NetBackup™ Snapshot Manager 安装和升级指南

Snapshot Manager 需要的 AWS 权限

以下是 IAM 角色定义（JSON 格式），它使 Snapshot Manager 能够配置 AWS 插件、发现资产以及管理快照等。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2AutoScaling",
            "Effect": "Allow",
            "Action": [
                "autoscaling:UpdateAutoScalingGroup",
                "autoscaling:AttachInstances",
																"autoscaling:DescribeScalingActivities",
																"autoscaling:TerminateInstanceInAutoScalingGroup"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "KMS",
            "Effect": "Allow",
            "Action": [
                "kms:ListKeys",
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncryptTo",
                "kms:DescribeKey",
                "kms:ListAliases",
                "kms:GenerateDataKey",
                "kms:GenerateDataKeyWithoutPlaintext",
                "kms:ReEncryptFrom",
                "kms:CreateGrant"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "RDSBackup",
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBSnapshots",
                "rds:DescribeDBClusters",
                "rds:DescribeDBClusterSnapshots",
                "rds:DeleteDBSnapshot",
                "rds:CreateDBSnapshot",
                "rds:CreateDBClusterSnapshot",
                "rds:ModifyDBSnapshotAttribute",
                "rds:DescribeDBSubnetGroups",
                "rds:DescribeDBInstances",
                "rds:CopyDBSnapshot",
                "rds:CopyDBClusterSnapshot",
                "rds:DescribeDBSnapshotAttributes",
                "rds:DeleteDBClusterSnapshot",
                "rds:ListTagsForResource",
                "rds:AddTagsToResource"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "RDSRecovery",
            "Effect": "Allow",
            "Action": [
                "rds:ModifyDBInstance",
                "rds:ModifyDBClusterSnapshotAttribute",
                "rds:RestoreDBInstanceFromDBSnapshot",
                "rds:ModifyDBCluster",
                "rds:RestoreDBClusterFromSnapshot",
                "rds:CreateDBInstance",
                "rds:RestoreDBClusterToPointInTime",
                "rds:CreateDBSecurityGroup",
                "rds:CreateDBCluster",
                "rds:RestoreDBInstanceToPointInTime",
                "rds:DescribeDBClusterParameterGroups"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "EC2Backup",
            "Effect": "Allow",
            "Action": [
                "sts:GetCallerIdentity",
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots",
                "ec2:DescribeInstances",
                "ec2:DescribeInstanceStatus",
                "ec2:ModifySnapshotAttribute",
                "ec2:CreateImage",
                "ec2:CopyImage",
                "ec2:CopySnapshot",
                "ec2:DescribeSnapshots",
                "ec2:DescribeVolumeStatus",
                "ec2:DescribeVolumes",
                "ec2:RegisterImage",
                "ec2:DescribeVolumeAttribute",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "ec2:DeregisterImage",
                "ec2:DeleteSnapshot",
                "ec2:DescribeInstanceAttribute",
                "ec2:DescribeRegions",
                "ec2:ModifyImageAttribute",
                "ec2:DescribeAvailabilityZones",
                "ec2:ResetSnapshotAttribute",
                "ec2:DescribeHosts",
                "ec2:DescribeImages",
                "ec2:DescribeSecurityGroups" ,
                "ec2:DescribeNetworkInterfaces" 
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "EC2Recovery",
            "Effect": "Allow",
            "Action": [
                "ec2:RunInstances",
                "ec2:AttachNetworkInterface",
                "ec2:DetachVolume",
                "ec2:AttachVolume",
                "ec2:DeleteTags",
                "ec2:CreateTags",
                "ec2:StartInstances",
                "ec2:StopInstances",
	               "ec2:TerminateInstances",												
                "ec2:CreateVolume",
                "ec2:DeleteVolume",
                "ec2:DescribeIamInstanceProfileAssociations",
                "ec2:AssociateIamInstanceProfile",
                "ec2:AssociateAddress",
                "ec2:DescribeKeyPairs",
																"ec2:AuthorizeSecurityGroupEgress",
																"ec2:AuthorizeSecurityGroupIngress",
																"ec2:DescribeInstanceTypeOfferings",
                "ec2:GetEbsEncryptionByDefault"
            ],
            "Resource": [
                "*"
            ]
        },
        {   
            "Sid": "EBS",
            "Effect": "Allow",
            "Action": [
                "ebs:ListSnapshotBlocks",
                "ebs:GetSnapshotBlock",
																"ebs:CompleteSnapshot",
																"ebs:PutSnapshotBlock",
																"ebs:ListChangedBlocks"
            ],
            "Resource": [
                "*"
            ]
        },
        {   
            "Sid": "EKS",
            "Effect": "Allow",
            "Action": [
                "eks:DescribeNodegroup",
																"eks:DescribeUpdate",
																"eks:UpdateNodegroupConfig",
																"eks:ListClusters"
                "eks:DescribeCluster"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "IAM",
            "Effect": "Allow",
            "Action": [
                "iam:ListAccountAliases",
						          "iam:SimulatePrincipalPolicy"
            ],
            "Resource": [
                "*"
            ]
        }	
    ]
}

如果 Snapshot Manager 扩展安装在 AWS 中的托管 Kubernetes 群集上，则在配置插件之前为用户帐户或角色启用以下策略：

AmazonEKSClusterPolicy
AmazonEKSWorkerNodePolicy
AmazonEC2ContainerRegistryReadOnly
AmazonEKS_CNI_Policy
AmazonEKSServicePolicy

Marketplace 部署所需的其他 IAM 权限

{
  "Sid": "AWSMarketplacePermissions", 
  "Effect": "Allow", 
  "Action": [ 
     "autoscaling:UpdateAutoScalingGroup",  
     "autoscaling:AttachInstances", 
     "sns:Publish", 
     "sns:GetTopicAttributes", 
     "secretsmanager:GetResourcePolicy", 
     "secretsmanager:GetSecretValue", 
     "secretsmanager:DescribeSecret", 
     "secretsmanager:RestoreSecret", 
     "secretsmanager:PutSecretValue", 
     "secretsmanager:DeleteSecret", 
     "secretsmanager:UpdateSecret" 
  ], 
  "Resource": [ 
    "*" 
  ]
}

PaaS 工作负载所需的其他 IAM 权限

{
   "Sid": "DynamoDB",
   "Effect": "Allow",
   "Action": [
      "dynamodb:ListTables",
      "dynamodb:DescribeTable",
      "dynamodb:CreateTable",
      "dynamodb:BatchWriteItem",
      "dynamodb:DescribeContinuousBackups",
      "dynamodb:ExportTableToPointInTime",
      "dynamodb:DescribeExport",
      "dynamodb:DeleteTable",
      "dynamodb:UpdateTable",
      "dynamodb:UpdateContinuousBackups"
   ],
   "Resource": [
     "*"
   ]
},
{
  "Sid": "S3Permissions",
  "Effect": "Allow",
  "Action": [
     "s3:PutObject",
     "s3:GetObject",
     "s3:ListBucket",
     "s3:DeleteObject"
  ],
  "Resource": [
    "*"
   ]
}