AmazonInspector2AgentlessServiceRolePolicy
Description: Grants Amazon Inspector access to AWS services needed to perform agent-less security assessments
AmazonInspector2AgentlessServiceRolePolicy is an AWS managed policy.
Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
Policy details
-
Type: Service-linked role policy
-
Creation time: November 20, 2023, 15:18 UTC
-
Edited time: November 20, 2023, 15:18 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2AgentlessServiceRolePolicy
Policy version
Policy version: v1 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "InstanceIdentification", "Effect" : "Allow", "Action" : [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeSnapshots" ], "Resource" : "*" }, { "Sid" : "GetSnapshotData", "Effect" : "Allow", "Action" : [ "ebs:ListSnapshotBlocks", "ebs:GetSnapshotBlock" ], "Resource" : "arn:aws:ec2:*:*:snapshot/*", "Condition" : { "StringLike" : { "aws:ResourceTag/InspectorScan" : "*" } } }, { "Sid" : "CreateSnapshotsAnyInstanceOrVolume", "Effect" : "Allow", "Action" : "ec2:CreateSnapshots", "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ec2:*:*:volume/*" ] }, { "Sid" : "DenyCreateSnapshotsOnExcludedInstances", "Effect" : "Deny", "Action" : "ec2:CreateSnapshots", "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringEquals" : { "ec2:ResourceTag/InspectorEc2Exclusion" : "true" } } }, { "Sid" : "CreateSnapshotsOnAnySnapshotOnlyWithTag", "Effect" : "Allow", "Action" : "ec2:CreateSnapshots", "Resource" : "arn:aws:ec2:*:*:snapshot/*", "Condition" : { "Null" : { "aws:TagKeys" : "false" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "InspectorScan" } } }, { "Sid" : "CreateOnlyInspectorScanTagOnlyUsingCreateSnapshots", "Effect" : "Allow", "Action" : "ec2:CreateTags", "Resource" : "arn:aws:ec2:*:*:snapshot/*", "Condition" : { "StringLike" : { "ec2:CreateAction" : "CreateSnapshots" }, "Null" : { "aws:TagKeys" : "false" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "InspectorScan" } } }, { "Sid" : "DeleteOnlySnapshotsTaggedForScanning", "Effect" : "Allow", "Action" : "ec2:DeleteSnapshot", "Resource" : "arn:aws:ec2:*:*:snapshot/*", "Condition" : { "StringLike" : { "ec2:ResourceTag/InspectorScan" : "*" } } }, { "Sid" : "DenyKmsDecryptForExcludedKeys", "Effect" : "Deny", "Action" : "kms:Decrypt", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/InspectorEc2Exclusion" : "true" } } }, { "Sid" : "DecryptSnapshotBlocksVolContext", "Effect" : "Allow", "Action" : "kms:Decrypt", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com", "kms:EncryptionContext:aws:ebs:id" : "vol-*" } } }, { "Sid" : "DecryptSnapshotBlocksSnapContext", "Effect" : "Allow", "Action" : "kms:Decrypt", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com", "kms:EncryptionContext:aws:ebs:id" : "snap-*" } } }, { "Sid" : "DescribeKeysForEbsOperations", "Effect" : "Allow", "Action" : "kms:DescribeKey", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringLike" : { "kms:ViaService" : "ec2.*.amazonaws.com" } } }, { "Sid" : "ListKeyResourceTags", "Effect" : "Allow", "Action" : "kms:ListResourceTags", "Resource" : "arn:aws:kms:*:*:key/*" } ] }
Learn more
