Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.
AWSQuickSetupPatchPolicyPermissionsBoundary
Descripción: QuickSetup crea funciones de IAM que le permiten configurar la función Systems Manager Patch Manager en su nombre y utiliza esta política al crear dichas funciones para definir el límite de sus permisos.
AWSQuickSetupPatchPolicyPermissionsBoundaryes una política AWS gestionada.
Uso de la política
Puede asociar AWSQuickSetupPatchPolicyPermissionsBoundary a los usuarios, grupos y roles.
Información de la política
-
Tipo: política AWS gestionada
-
Hora de creación: 26 de junio de 2024 a las 09:46 UTC
-
Hora editada: 26 de junio de 2024 a las 09:46 UTC
-
ARN:
arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary
Versión de la política
Versión de la política: v1 (predeterminada)
La versión predeterminada de la política define qué permisos tendrá. Cuando un usuario o un rol con la política solicita el acceso a un AWS recurso, AWS comprueba la versión predeterminada de la política para determinar si permite la solicitud.
Documento de política JSON
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "PatchingAutomationRoleGetPermissions", "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : [ "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" ] }, { "Sid" : "PatchingAutomationRolePassPermissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ssm.amazonaws.com" ] } } }, { "Sid" : "DefaultInstanceRolePermissions", "Effect" : "Allow", "Action" : [ "iam:CreateRole", "iam:DeleteRole", "iam:UpdateRole", "iam:GetRole" ], "Condition" : { "StringLike" : { "aws:PrincipalTag/QuickSetupManagerID" : "*" }, "ArnLike" : { "aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" } }, "Resource" : [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid" : "DefaultInstanceRolePassPermissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com", "ssm.amazonaws.com" ] } } }, { "Sid" : "PoliciesAttachPermissions", "Effect" : "Allow", "Action" : [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition" : { "ArnEquals" : { "iam:PolicyARN" : [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess" ] }, "StringLike" : { "aws:PrincipalTag/QuickSetupManagerID" : "*" }, "ArnLike" : { "aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" } }, "Resource" : "arn:aws:iam::*:role/*" }, { "Sid" : "CreateSLRPermissions", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "ssm.amazonaws.com" } } }, { "Sid" : "InstanceRoleAddPermissions", "Effect" : "Allow", "Action" : [ "iam:AddRoleToInstanceProfile" ], "Resource" : [ "*" ] }, { "Sid" : "ManagedInstanceRoleUpdatePermissions", "Effect" : "Allow", "Action" : [ "ssm:UpdateManagedInstanceRole" ], "Resource" : "*" }, { "Sid" : "IAMReadOnlyPermissions", "Effect" : "Allow", "Action" : [ "iam:GetInstanceProfile", "iam:GetRolePolicy", "iam:ListInstanceProfilesForRole", "iam:ListRoles" ], "Resource" : [ "*" ] }, { "Sid" : "InstanceProfileCreatePermissions", "Effect" : "Allow", "Action" : [ "iam:CreateInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid" : "InstanceProfileAssociationPermissions", "Effect" : "Allow", "Action" : [ "ec2:AssociateIamInstanceProfile" ], "Resource" : "*", "Condition" : { "Null" : { "ec2:InstanceProfile" : "true" }, "ArnLike" : { "ec2:NewInstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid" : "InstanceProfileDisassociationPermissions", "Effect" : "Allow", "Action" : [ "ec2:DisassociateIamInstanceProfile" ], "Resource" : "*", "Condition" : { "ArnLike" : { "ec2:InstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid" : "SSMAssociationsPermissions", "Effect" : "Allow", "Action" : [ "ssm:DescribeAssociationExecutions", "ssm:UpdateAssociation", "ssm:DescribeAssociation" ], "Resource" : [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid" : "BaselineS3Permissions", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:Put*", "s3:Get*", "s3:List*", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:DeleteBucket" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : [ "${aws:PrincipalAccount}" ] } }, "Resource" : "arn:aws:s3:::aws-quicksetup-patchpolicy-*" }, { "Sid" : "PatchingFunctionsPermissions", "Effect" : "Allow", "Action" : [ "lambda:InvokeFunction" ], "Resource" : [ "arn:aws:lambda:*:*:function:baseline-overrides-*", "arn:aws:lambda:*:*:function:delete-name-tags-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : [ "${aws:PrincipalAccount}" ] } } }, { "Sid" : "LoggingPermissions", "Effect" : "Allow", "Action" : [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*", "arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*" ] }, { "Sid" : "SSMTaggingPermissions", "Effect" : "Allow", "Action" : [ "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource" ], "Resource" : "arn:aws:ssm:*:*:managed-instance/*", "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : "QSConfigName-*" } } }, { "Sid" : "EC2TaggingPermissions", "Effect" : "Allow", "Action" : [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : "QSConfigName-*" } } }, { "Sid" : "RoleTaggingPermissions", "Effect" : "Allow", "Action" : [ "iam:TagRole", "iam:UntagRole" ], "Resource" : "*", "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : "QSConfigId-*" } } }, { "Sid" : "PatchingReadOnlyPermissions", "Effect" : "Allow", "Action" : [ "ssm:GetPatchBaseline", "ssm:GetInventory", "ssm:DescribeInstanceInformation", "ssm:DescribeAssociation", "ssm:GetAutomationExecution", "ssm:ListTagsForResource", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeInstances" ], "Resource" : "*" }, { "Sid" : "PatchingAutomationsStartPermissions", "Effect" : "Allow", "Action" : [ "ssm:StartAutomationExecution" ], "Resource" : [ "arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer*", "arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaseline*", "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*", "arn:aws:ssm:*:*:automation-definition/QuickSetup-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-*" ] }, { "Sid" : "ReadOnlyPermissionsForEnablingExplorer", "Effect" : "Allow", "Action" : [ "iam:ListRoles", "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource" : "*" }, { "Sid" : "ExplorerServiceSettingsPermissions", "Effect" : "Allow", "Action" : [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource" : [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] }
Más información
