AmazonInspector2AgentlessServiceRolePolicy
Description: Grants Amazon Inspector access to AWS services needed to perform agent-less security assessments
AmazonInspector2AgentlessServiceRolePolicy
is an AWS managed policy.
Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
Policy
details
-
Type: Service-linked role policy
-
Creation time: November 20, 2023, 15:18 UTC
-
Edited time: November 20, 2023, 15:18 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2AgentlessServiceRolePolicy
Policy version
Policy version: v1 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "InstanceIdentification",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeInstances",
"ec2:DescribeVolumes",
"ec2:DescribeSnapshots"
],
"Resource" : "*"
},
{
"Sid" : "GetSnapshotData",
"Effect" : "Allow",
"Action" : [
"ebs:ListSnapshotBlocks",
"ebs:GetSnapshotBlock"
],
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
"Condition" : {
"StringLike" : {
"aws:ResourceTag/InspectorScan" : "*"
}
}
},
{
"Sid" : "CreateSnapshotsAnyInstanceOrVolume",
"Effect" : "Allow",
"Action" : "ec2:CreateSnapshots",
"Resource" : [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:volume/*"
]
},
{
"Sid" : "DenyCreateSnapshotsOnExcludedInstances",
"Effect" : "Deny",
"Action" : "ec2:CreateSnapshots",
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"StringEquals" : {
"ec2:ResourceTag/InspectorEc2Exclusion" : "true"
}
}
},
{
"Sid" : "CreateSnapshotsOnAnySnapshotOnlyWithTag",
"Effect" : "Allow",
"Action" : "ec2:CreateSnapshots",
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
"Condition" : {
"Null" : {
"aws:TagKeys" : "false"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "InspectorScan"
}
}
},
{
"Sid" : "CreateOnlyInspectorScanTagOnlyUsingCreateSnapshots",
"Effect" : "Allow",
"Action" : "ec2:CreateTags",
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
"Condition" : {
"StringLike" : {
"ec2:CreateAction" : "CreateSnapshots"
},
"Null" : {
"aws:TagKeys" : "false"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "InspectorScan"
}
}
},
{
"Sid" : "DeleteOnlySnapshotsTaggedForScanning",
"Effect" : "Allow",
"Action" : "ec2:DeleteSnapshot",
"Resource" : "arn:aws:ec2:*:*:snapshot/*",
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/InspectorScan" : "*"
}
}
},
{
"Sid" : "DenyKmsDecryptForExcludedKeys",
"Effect" : "Deny",
"Action" : "kms:Decrypt",
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/InspectorEc2Exclusion" : "true"
}
}
},
{
"Sid" : "DecryptSnapshotBlocksVolContext",
"Effect" : "Allow",
"Action" : "kms:Decrypt",
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"StringLike" : {
"kms:ViaService" : "ec2.*.amazonaws.com",
"kms:EncryptionContext:aws:ebs:id" : "vol-*"
}
}
},
{
"Sid" : "DecryptSnapshotBlocksSnapContext",
"Effect" : "Allow",
"Action" : "kms:Decrypt",
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"StringLike" : {
"kms:ViaService" : "ec2.*.amazonaws.com",
"kms:EncryptionContext:aws:ebs:id" : "snap-*"
}
}
},
{
"Sid" : "DescribeKeysForEbsOperations",
"Effect" : "Allow",
"Action" : "kms:DescribeKey",
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"StringLike" : {
"kms:ViaService" : "ec2.*.amazonaws.com"
}
}
},
{
"Sid" : "ListKeyResourceTags",
"Effect" : "Allow",
"Action" : "kms:ListResourceTags",
"Resource" : "arn:aws:kms:*:*:key/*"
}
]
}