AWSLicenseManagerUserSubscriptionsServiceRolePolicy
Description: Allows AWS License Manager User Subscriptions Service to manage resources on your behalf.
AWSLicenseManagerUserSubscriptionsServiceRolePolicy
is an AWS managed policy.
Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
Policy
details
-
Type: Service-linked role policy
-
Creation time: July 30, 2022, 01:17 UTC
-
Edited time: November 08, 2024, 02:54 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerUserSubscriptionsServiceRolePolicy
Policy version
Policy version: v4 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "DSReadPermissions",
"Effect" : "Allow",
"Action" : [
"ds:DescribeDirectories",
"ds:GetAuthorizedApplicationDetails"
],
"Resource" : "*"
},
{
"Sid" : "SSMReadPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:GetInventory",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:DescribeInstanceInformation"
],
"Resource" : "*"
},
{
"Sid" : "EC2ReadPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeInstances",
"ec2:DescribeVpcPeeringConnections"
],
"Resource" : "*"
},
{
"Sid" : "EC2WritePermissions",
"Effect" : "Allow",
"Action" : [
"ec2:TerminateInstances",
"ec2:CreateTags"
],
"Condition" : {
"StringEquals" : {
"ec2:productCode" : [
"bz0vcy31ooqlzk5tsash4r1ik",
"d44g89hc0gp9jdzm99rznthpw",
"77yzkpa7kvee1y1tt7wnsdwoc",
"a8jthu9h8pjsn4b8ylvfl6sfr",
"7at6der8hnlov1g347e6tdkde",
"3t0v0vuhvxjzm6m462f9v8iz4",
"4gs2prcp03ojilgkjx8m3ifh7"
]
}
},
"Resource" : [
"arn:aws:ec2:*:*:instance/*"
]
},
{
"Sid" : "SSMDocumentExecutionPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:SendCommand"
],
"Resource" : [
"arn:aws:ssm:*::document/AWS-RunPowerShellScript"
]
},
{
"Sid" : "SSMInstanceExecutionPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:SendCommand"
],
"Resource" : [
"arn:aws:ec2:*:*:instance/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/AWSLicenseManager" : "UserSubscriptions"
}
}
},
{
"Sid" : "ReadHostedZonePermissions",
"Effect" : "Allow",
"Action" : [
"route53:GetHostedZone",
"route53:ListResourceRecordSets"
],
"Resource" : "*"
},
{
"Sid" : "ReadSecurityGroupRulePermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeSecurityGroupRules"
],
"Resource" : "*"
},
{
"Effect" : "Allow",
"Sid" : "DescribeSubnetsPermissions",
"Action" : [
"ec2:DescribeSubnets"
],
"Resource" : "*"
},
{
"Sid" : "DescribeNetworkInterfacePermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeNetworkInterfaces"
],
"Resource" : "*"
},
{
"Sid" : "ReadSecretPermissions",
"Effect" : "Allow",
"Action" : [
"secretsmanager:GetSecretValue"
],
"Resource" : "arn:aws:secretsmanager:*:*:secret:license-manager-user-*"
}
]
}