AIOpsConsoleAdminPolicy
Description: Grants full access to Amazon AI Operations service and its required permissions via AWS console. It also includes permissions to use identity-aware console sessions.
AIOpsConsoleAdminPolicy
is an AWS managed policy.
Using this policy
You can attach AIOpsConsoleAdminPolicy
to your users, groups, and roles.
Policy
details
-
Type: AWS managed policy
-
Creation time: December 02, 2024, 23:51 UTC
-
Edited time: December 02, 2024, 23:51 UTC
-
ARN:
arn:aws:iam::aws:policy/AIOpsConsoleAdminPolicy
Policy version
Policy version: v1 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "AIOpsAdmin",
"Effect" : "Allow",
"Action" : [
"aiops:*"
],
"Resource" : "*"
},
{
"Sid" : "OrganizationsAccess",
"Effect" : "Allow",
"Action" : [
"organizations:ListAWSServiceAccessForOrganization",
"organizations:DescribeOrganization"
],
"Resource" : "*"
},
{
"Sid" : "SSOApplicationManagement",
"Effect" : "Allow",
"Action" : [
"sso:PutApplicationAccessScope",
"sso:PutApplicationAssignmentConfiguration",
"sso:PutApplicationGrant",
"sso:PutApplicationAuthenticationMethod",
"sso:DeleteApplication"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:CalledViaLast" : "aiops.amazonaws.com",
"aws:ResourceTag/ManagedByAmazonAIOperations" : "true"
}
}
},
{
"Sid" : "SSOApplicationTagManagement",
"Effect" : "Allow",
"Action" : [
"sso:CreateApplication",
"sso:TagResource"
],
"Resource" : [
"arn:aws:sso:::instance/*",
"arn:aws:sso::aws:applicationProvider/aiops"
],
"Condition" : {
"StringEquals" : {
"aws:CalledViaLast" : "aiops.amazonaws.com",
"aws:RequestTag/ManagedByAmazonAIOperations" : "true"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : [
"ManagedByAmazonAIOperations"
]
}
}
},
{
"Sid" : "SSOTagManagement",
"Effect" : "Allow",
"Action" : [
"sso:TagResource"
],
"Resource" : "arn:aws:sso::*:application/*",
"Condition" : {
"StringEquals" : {
"aws:CalledViaLast" : "aiops.amazonaws.com",
"aws:ResourceTag/ManagedByAmazonAIOperations" : "true"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : [
"ManagedByAmazonAIOperations"
]
}
}
},
{
"Sid" : "SSOManagementAccess",
"Effect" : "Allow",
"Action" : [
"identitystore:DescribeUser",
"sso:ListApplications",
"sso:ListInstances",
"sso:DescribeRegisteredRegions",
"sso:GetSharedSsoConfiguration",
"sso:DescribeInstance",
"sso:GetSSOStatus",
"sso-directory:DescribeUsers"
],
"Resource" : "*"
},
{
"Sid" : "AllowSTSContextSetting",
"Effect" : "Allow",
"Action" : [
"sts:SetContext"
],
"Resource" : "arn:aws:sts::*:self"
},
{
"Sid" : "IdentityPropagationAccess",
"Effect" : "Allow",
"Action" : [
"signin:ListTrustedIdentityPropagationApplicationsForConsole"
],
"Resource" : "*"
},
{
"Sid" : "CloudtrailAccess",
"Effect" : "Allow",
"Action" : [
"cloudtrail:ListTrails",
"cloudtrail:DescribeTrails",
"cloudtrail:ListEventDataStores"
],
"Resource" : "*"
},
{
"Sid" : "KMSAccess",
"Effect" : "Allow",
"Action" : [
"kms:ListAliases"
],
"Resource" : "*"
},
{
"Sid" : "SSMIntegrationSecretsManagerAccess",
"Effect" : "Allow",
"Action" : [
"secretsmanager:CreateSecret",
"secretsmanager:PutResourcePolicy",
"secretsmanager:UpdateSecret",
"secretsmanager:DeleteSecret"
],
"Resource" : "arn:aws:secretsmanager:*:*:secret:aws/ssm/3p/*"
},
{
"Sid" : "SSMIntegrationAccess",
"Effect" : "Allow",
"Action" : [
"ssm:GetServiceSetting",
"ssm:UpdateServiceSetting"
],
"Resource" : "arn:aws:ssm:*:*:servicesetting/integrations/*"
},
{
"Sid" : "SSMIntegrationCreatePolicy",
"Effect" : "Allow",
"Action" : [
"iam:CreatePolicy"
],
"Resource" : "arn:aws:iam::*:policy/service-role/AWSServiceRoleSSMIntegrationsPolicy*"
},
{
"Sid" : "ChatbotConfigurations",
"Effect" : "Allow",
"Action" : [
"chatbot:DescribeChimeWebhookConfigurations",
"chatbot:DescribeSlackWorkspaces",
"chatbot:DescribeSlackChannelConfigurations",
"chatbot:ListMicrosoftTeamsChannelConfigurations",
"chatbot:ListMicrosoftTeamsConfiguredTeams"
],
"Resource" : "*"
},
{
"Sid" : "IAMPassRoleToAIOps",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "aiops.amazonaws.com"
}
}
},
{
"Sid" : "IAMListRoles",
"Effect" : "Allow",
"Action" : [
"iam:ListRoles"
],
"Resource" : "*"
},
{
"Sid" : "TagBoundaryPermission",
"Effect" : "Allow",
"Action" : [
"tag:GetTagKeys"
],
"Resource" : "*"
},
{
"Sid" : "IAMPassRoleToSSMIntegration",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "ssm.integrations.amazonaws.com"
},
"ArnEquals" : {
"iam:AssociatedResourceArn" : "arn:aws:aiops:*:*:investigation-group/*"
}
}
},
{
"Sid" : "SSMOpsItemAccess",
"Effect" : "Allow",
"Action" : [
"ssm:CreateOpsItem",
"ssm:AddTagsToResource"
],
"Resource" : "arn:*:ssm:*:*:opsitem/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/Integration" : "CloudWatch",
"aws:ResourceTag/Integration" : "CloudWatch"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : [
"Integration"
]
}
}
}
]
}