Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.
AWSQuickSetupSSMHostMgmtPermissionsBoundary
Descripción: Quick Setup crea funciones de IAM que le permiten configurar el tipo de configuración rápida de Host Manager en su nombre y utiliza esta política al crear dichas funciones para definir el límite de sus permisos.
AWSQuickSetupSSMHostMgmtPermissionsBoundary
es una política AWS gestionada.
Uso de la política
Puede asociar AWSQuickSetupSSMHostMgmtPermissionsBoundary
a los usuarios, grupos y roles.
Información de la política
-
Tipo: política AWS gestionada
-
Hora de creación: 26 de junio de 2024 a las 09:48 UTC
-
Hora editada: 26 de junio de 2024 a las 09:48 UTC
-
ARN:
arn:aws:iam::aws:policy/AWSQuickSetupSSMHostMgmtPermissionsBoundary
Versión de la política
Versión de la política: v1 (predeterminada)
La versión predeterminada de la política define qué permisos tendrá. Cuando un usuario o un rol con la política solicita el acceso a un AWS recurso, AWS comprueba la versión predeterminada de la política para determinar si permite la solicitud.
Documento de política JSON
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "HostManagementAutomationRoleGetPermissions", "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : [ "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" ] }, { "Sid" : "HostManagementAutomationRolePassPermissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ssm.amazonaws.com" ] } } }, { "Sid" : "DefaultInstanceRoleManagePermissions", "Effect" : "Allow", "Action" : [ "iam:CreateRole", "iam:DeleteRole", "iam:UpdateRole", "iam:GetRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition" : { "StringLike" : { "aws:PrincipalTag/QuickSetupManagerID" : "*" }, "ArnLike" : { "aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" } } }, { "Sid" : "DefaultInstanceRolePassToEC2Permissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com" ] } } }, { "Sid" : "DefaultInstanceRolePassToSSMPermissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ssm.amazonaws.com" ] } } }, { "Sid" : "InstanceManagementPoliciesAttachPermissions", "Effect" : "Allow", "Action" : [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition" : { "ArnEquals" : { "iam:PolicyARN" : [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/AmazonSSMPatchAssociation" ] }, "StringLike" : { "aws:PrincipalTag/QuickSetupManagerID" : "*" }, "ArnLike" : { "aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-HostMgmtRole-*" } }, "Resource" : "arn:aws:iam::*:role/*" }, { "Sid" : "CreateSystemsManagerSLRPermissions", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "ssm.amazonaws.com" } } }, { "Sid" : "DefaultInstanceRoleAddPermissions", "Effect" : "Allow", "Action" : [ "iam:AddRoleToInstanceProfile" ], "Resource" : [ "*" ] }, { "Sid" : "IAMReadOnlyPermissions", "Effect" : "Allow", "Action" : [ "iam:GetInstanceProfile", "iam:GetRolePolicy", "iam:ListInstanceProfilesForRole", "iam:ListRoles" ], "Resource" : [ "*" ] }, { "Sid" : "DefaultInstanceProfileCreatePermissions", "Effect" : "Allow", "Action" : [ "iam:CreateInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid" : "DefaultInstanceProfileAssociationPermissions", "Effect" : "Allow", "Action" : [ "ec2:AssociateIamInstanceProfile" ], "Resource" : "*", "Condition" : { "Null" : { "ec2:InstanceProfile" : "true" }, "ArnLike" : { "ec2:NewInstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid" : "DefaultInstanceProfileDisassociationPermissions", "Effect" : "Allow", "Action" : [ "ec2:DisassociateIamInstanceProfile" ], "Resource" : "*", "Condition" : { "ArnLike" : { "ec2:InstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid" : "ConfigurationAutomationsStartPermissions", "Effect" : "Allow", "Action" : [ "ssm:StartAutomationExecution" ], "Resource" : [ "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-HostMgmt-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-CreateAndAttachIAMToInstance-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-UpdateExistingInstanceProfile-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-InstallAndManageCloudWatchDocument-*", "arn:aws:ssm:*:*:automation-definition/UpdateCloudWatchDocument-*", "arn:aws:ssm:*:*:automation-definition/AWSEC2-UpdateLaunchAgent-*", "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*", "arn:aws:ssm:*:*:automation-definition/AWS-GatherSoftwareInventory*", "arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaselineAssociation*", "arn:aws:ssm:*:*:automation-definition/AWS-UpdateSSMAgent*" ] }, { "Sid" : "ReadOnlyPermissionsForEnablingHostManagementBySSM", "Effect" : "Allow", "Action" : [ "ssm:ListTagsForResource", "ssm:GetAutomationExecution", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeInstances" ], "Resource" : "*" }, { "Sid" : "ReadOnlyPermissionsForEnablingExplorer", "Effect" : "Allow", "Action" : [ "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource" : "*" }, { "Sid" : "SSMExplorerServiceSettingsPermissions", "Effect" : "Allow", "Action" : [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource" : [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] }