ConfigConformsServiceRolePolicy
Description: Policy needed for AWSConfig to create conformance packs
ConfigConformsServiceRolePolicy
is an AWS managed policy.
Using this policy
This policy is attached to a service-linked role that allows the service to perform actions on your behalf. You cannot attach this policy to your users, groups, or roles.
Policy details
-
Type: Service-linked role policy
-
Creation time: July 25, 2019, 21:38 UTC
-
Edited time: January 12, 2023, 04:17 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/ConfigConformsServiceRolePolicy
Policy version
Policy version: v6 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Action" : [ "config:PutConfigRule", "config:DeleteConfigRule" ], "Resource" : "arn:aws:config:*:*:config-rule/aws-service-rule/config-conforms.amazonaws.com*" }, { "Effect" : "Allow", "Action" : [ "config:DescribeConfigRules" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "config:DescribeRemediationConfigurations", "config:DeleteRemediationConfiguration", "config:PutRemediationConfigurations" ], "Resource" : "arn:aws:config:*:*:remediation-configuration/aws-service-remediation-configuration/config-conforms.amazonaws.com*" }, { "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : "arn:aws:iam::*:role/aws-service-role/config-conforms.amazonaws.com/*" }, { "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation" }, { "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/remediation.config.amazonaws.com/AWSServiceRoleForConfigRemediation", "Condition" : { "StringLike" : { "iam:AWSServiceName" : "remediation.config.amazonaws.com" } } }, { "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "*", "Condition" : { "StringEquals" : { "iam:PassedToService" : "ssm.amazonaws.com" } } }, { "Effect" : "Allow", "Action" : [ "ssm:DescribeDocument", "ssm:GetDocument" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "s3:PutObject", "s3:PutObjectAcl", "s3:GetObject", "s3:GetBucketAcl" ], "Resource" : "arn:aws:s3:::awsconfigconforms*" }, { "Effect" : "Allow", "Action" : [ "cloudformation:CreateStack", "cloudformation:DeleteStack", "cloudformation:DescribeStackEvents", "cloudformation:DescribeStackResource", "cloudformation:DescribeStackResources", "cloudformation:DescribeStacks", "cloudformation:GetStackPolicy", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack", "cloudformation:UpdateTerminationProtection", "cloudformation:ValidateTemplate", "cloudformation:ListStackResources" ], "Resource" : "arn:aws:cloudformation:*:*:stack/awsconfigconforms-*" }, { "Effect" : "Allow", "Action" : [ "cloudwatch:PutMetricData" ], "Resource" : "*", "Condition" : { "StringEquals" : { "cloudwatch:namespace" : "AWS/Config" } } } ] }