DynamoDB 表和全局二级索引自动缩放的 AWS 服务相关角色

如何解决DynamoDB 表和全局二级索引自动缩放的 AWS 服务相关角色

根据文档 here，dynamodb 自动扩展有一个服务相关角色 - AWSServiceRoleForApplicationAutoScaling_DynamoDBTable。 角色权限策略允许 Application Auto Scaling 对所有资源完成以下操作：

Action: dynamodb:DescribeTable
Action: dynamodb:UpdateTable
Action: cloudwatch:Deletealarms
Action: cloudwatch:DescribeAlarms
Action: cloudwatch:PutMetricAlarm

翻译成（来自here），

{
    "Version": "2012-10-17","Statement": [
        {
            "Effect": "Allow","Action": [
              "dynamodb:DescribeTable","dynamodb:UpdateTable","cloudwatch:Deletealarms","cloudwatch:DescribeAlarms","cloudwatch:PutMetricAlarm"
            ],"Resource": "*"
        }
    ]
}

例如，当使用如下策略时，

  TableLiveProductsReadscalableTarget:
    Type: 'AWS::ApplicationAutoScaling::scalableTarget'
    Properties:
      MaxCapacity: !Ref TableLiveProductsReadMaxCap
      MinCapacity: !Ref TableLiveProductsReadMinCap
      ResourceId: !Sub "table/${TableLiveProducts}"
      RoleARN: !Sub  arn:aws:iam::${AWS::AccountId}:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable
      scalableDimension: 'dynamodb:table:ReadCapacityUnits'
      ServiceNamespace: dynamodb

从安全角度来看是否可以假设，因为角色只能由 dynamodb.application-autoscaling.amazonaws.com 承担没有问题授予更新 ALL 表、删除 ALL 警报等的权限.?

在此处（以及在许多 AWS 构建的服务相关角色中）要求此类通配符权限背后的基本原理是什么？

解决方法

它们对于您的帐户来说是最通用的。因此，一个角色为您覆盖每张桌子。由于原则是 dynamodb.application-autoscaling.amazonaws.com，没有其他服务或 IAM 用户/角色可以使用这些权限。

您可以提供您自己的角色，并进行更细致的设置。因此，要将权限限制为只有一张表，您可以执行以下操作：

  MyDynamoDBRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'               
        Statement:
          - Effect: Allow
            Principal: {'Service': ['dynamodb.application-autoscaling.amazonaws.com']}
            Action: ['sts:AssumeRole']  
      Path: '/'  
      Policies:
        - PolicyName: DynamoDBScaling
          PolicyDocument: !Sub |
            {
                "Version": "2012-10-17","Statement": [
                    {
                        "Effect": "Allow","Action": [
                            "dynamodb:DescribeTable","dynamodb:UpdateTable"
                        ],"Resource": "${TableLiveProducts.Arn}"
                    },{
                        "Effect": "Allow","Action": [
                            "cloudwatch:PutMetricAlarm","cloudwatch:DescribeAlarms","cloudwatch:DeleteAlarms"
                        ],"Resource": "*"
                    }
                ]
            }        


  TableLiveProductsReadScalableTarget:
    Type: 'AWS::ApplicationAutoScaling::ScalableTarget'
    Properties:
      MaxCapacity: !Ref TableLiveProductsReadMaxCap
      MinCapacity: !Ref TableLiveProductsReadMinCap
      ResourceId: !Sub "table/${TableLiveProducts}"
      RoleARN: !GetAtt MyDynamoDBRole.Arn
      ScalableDimension: 'dynamodb:table:ReadCapacityUnits'
      ServiceNamespace: dynamodb