Configuración de permisos para Application Manager de Systems Manager

Puede utilizar todas las características de Application Manager, una capacidad de AWS Systems Manager, si la entidad (como el usuario, el grupo o el rol) de AWS Identity and Access Management (IAM) tiene acceso a las operaciones de la API que se enumeran en este tema. Las operaciones de API están separadas en dos tablas para ayudarlo a comprender las diferentes funciones que realizan.

La siguiente tabla contiene una lista de las operaciones de la API que Systems Manager llama si elige un recurso en Application Manager porque desea ver los detalles del recurso. Por ejemplo, si Application Manager muestra un grupo de Amazon EC2 Auto Scaling y, si elige ese grupo para ver sus detalles, Systems Manager llama las operaciones autoscaling:DescribeAutoScalingGroups de la API. Si no tiene ningún grupo de escalado automático en su cuenta, esta operación de API no se llama desde Application Manager.

Detalles del recurso únicamente

acm:DescribeCertificate acm:ListTagsForCertificate autoscaling:DescribeAutoScalingGroups cloudfront:GetDistribution cloudfront:ListTagsForResource cloudtrail:DescribeTrails cloudtrail:ListTags cloudtrail:LookupEvents codebuild:BatchGetProjects codepipeline:GetPipeline codepipeline:ListTagsForResource dynamodb:DescribeTable dynamodb:ListTagsOfResource ec2:DescribeAddresses ec2:DescribeCustomerGateways ec2:DescribeHosts ec2:DescribeInternetGateways ec2:DescribeNetworkAcls ec2:DescribeNetworkInterfaces ec2:DescribeRouteTables ec2:DescribeSecurityGroups ec2:DescribeSubnets ec2:DescribeVolumes ec2:DescribeVpcs ec2:DescribeVpnConnections ec2:DescribeVpnGateways elasticbeanstalk:DescribeApplications elasticbeanstalk:ListTagsForResource elasticloadbalancing:DescribeInstanceHealth elasticloadbalancing:DescribeListeners elasticloadbalancing:DescribeLoadBalancers elasticloadbalancing:DescribeTags iam:GetGroup iam:GetPolicy iam:GetRole iam:GetUser lambda:GetFunction rds:DescribeDBClusters rds:DescribeDBInstances rds:DescribeDBSecurityGroups rds:DescribeDBSnapshots rds:DescribeDBSubnetGroups rds:DescribeEventSubscriptions rds:ListTagsForResource redshift:DescribeClusterParameters redshift:DescribeClusterSecurityGroups redshift:DescribeClusterSnapshots redshift:DescribeClusterSubnetGroups redshift:DescribeClusters s3:GetBucketTagging

La siguiente tabla contiene una lista de las operaciones de la API que Systems Manager utiliza para realizar cambios en las aplicaciones y los recursos que se indican en Application Manager o para ver la información de operaciones de una aplicación o recurso seleccionados.

Acciones y detalles de la aplicación

applicationinsights:CreateApplication applicationinsights:DescribeApplication applicationinsights:ListProblems ce:GetCostAndUsage ce:GetTags ce:ListCostAllocationTags ce:UpdateCostAllocationTagsStatus cloudformation:CreateStack cloudformation:DeleteStack cloudformation:DescribeStackDriftDetectionStatus cloudformation:DescribeStackEvents cloudformation:DescribeStacks cloudformation:DetectStackDrift cloudformation:GetTemplate cloudformation:GetTemplateSummary cloudformation:ListStacks cloudformation:UpdateStack cloudwatch:DescribeAlarms cloudwatch:DescribeInsightRules cloudwatch:DisableAlarmActions cloudwatch:EnableAlarmActions cloudwatch:GetMetricData cloudwatch:ListTagsForResource cloudwatch:PutMetricAlarm config:DescribeComplianceByConfigRule config:DescribeComplianceByResource config:DescribeConfigRules config:DescribeRemediationConfigurations config:GetComplianceDetailsByConfigRule config:GetComplianceDetailsByResource config:GetResourceConfigHistory config:ListDiscoveredResources config:PutRemediationConfigurations config:SelectResourceConfig config:StartConfigRulesEvaluation config:StartRemediationExecution ec2:DescribeInstances ecs:DescribeCapacityProviders ecs:DescribeClusters ecs:DescribeContainerInstances ecs:ListClusters ecs:ListContainerInstances ecs:TagResource eks:DescribeCluster eks:DescribeFargateProfile eks:DescribeNodegroup eks:ListClusters eks:ListFargateProfiles eks:ListNodegroups eks:TagResource iam:CreateServiceLinkedRole iam:ListRoles logs:DescribeLogGroups resource-groups:CreateGroup resource-groups:DeleteGroup resource-groups:GetGroup resource-groups:GetGroupQuery resource-groups:GetTags resource-groups:ListGroupResources resource-groups:ListGroups resource-groups:Tag resource-groups:Untag resource-groups:UpdateGroup s3:ListAllMyBuckets s3:ListBucket s3:ListBucketVersions servicecatalog:GetApplication servicecatalog:ListApplications sns:CreateTopic sns:ListSubscriptionsByTopic sns:ListTopics sns:Subscribe ssm:AddTagsToResource ssm:CreateDocument ssm:CreateOpsMetadata ssm:DeleteDocument ssm:DeleteOpsMetadata ssm:DescribeAssociation ssm:DescribeAutomationExecutions ssm:DescribeDocument ssm:DescribeDocumentPermission ssm:GetDocument ssm:GetInventory ssm:GetOpsMetadata ssm:GetOpsSummary ssm:GetServiceSetting ssm:ListAssociations ssm:ListComplianceItems ssm:ListDocuments ssm:ListDocumentVersions ssm:ListOpsMetadata ssm:ListResourceComplianceSummaries ssm:ListTagsForResource ssm:ModifyDocumentPermission ssm:RemoveTagsFromResource ssm:StartAssociationsOnce ssm:StartAutomationExecution ssm:UpdateDocument ssm:UpdateDocumentDefaultVersion ssm:UpdateOpsItem ssm:UpdateOpsMetadata ssm:UpdateServiceSetting tag:GetTagKeys tag:GetTagValues tag:TagResources tag:UntagResources

Configurar los permisos

Para configurar permisos de Application Manager para una entidad (un usuario, un grupo o un rol) de IAM, cree una política de IAM mediante el siguiente ejemplo. Este ejemplo de política incluye todas las operaciones de la API utilizadas por Application Manager.

                    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acm:DescribeCertificate",
                "acm:ListTagsForCertificate",
                "applicationinsights:CreateApplication",
                "applicationinsights:DescribeApplication",
                "applicationinsights:ListProblems",
                "autoscaling:DescribeAutoScalingGroups",
                "ce:GetCostAndUsage",
                "ce:GetTags",
                "ce:ListCostAllocationTags",
                "ce:UpdateCostAllocationTagsStatus",
                "cloudformation:CreateStack",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStackDriftDetectionStatus",
                "cloudformation:DescribeStackEvents",
                "cloudformation:DescribeStacks",
                "cloudformation:DetectStackDrift",
                "cloudformation:GetTemplate",
                "cloudformation:GetTemplateSummary",
                "cloudformation:ListStacks",
                "cloudformation:ListStackResources",
                "cloudformation:UpdateStack",
                "cloudfront:GetDistribution",
                "cloudfront:ListTagsForResource",
                "cloudtrail:DescribeTrails",
                "cloudtrail:ListTags",
                "cloudtrail:LookupEvents",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DescribeInsightRules",
                "cloudwatch:DisableAlarmActions",
                "cloudwatch:EnableAlarmActions",
                "cloudwatch:GetMetricData",
                "cloudwatch:ListTagsForResource",
                "cloudwatch:PutMetricAlarm",
                "codebuild:BatchGetProjects",
                "codepipeline:GetPipeline",
                "codepipeline:ListTagsForResource",
                "config:DescribeComplianceByConfigRule",
                "config:DescribeComplianceByResource",
                "config:DescribeConfigRules",
                "config:DescribeRemediationConfigurations",
                "config:GetComplianceDetailsByConfigRule",
                "config:GetComplianceDetailsByResource",
                "config:GetResourceConfigHistory",
                "config:ListDiscoveredResources",
                "config:PutRemediationConfigurations",
                "config:SelectResourceConfig",
                "config:StartConfigRulesEvaluation",
                "config:StartRemediationExecution",
                "dynamodb:DescribeTable",
                "dynamodb:ListTagsOfResource",
                "ec2:DescribeAddresses",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeHosts",
                "ec2:DescribeInstances",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcs",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeVpnGateways",
                "ecs:DescribeCapacityProviders",
                "ecs:DescribeClusters",
                "ecs:DescribeContainerInstances",
                "ecs:ListClusters",
                "ecs:ListContainerInstances",
                "ecs:TagResource",
                "eks:DescribeCluster",
                "eks:DescribeFargateProfile",
                "eks:DescribeNodegroup",
                "eks:ListClusters",
                "eks:ListFargateProfiles",
                "eks:ListNodegroups",
                "eks:TagResource",
                "elasticbeanstalk:DescribeApplications",
                "elasticbeanstalk:ListTagsForResource",
                "elasticloadbalancing:DescribeInstanceHealth",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags",
                "iam:CreateServiceLinkedRole",
                "iam:GetGroup",
                "iam:GetPolicy",
                "iam:GetRole",
                "iam:GetUser",
                "iam:ListRoles",
                "lambda:GetFunction",
                "logs:DescribeLogGroups",
                "rds:DescribeDBClusters",
                "rds:DescribeDBInstances",
                "rds:DescribeDBSecurityGroups",
                "rds:DescribeDBSnapshots",
                "rds:DescribeDBSubnetGroups",
                "rds:DescribeEventSubscriptions",
                "rds:ListTagsForResource",
                "redshift:DescribeClusterParameters",
                "redshift:DescribeClusters",
                "redshift:DescribeClusterSecurityGroups",
                "redshift:DescribeClusterSnapshots",
                "redshift:DescribeClusterSubnetGroups",
                "resource-groups:CreateGroup",
                "resource-groups:DeleteGroup",
                "resource-groups:GetGroup",
                "resource-groups:GetGroupQuery",
                "resource-groups:GetTags",
                "resource-groups:ListGroupResources",
                "resource-groups:ListGroups",
                "resource-groups:Tag",
                "resource-groups:Untag",
                "resource-groups:UpdateGroup",
                "s3:GetBucketTagging",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "servicecatalog:GetApplication",
                "servicecatalog:ListApplications",
                "sns:CreateTopic",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sns:Subscribe",
                "ssm:AddTagsToResource",
                "ssm:CreateDocument",
                "ssm:CreateOpsMetadata",
                "ssm:DeleteDocument",
                "ssm:DeleteOpsMetadata",
                "ssm:DescribeAssociation",
                "ssm:DescribeAutomationExecutions",
                "ssm:DescribeDocument",
                "ssm:DescribeDocumentPermission",
                "ssm:GetDocument",
                "ssm:GetInventory",
                "ssm:GetOpsMetadata",
                "ssm:GetOpsSummary",
                "ssm:GetServiceSetting",
                "ssm:ListAssociations",
                "ssm:ListComplianceItems",
                "ssm:ListDocuments",
                "ssm:ListDocumentVersions",
                "ssm:ListOpsMetadata",
                "ssm:ListResourceComplianceSummaries",
                "ssm:ListTagsForResource",
                "ssm:ModifyDocumentPermission",
                "ssm:RemoveTagsFromResource",
                "ssm:StartAssociationsOnce",
                "ssm:StartAutomationExecution",
                "ssm:UpdateDocument",
                "ssm:UpdateDocumentDefaultVersion",
                "ssm:UpdateOpsMetadata",
                "ssm:UpdateOpsItem",
                "ssm:UpdateServiceSetting",
                "tag:GetResources",
                "tag:GetTagKeys",
                "tag:GetTagValues",
                "tag:TagResources",
                "tag:UntagResources"
            ],
            "Resource": "*"
        }
    ]
}

nota

Puede restringir la capacidad de un usuario para realizar cambios en aplicaciones y recursos en Application Manager. Esto lo puede hacer si elimina las siguientes operaciones de la API de la política de permisos de IAM asociada a su usuario, grupo o rol. La eliminación de estas acciones crea una experiencia de solo lectura en Application Manager. Las siguientes son todas las API que permiten a los usuarios realizar cambios en la aplicación o en cualquier otro recurso relacionado.

applicationinsights:CreateApplication
ce:UpdateCostAllocationTagsStatus
cloudformation:CreateStack
cloudformation:DeleteStack
cloudformation:UpdateStack
cloudwatch:DisableAlarmActions
cloudwatch:EnableAlarmActions
cloudwatch:PutMetricAlarm
config:PutRemediationConfigurations
config:StartConfigRulesEvaluation
config:StartRemediationExecution
ecs:TagResource
eks:TagResource
iam:CreateServiceLinkedRole
resource-groups:CreateGroup
resource-groups:DeleteGroup
resource-groups:Tag
resource-groups:Untag
resource-groups:UpdateGroup
sns:CreateTopic
sns:Subscribe
ssm:AddTagsToResource
ssm:CreateDocument
ssm:CreateOpsMetadata
ssm:DeleteDocument
ssm:DeleteOpsMetadata
ssm:ModifyDocumentPermission
ssm:RemoveTagsFromResource
ssm:StartAssociationsOnce
ssm:StartAutomationExecution
ssm:UpdateDocument
ssm:UpdateDocumentDefaultVersion
ssm:UpdateOpsMetadata
ssm:UpdateOpsItem
ssm:UpdateServiceSetting
tag:TagResources
tag:UntagResources

Para obtener información acerca de la creación y la edición de políticas de IAM, consulte Creación de políticas de IAM en la Guía del usuario de IAM. Para obtener información acerca de cómo asignar esta política a una entidad (un usuario, un grupo o un rol) de IAM, consulte Adición y eliminación de permisos de identidad de IAM.