本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# CodeDeploy 許可參考
<a name="auth-and-access-control-permissions-reference"></a>

當您設定可連接到 IAM 身分 （身分型政策） 的存取和寫入許可政策時，請使用下表。此表格列出每個 CodeDeploy API 操作、您可以授予執行動作許可的動作，以及用於授予許可的資源 ARN 格式。您可以在政策的 `Action` 欄位中指定動作。您可以使用或不使用萬用字元 (\*)，指定 ARN 做為政策之 `Resource` 欄位中的資源值。

您可以在 CodeDeploy 政策中使用 AWS整個條件索引鍵來表達條件。如需 AWS全系列金鑰的完整清單，請參閱《*IAM 使用者指南*》中的[可用金鑰](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html#AvailableKeys)。

若要指定動作，請使用 `codedeploy:` 字首，後面接著 API 操作名稱 (例如 `codedeploy:GetApplication` 和 `codedeploy:CreateApplication`)。若要在單一陳述式中指定多個動作，請用逗號加以分隔 (例如 `"Action": ["codedeploy:action1", "codedeploy:action2"]`)。

**使用萬用字元**

您可以在您的 ARN 中使用萬用字元 (\*) 指定多個動作或資源。例如， `codedeploy:*`會指定所有 CodeDeploy 動作，並`codedeploy:Get*`指定以字詞 開頭的所有 CodeDeploy 動作`Get`。以下範例會授予存取所有名稱開頭為 `West`，且和名稱開頭為 `Test` 應用程式建立關聯的部署群組。

```
arn:aws:codedeploy:us-west-2:444455556666:deploymentgroup:Test*/West*
```

您可以針對下表列出的資源使用萬用字元：
+ {{application-name}}
+ {{deployment-group-name}}
+ {{deployment-configuration-name}}
+ {{instance-ID}}

萬用字元無法用於 {{region}} 或 {{account-id}}。如需萬用字元的詳細資訊，請參閱《*IAM 使用者指南*》中的 [IAM 識別符](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html)。

**注意**  
 在每個動作的 ARN 中，資源後方會跟隨一個冒號 (:)。您也可以使用斜線 (/) 跟隨資源。如需詳細資訊，請參閱 [CodeDeploy 範例 ARNs](https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html#arn-syntax-codedeploy)。

使用捲軸查看資料表的其餘部分。


**CodeDeploy API 操作和動作所需的許可**  

<table>
<thead>
  <tr><th>CodeDeploy API 操作</th><th>所需許可 (API 動作)</th><th>Resources</th></tr>
</thead>
<tbody>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_AddTagsToOnPremisesInstances.html">AddTagsToOnPremisesInstances</a></td><td><code>codedeploy:AddTagsToOnPremisesInstances</code><br />若要將標籤新增至一個或多個現場部署執行個體，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：instance/{{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/BatchGetApplicationRevisions.html">BatchGetApplicationRevisions</a></td><td><code>codedeploy:BatchGetApplicationRevisions</code><br />若要取得與 使用者相關聯的多個應用程式修訂版本相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetApplications.html">BatchGetApplications</a></td><td><code>codedeploy:BatchGetApplications</code><br />若要取得與 使用者相關聯的多個應用程式相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：*</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentGroups.html">BatchGetDeploymentGroups</a></td><td><code>codedeploy:BatchGetDeploymentGroups</code><br />若要取得與 使用者相關聯的多個部署群組相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeploymentInstances.html">BatchGetDeploymentInstances</a></td><td><code>codedeploy:BatchGetDeploymentInstances</code>若要取得部署群組中的一個或多個執行個體相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetDeployments.html">BatchGetDeployments</a></td><td><code>codedeploy:BatchGetDeployments</code><br />若要取得與 使用者相關聯的多個部署相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_BatchGetOnPremisesInstances.html">BatchGetOnPremisesInstances</a></td><td><code>codedeploy:BatchGetOnPremisesInstances</code><br />若要取得一個或多個現場部署執行個體的相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：*</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ContinueDeployment.html">ContinueDeployment</a></td><td><code>codedeploy:ContinueDeployment</code><br />在藍/綠部署期間，使用 Elastic Load Balancing 負載平衡器開始在替代環境中註冊執行個體的程序時需要。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateApplication.html">CreateApplication</a></td><td><code>codedeploy:CreateApplication</code><br />若要建立與 使用者相關聯的應用程式，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeployment.html">CreateDeployment</a> 1</td><td><code>codedeploy:CreateDeployment</code><br />若要建立與 使用者相關聯的應用程式部署，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentConfig.html">CreateDeploymentConfig</a></td><td><code>codedeploy:CreateDeploymentConfig</code><br />若要建立與 使用者相關聯的自訂部署組態，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentconfig：{{deployment-configuration-name}} </td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_CreateDeploymentGroup.html">CreateDeploymentGroup</a></td><td><code>codedeploy:CreateDeploymentGroup</code><br />若要建立與 使用者相關聯的應用程式部署群組，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteApplication.html">DeleteApplication</a></td><td><code>codedeploy:DeleteApplication</code><br />若要刪除與 使用者相關聯的應用程式，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentConfig.html">DeleteDeploymentConfig</a></td><td><code>codedeploy:DeleteDeploymentConfig</code><br />若要刪除與 使用者相關聯的自訂部署組態，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentconfig：{{deployment-configuration-name}} </td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeleteDeploymentGroup.html">DeleteDeploymentGroup</a></td><td><code>codedeploy:DeleteDeploymentGroup</code><br />若要刪除與 使用者相關聯的應用程式部署群組，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_DeregisterOnPremisesInstance.html">DeregisterOnPremisesInstance</a></td><td><code>codedeploy:DeregisterOnPremisesInstance</code><br />若要取消註冊現場部署執行個體，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：instance/{{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplication.html">GetApplication</a></td><td><code>codedeploy:GetApplication</code><br />若要取得與 使用者相關聯的單一應用程式相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetApplicationRevision.html">GetApplicationRevision</a></td><td><code>codedeploy:GetApplicationRevision</code><br />若要取得與 使用者相關聯的單一應用程式修訂版本相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeployment.html">GetDeployment</a></td><td><code>codedeploy:GetDeployment</code><br />若要針對與 使用者相關聯的應用程式，取得部署群組的單一部署相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentConfig.html">GetDeploymentConfig</a></td><td><code>codedeploy:GetDeploymentConfig</code><br />若要取得與 使用者相關聯的單一部署組態相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentconfig：{{deployment-configuration-name}} </td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentGroup.html">GetDeploymentGroup</a></td><td><code>codedeploy:GetDeploymentGroup</code><br />若要取得與 使用者相關聯的應用程式單一部署群組相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentInstance.html">GetDeploymentInstance</a></td><td><code>codedeploy:GetDeploymentInstance</code><br />若要取得與 使用者相關聯部署中的單一執行個體相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetDeploymentTarget.html">GetDeploymentTarget</a></td><td><code>codedeploy:GetDeploymentTarget</code><br />若要取得在 使用者相關部署中目標的相關資訊，則為必要資訊。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_GetOnPremisesInstance.html">GetOnPremisesInstance</a></td><td><code>codedeploy:GetOnPremisesInstance</code><br />若要取得單一現場部署執行個體的相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：instance/{{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplicationRevisions.html">ListApplicationRevisions</a></td><td><code>codedeploy:ListApplicationRevisions</code><br />若要取得與 使用者相關聯的所有應用程式修訂版本相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：*</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListApplications.html">ListApplications</a></td><td><code>codedeploy:ListApplications</code><br />若要取得與 使用者相關聯的所有應用程式相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：*</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentConfigs.html">ListDeploymentConfigs</a></td><td><code>codedeploy:ListDeploymentConfigs</code><br />若要取得與 使用者相關聯的所有部署組態相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentconfig：*</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentGroups.html">ListDeploymentGroups</a></td><td><code>codedeploy:ListDeploymentGroups</code><br />若要取得與 使用者相關聯的所有應用程式部署群組相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/*</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentInstances.html">ListDeploymentInstances</a></td><td><code>codedeploy:ListDeploymentInstances</code><br />取得與使用者或 AWS 帳戶相關聯之部署中所有執行個體的相關資訊時需要。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeployments.html">ListDeployments</a></td><td><code>codedeploy:ListDeployments</code><br />取得與使用者相關聯的部署群組之所有部署的相關資訊，或取得與使用者相關聯的所有部署時必填。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListDeploymentTargets.html">ListDeploymentTargets</a></td><td><code>codedeploy:ListDeploymentTargets</code><br />取得與使用者相關聯之部署中所有目標的相關資訊時需要。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListGitHubAccountTokenNames.html">ListGitHubAccountTokenNames</a></td><td><code>codedeploy:ListGitHubAccountTokenNames</code><br />必要許可，用於取得已存放 GitHub 帳戶連線的名稱清單。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：*</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_ListOnPremisesInstances.html">ListOnPremisesInstances</a></td><td><code>codedeploy:ListOnPremisesInstances</code><br />若要取得一個或多個現場部署執行個體名稱的清單，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：*</td></tr>
  <tr><td>PutLifecycleEventHookExecutionStatus</td><td><code>codedeploy:PutLifecycleEventHookExecutionStatus</code><br />若要提供生命週期關聯事件執行狀態的相關通知，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterApplicationRevision.html">RegisterApplicationRevision</a></td><td><code>codedeploy:RegisterApplicationRevision</code><br />若要註冊與 使用者相關聯的應用程式修訂版本相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RegisterOnPremisesInstance.html">RegisterOnPremisesInstance</a></td><td><code>codedeploy:RegisterOnPremisesInstance</code><br />向 CodeDeploy 註冊現場部署執行個體時需要。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：instance/{{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_RemoveTagsFromOnPremisesInstances.html">RemoveTagsFromOnPremisesInstances</a></td><td><code>codedeploy:RemoveTagsFromOnPremisesInstances</code><br />若要從一個或多個現場部署執行個體移除標籤，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：instance/{{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_SkipWaitTimeForInstanceTermination.html">SkipWaitTimeForInstanceTermination</a></td><td><code>codedeploy:SkipWaitTimeForInstanceTermination</code><br />若要在藍/綠部署中覆寫指定的等待時間，並立即在原始環境中啟動終止的執行個體，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：instance/{{instance-ID}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_StopDeployment.html">StopDeployment</a></td><td><code>codedeploy:StopDeployment</code><br />若要針對與 使用者相關聯的應用程式，停止部署群組正在進行的部署，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateApplication.html">UpdateApplication</a> 3</td><td><code>codedeploy:UpdateApplication</code><br />若要變更與 使用者相關聯的應用程式相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：application：{{application-name}}</td></tr>
  <tr><td><a href="https://docs.aws.amazon.com/codedeploy/latest/APIReference/API_UpdateDeploymentGroup.html">UpdateDeploymentGroup</a> 3</td><td><code>codedeploy:UpdateDeploymentGroup</code><br />若要變更與 使用者相關聯的應用程式單一部署群組相關資訊，則為必要許可。</td><td>arn：aws：codedeploy：{{region}}：{{account-id}}：deploymentgroup：{{application-name}}/{{deployment-group-name}}</td></tr>
  <tr><td colspan="3">1 當您指定<code>CreateDeployment</code>許可時，您還必須指定部署組態的<code>GetDeploymentConfig</code>許可和<code>GetApplicationRevision</code>/或應用程式修訂版的<code>RegisterApplicationRevision</code>許可。此外，如果您在 <code>CreateDeployment</code> API 呼叫中包含 <code>overrideAlarmConfiguration</code> 參數，則必須指定 <code>UpdateDeploymentGroup</code>許可。<br />2 適用於提供特定部署群組<code>ListDeployments</code>時，但不適用於列出與使用者相關聯的所有部署時。<br />3 對於 <code>UpdateApplication</code>，您必須同時擁有新舊應用程式名稱的<code>UpdateApplication</code>許可。對於涉及變更部署群組名稱的 <code>UpdateDeploymentGroup</code> 動作，您必須同時擁有舊的及新的部署群組名稱的 <code>UpdateDeploymentGroup</code> 許可。</td></tr>
</tbody>
</table>