Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.
AWSOpsWorksCMServiceRole
Descripción: política de rol de servicio que se utilizará para crear servidores de OpsWorks CM.
AWSOpsWorksCMServiceRole es una política administrada de AWS.
Uso de la política
Puede asociar AWSOpsWorksCMServiceRole a los usuarios, grupos y roles.
Información de la política
-
Tipo: política de rol de servicio
-
Hora de creación: 24 de noviembre de 2016 a las 09:49 UTC
-
Hora de edición: 23 de abril de 2021 a las 17:32 UTC
-
ARN:
arn:aws:iam::aws:policy/service-role/AWSOpsWorksCMServiceRole
Versión de la política
Versión de la política: v14 (predeterminada)
La versión predeterminada de la política define qué permisos tendrá. Cuando un usuario o un rol con la política solicita acceso a un recurso de AWS, AWS comprueba la versión predeterminada de la política para decidir si permite o no la solicitud.
Documento de política JSON
{
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Resource" : [
"arn:aws:s3:::aws-opsworks-cm-*"
],
"Action" : [
"s3:CreateBucket",
"s3:DeleteObject",
"s3:DeleteBucket",
"s3:GetObject",
"s3:ListBucket",
"s3:PutBucketPolicy",
"s3:PutObject",
"s3:GetBucketTagging",
"s3:PutBucketTagging"
]
},
{
"Effect" : "Allow",
"Resource" : [
"*"
],
"Action" : [
"tag:UntagResources",
"tag:TagResources"
]
},
{
"Effect" : "Allow",
"Resource" : [
"*"
],
"Action" : [
"ssm:DescribeInstanceInformation",
"ssm:GetCommandInvocation",
"ssm:ListCommandInvocations",
"ssm:ListCommands"
]
},
{
"Effect" : "Allow",
"Resource" : [
"*"
],
"Condition" : {
"StringLike" : {
"ssm:resourceTag/aws:cloudformation:stack-name" : "aws-opsworks-cm-*"
}
},
"Action" : [
"ssm:SendCommand"
]
},
{
"Effect" : "Allow",
"Resource" : [
"arn:aws:ssm:*::document/*",
"arn:aws:s3:::aws-opsworks-cm-*"
],
"Action" : [
"ssm:SendCommand"
]
},
{
"Effect" : "Allow",
"Resource" : [
"*"
],
"Action" : [
"ec2:AllocateAddress",
"ec2:AssociateAddress",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:CreateImage",
"ec2:CreateSecurityGroup",
"ec2:CreateSnapshot",
"ec2:CreateTags",
"ec2:DeleteSecurityGroup",
"ec2:DeleteSnapshot",
"ec2:DeregisterImage",
"ec2:DescribeAccountAttributes",
"ec2:DescribeAddresses",
"ec2:DescribeImages",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstances",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSnapshots",
"ec2:DescribeSubnets",
"ec2:DisassociateAddress",
"ec2:ReleaseAddress",
"ec2:RunInstances",
"ec2:StopInstances"
]
},
{
"Effect" : "Allow",
"Resource" : [
"*"
],
"Condition" : {
"StringLike" : {
"ec2:ResourceTag/aws:cloudformation:stack-name" : "aws-opsworks-cm-*"
}
},
"Action" : [
"ec2:TerminateInstances",
"ec2:RebootInstances"
]
},
{
"Effect" : "Allow",
"Resource" : [
"arn:aws:opsworks-cm:*:*:server/*"
],
"Action" : [
"opsworks-cm:DeleteServer",
"opsworks-cm:StartMaintenance"
]
},
{
"Effect" : "Allow",
"Resource" : [
"arn:aws:cloudformation:*:*:stack/aws-opsworks-cm-*"
],
"Action" : [
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStackEvents",
"cloudformation:DescribeStackResources",
"cloudformation:DescribeStacks",
"cloudformation:UpdateStack"
]
},
{
"Effect" : "Allow",
"Resource" : [
"arn:aws:iam::*:role/aws-opsworks-cm-*",
"arn:aws:iam::*:role/service-role/aws-opsworks-cm-*"
],
"Action" : [
"iam:PassRole"
]
},
{
"Effect" : "Allow",
"Resource" : "*",
"Action" : [
"acm:DeleteCertificate",
"acm:ImportCertificate"
]
},
{
"Effect" : "Allow",
"Resource" : "arn:aws:secretsmanager:*:*:opsworks-cm!aws-opsworks-cm-secrets-*",
"Action" : [
"secretsmanager:CreateSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:UpdateSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:TagResource",
"secretsmanager:UntagResource"
]
},
{
"Effect" : "Allow",
"Action" : "ec2:DeleteTags",
"Resource" : [
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ec2:*:*:elastic-ip/*",
"arn:aws:ec2:*:*:security-group/*"
]
}
]
}Más información
