{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "vpc:*DescribeVpc*",
                "vpc:*DescribeSubnet*",
                "vpc:*DescribeNetworkInterface*",
                "vpc:*DescribeRoute*",
                "vpc:*DescribeSecurityGroup*",
                "vpc:*DescribeHaVip*",
                "cen:DescribeInstanceGrantedRules",
                "vpc:*DescribeNetworkAcl*",
                "vpc:*DescribeFlowLog*",
                "vpc:*DescribePrefixList*",
                "vpc:*DescribeTrafficMirror*",
                "vpc:ListTagsForResources"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

为IAM用户授权 VPCReadOnlyAccess 后，可为其再授予指定子网(如subnet-2yyxafgve001）的权限，使其可以管理该子网。

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "vpc:*Subnet*"
      ],
      "Resource": [
        "trn:vpc:*:*:subnet/subnet-2yyxafgve001"
      ]
    }
	]
}

仅允许IAM用户修改指定路由表vtb-2fdzao4h726f45中的路由条目。将vtb-2fdzao4h726f45中加入到项目中，并为该IAM用户在该项目授予如下权限。

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "vpc:DescribeRouteTable*",
        "vpc:*RouteEntry*"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
		    "vpc:Describe*",
        "ecs:Describe*",
        "vpn:Describe*",
        "natgateway:Describe*", 
        "transitrouter:Describe*" 
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

{
    "Statement":[
        {
            "Effect":"Allow",
            "Action":[
                "vpc:TagResources",
                "vpc:UntagResources",
                "vpc:ListTagsForResources"
            ],
            "Resource":[
                "*"
            ]
        }
    ]
}