "ec2:CreateLaunchTemplate"
               ],
               "Resource": "*"
           },
           {
               "Sid": "LaunchTemplatesUpdate",
               "Effect": "Allow",
               "Action": [
                   "ec2:CreateLaunchTemplateVersion"
               ],
               "Resource": "*"
           },
           {
               "Sid": "InstancesRead",
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeCapacityReservations",
                   "ec2:DescribeInstances",
                   "ec2:DescribeSpotInstanceRequests",
                   "ec2:DescribeAvailabilityZones",
                   "ec2:DescribeInstanceTypeOfferings"            
                   
               ],
               "Resource": "*"
           },
           {
               "Sid": "InstancesCreate",
               "Effect": "Allow",
               "Action": [
                   "ec2:RunInstances",
                   "ec2:CreateFleet",
                   "ec2:RequestSpotFleet",
                   "ec2:RequestSpotInstances"
               ],
               "Resource": "*"
           },
           {
               "Sid": "InstancesWrite",
               "Effect": "Allow",
               "Action": [
                   "ec2:StartInstances",
                   "ec2:StopInstances",
                   "ec2:TerminateInstances",
                   "ec2:ModifyInstanceAttribute",
                   "ec2:ModifySpotFleetRequest",
                   "ec2:CancelSpotInstanceRequests"
               ],
               "Resource": "*",
               "Condition": {
                   "StringLike": {
                       "ec2:ResourceTag/resourceGroup": "*cloud-rg"
                   }
               }
           },
           {
               "Sid": "SecurityGroupsRead",
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeSecurityGroups"
               ],
               "Resource": "*"
           },
           {
               "Sid": "SecurityGroupCreate",
               "Effect": "Allow",
               "Action": [
                   "ec2:CreateSecurityGroup"
               ],
               "Resource": [
                   "arn:aws:ec2:*:<youraccountnumber>:vpc/<yourvpcid>",
                   "arn:aws:ec2:*:<youraccountnumber>:security-group/*"
               ]
           },
           {
               "Sid": "SecurityGroupDelete",
               "Effect": "Allow",
               "Action": [
                   "ec2:DeleteSecurityGroup"
               ],
               "Resource": "*",
               "Condition": {
                   "StringLike": {
                       "ec2:ResourceTag/resourceGroup": "*cloud-rg"
                   }
               }
           },
           {
               "Sid": "SecurityGroupsRulesRead",
               "Effect": "Allow",
               "Action": [
                   "ec2:DescribeSecurityGroupRules"
               ],
               "Resource": "*"
           },
           {
               "Sid": "SecurityGroupsRulesWrite",
               "Effect": "Allow",
               "Action": [
                   "ec2:AuthorizeSecurityGroupIngress",
                   "ec2:RevokeSecurityGroupIngress"
               ],
               "Resource": "*",
               "Condition": {
                   "StringLike": {
                       "ec2:ResourceTag/resourceGroup": "*cloud-rg"
                   }
               }
           },
           {
               "Sid": "Quotas",
               "Effect": "Allow",
               "Action": [
                   "servicequotas:ListServices",
                   "servicequotas:GetServiceQuota",
                   "servicequotas:ListServiceQuotas"
               ],
               "Resource": "*"
           },
           {
               "Sid": "SpotServiceLinkedRole",
               "Effect": "Allow",
               "Action": "iam:CreateServiceLinkedRole",
               "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/*",
               "Condition": {
                   "StringLike": {
                       "iam:AWSServiceName": "spot.amazonaws.com"
                   }
               }
           },
           {
               "Sid": "Ec2FleetServiceLinkedRole",
               "Effect": "Allow",
               "Action": "iam:CreateServiceLinkedRole",
               "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fleet.amazonaws.com/*",
               "Condition": {
                   "StringLike": {
                       "iam:AWSServiceName": "ec2fleet.amazonaws.com"
                   }
               }
           }
       ]
   }
   

   具有自定义虚拟机角色的公共网络策略

   将 "Account-Id"、"RoleName1" 和 "RoleName2" 替换为您的帐户 ID 和自定义虚拟机角色名称。您可以指定一个角色或任意多个角色。

   复制

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "VisualEditor0",
               "Effect": "Allow",
               "Action": [
                   "servicequotas:ListServices",
                   "ec2:AuthorizeSecurityGroupIngress",
                   "ec2:DeleteSubnet",
                   "ec2:DescribeInstances",
                   "ec2:RequestSpotInstances",
                   "ec2:CreateVpc",
                   "ec2:RequestSpotFleet",
                   "ec2:AttachInternetGateway",
                   "ec2:DescribeSpotInstanceRequests",
                   "servicequotas:GetServiceQuota",
                   "ec2:ModifySubnetAttribute",
                   "ec2:DescribeInternetGateways",
                   "ec2:ModifySpotFleetRequest",
                   "ec2:DescribeNetworkInterfaces",
                   "ec2:StartInstances",
                   "ec2:CreateRoute",
                   "ec2:CreateInternetGateway",
                   "ec2:CreateSecurityGroup",
                   "ec2:DeleteInternetGateway",
                   "ec2:ModifyInstanceAttribute",
                   "ec2:DescribeRouteTables",
                   "servicequotas:ListServiceQuotas",
                   "ec2:DescribeCapacityReservations",
                   "ec2:TerminateInstances",
                   "ec2:DescribeLaunchTemplates",
                   "ec2:CreateTags",
                   "ec2:RunInstances",
                   "ec2:CreateFleet",
                   "ec2:DetachInternetGateway",
                   "ec2:StopInstances",
                   "ec2:DescribeSecurityGroups",
                   "ec2:CreateLaunchTemplateVersion",
                   "ec2:RevokeSecurityGroupIngress",
                   "ec2:DescribeImages",
                   "ec2:CancelSpotInstanceRequests",
                   "ec2:CreateLaunchTemplate",
                   "ec2:DescribeSecurityGroupRules",
                   "ec2:DescribeVpcs",
                   "ec2:DeleteSecurityGroup",
                   "ec2:DeleteVpc",
                   "ec2:CreateSubnet",
                   "ec2:DescribeIamInstanceProfileAssociations",
                   "ec2:DescribeSubnets",
                   "ec2:DescribeAvailabilityZones",
                   "ec2:DescribeInstanceTypeOfferings"
               ],
               "Resource": "*"
           },
    	{
                "Effect": "Allow",
               "Action": "iam:CreateServiceLinkedRole",
               "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/*",
               "Condition": {
                   "StringLike": {
                       "iam:AWSServiceName": "spot.amazonaws.com"
                   }
               }
           },
           {
               "Sid": "VisualEditor1",
               "Effect": "Allow",
               "Action": "iam:CreateServiceLinkedRole",
               "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fleet.amazonaws.com/*",
               "Condition": {
                   "StringLike": {
                       "iam:AWSServiceName": "ec2fleet.amazonaws.com"
                   }
               }
           },
           {
               "Sid": "VisualEditor2",
               "Effect": "Allow",
               "Action": [
                   "iam:AttachRolePolicy",
                   "iam:PutRolePolicy"
               ],
               "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fleet.amazonaws.com/*"
           },
     	{
               "Sid": "VisualEditor3",
               "Effect": "Allow",
               "Action": [
                   "iam:GetRole",
                   "iam:PassRole"
               ],
               "Resource": [
                   "arn:aws:iam::<Account-Id>:role/<RoleName1>",
                   "arn:aws:iam::<Account-Id>:role/<RoleName2>"
               ]
           },
   
   	{
               "Sid": "VisualEditor4",
               "Effect": "Allow",
               "Action": [
                   "ec2:DisassociateIamInstanceProfile",
                   "ec2:AssociateIamInstanceProfile"
               ],
               "Resource": "",
               "Condition": {
                   "StringEquals": {
                       "ec2:ResourceTag/incredibuild": "1"
                   }
               }
           }
       ]
   }

   具有自定义虚拟机角色的私人网络策略

   将 "youraccountnumber" 和 "vpcid" 替换为您的帐户信息。

   将 "Account-Id"、"RoleName1" 和 "RoleName2" 替换为您的帐户 ID 和自定义虚拟机角色名称。您可以指定一个角色或任意多个角色。

   复制

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "Subnets",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeSubnets"
         ],
         "Resource": "*"
       },
       {
         "Sid": "Vpc",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeInternetGateways",
           "ec2:DescribeVpcs"
         ],
         "Resource": "*"
       },
       {
         "Sid": "Images",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeImages"
         ],
         "Resource": "*"
       },
       {
         "Sid": "Tags",
         "Effect": "Allow",
         "Action": [
           "ec2:CreateTags"
         ],
         "Resource": "*"
       },
       {
         "Sid": "LaunchTemplatesRead",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeLaunchTemplates"
         ],
         "Resource": "*"
       },
       {
         "Sid": "LaunchTemplatesCreate",
         "Effect": "Allow",
         "Action": [
           "ec2:CreateLaunchTemplate"
         ],
         "Resource": "*"
       },
       {
         "Sid": "LaunchTemplatesUpdate",
         "Effect": "Allow",
         "Action": [
           "ec2:CreateLaunchTemplateVersion"
         ],
         "Resource": "*"
       },
       {
         "Sid": "InstancesRead",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeCapacityReservations",
           "ec2:DescribeInstances",
           "ec2:DescribeSpotInstanceRequests",
           "ec2:DescribeAvailabilityZones",
           "ec2:DescribeInstanceTypeOfferings" 
         ],
         "Resource": "*"
       },
       {
         "Sid": "InstancesCreate",
         "Effect": "Allow",
         "Action": [
           "ec2:RunInstances",
           "ec2:CreateFleet",
           "ec2:RequestSpotFleet",
           "ec2:RequestSpotInstances"
         ],
         "Resource": "*"
       },
       {
         "Sid": "InstancesWrite",
         "Effect": "Allow",
         "Action": [
           "ec2:StartInstances",
           "ec2:StopInstances",
           "ec2:TerminateInstances",
           "ec2:ModifyInstanceAttribute",
           "ec2:ModifySpotFleetRequest",
           "ec2:CancelSpotInstanceRequests"
         ],
         "Resource": "*",
         "Condition": {
           "StringLike": {
             "ec2:ResourceTag/resourceGroup": "*cloud-rg"
           }
         }
       },
       {
         "Sid": "SecurityGroupsRead",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeSecurityGroups"
         ],
         "Resource": "*"
       },
       {
         "Sid": "SecurityGroupCreate",
         "Effect": "Allow",
         "Action": [
           "ec2:CreateSecurityGroup"
         ],
         "Resource": [
           "arn:aws:ec2:*:<youraccountnumber>:vpc/<yourvpcid>",
           "arn:aws:ec2:*:<youraccountnumber>:security-group/*"
         ]
       },
       {
         "Sid": "SecurityGroupDelete",
         "Effect": "Allow",
         "Action": [
           "ec2:DeleteSecurityGroup"
         ],
         "Resource": "*",
         "Condition": {
           "StringLike": {
             "ec2:ResourceTag/resourceGroup": "*cloud-rg"
           }
         }
       },
       {
         "Sid": "SecurityGroupsRulesRead",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeSecurityGroupRules"
         ],
         "Resource": "*"
       },
       {
         "Sid": "SecurityGroupsRulesWrite",
         "Effect": "Allow",
         "Action": [
           "ec2:AuthorizeSecurityGroupIngress",
           "ec2:RevokeSecurityGroupIngress"
         ],
         "Resource": "*",
         "Condition": {
           "StringLike": {
             "ec2:ResourceTag/resourceGroup": "*cloud-rg"
           }
         }
       },
       {
         "Sid": "Quotas",
         "Effect": "Allow",
         "Action": [
           "servicequotas:ListServices",
           "servicequotas:GetServiceQuota",
           "servicequotas:ListServiceQuotas"
         ],
         "Resource": "*"
       },
       {
         "Sid": "SpotServiceLinkedRole",
         "Effect": "Allow",
         "Action": "iam:CreateServiceLinkedRole",
         "Resource": "arn:aws:iam::*:role/aws-service-role/spot.amazonaws.com/*",
         "Condition": {
           "StringLike": {
             "iam:AWSServiceName": "spot.amazonaws.com"
           }
         }
       },
       {
         "Sid": "Ec2FleetServiceLinkedRole",
         "Effect": "Allow",
         "Action": "iam:CreateServiceLinkedRole",
         "Resource": "arn:aws:iam::*:role/aws-service-role/ec2fleet.amazonaws.com/*",
         "Condition": {
           "StringLike": {
             "iam:AWSServiceName": "ec2fleet.amazonaws.com"
           }
         }
       },
       {
         "Sid": "GetAndPassRole",
         "Effect": "Allow",
         "Action": [
           "iam:GetRole",
           "iam:PassRole"
         ],
         "Resource": [
           "arn:aws:iam::<Account-Id>:role/<RoleName1>",
           "arn:aws:iam::<Account-Id>:role/<RoleName2>"
         ]
       },
       {
         "Sid": "AssociateAndDisassociateIamProfile",
         "Effect": "Allow",
         "Action": [
           "ec2:DisassociateIamInstanceProfile",
           "ec2:AssociateIamInstanceProfile"
         ],
         "Resource": "",
         "Condition": {
           "StringEquals": {
             "ec2:ResourceTag/incredibuild": "1"
           }
         }
       },
       {
         "Sid": "IamInstanceProfileRulesRead",
         "Effect": "Allow",
         "Action": [
           "ec2:DescribeIamInstanceProfileAssociations"
         ],
         "Resource": "*"
       }
     ]
   }
   

6. 通过定义名称并点击 Create Policy 来完成政策。在后面的步骤中，您将需要使用该名称。

创建 Custom AWS Role

1. 转到 Roles > Create Role。

   

2. 在第一页中，选择 AWS service 作为实体类型，选择 EC2 作为常见用例。

   

3. 在第二页中，使用 Filter policies 框查找您之前创建的自定义策略并点击其复选框。

   

4. [可选] 在第三页中，您可以为正在创建的新角色添加标签。

5. 在第四页中，输入新角色名称并点击 Create role。

   

6. 在Roles页面中找到新创建的角色。然后选中其复选框并点击以打开它：

   

7. 在新角色的Summary 页面中，点击 Trust relationships选项卡。然后点击Edit trust relationship 按钮：

   

8. 在 Edit Trust Relationship 页面中，删除现有内容并将其替换为以下代码：

   {

   "Version": "2012-10-17",

   "Statement": [

            {

   "Effect": "Allow",

   "Principal": {

   "AWS": "arn:aws:iam::827268715074:user/incrediCloud" },

   "Action": "sts:AssumeRole",

   "Condition": {

   "StringEquals": {

   "sts:ExternalId": "<New_String_for_Your_External_ID>" }

                          }

                 }

          ]

   }

   请输入不带特殊字符的唯一字符串来代替 "New_String_for_Your_External_ID"。您需要在激活期间将其提供给 Incredibuild。

9. 在 Policy Document 窗格中输入了您的唯一外部 ID 后，点击 Update Trust Policy 按钮。您将返回所创建角色的 Summary 页面。在此Summary 页面中，您可以找到以较低权限激活 Incredibuild Cloud 所需的登录详细信息：