Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.

# AmazonQuickSuiteAccessPolicy
<a name="AmazonQuickSuiteAccessPolicy"></a>

**Deskripsi**: Memberikan izin bagi Amazon Quick Suite untuk mengelola aplikasi Pusat Identitas IAM, pengguna dan grup penyimpanan identitas, langganan pengguna, dan QuickSight sumber daya atas nama Anda.

`AmazonQuickSuiteAccessPolicy` adalah [AWS kebijakan yang dikelola](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).

## Menggunakan kebijakan ini
<a name="AmazonQuickSuiteAccessPolicy-how-to-use"></a>

Anda dapat melampirkan `AmazonQuickSuiteAccessPolicy` untuk pengguna, grup, dan peran Anda.

## Detail kebijakan
<a name="AmazonQuickSuiteAccessPolicy-details"></a>
+ **Mengetik**: Kebijakan peran layanan 
+ **Waktu penciptaan**: 19 Oktober 2026, 23:57 UTC 
+ **Waktu yang diedit:** 19 Oktober 2026, 23:57 UTC
+ **ARN**: `arn:aws:iam::aws:policy/service-role/AmazonQuickSuiteAccessPolicy`

## Versi kebijakan
<a name="AmazonQuickSuiteAccessPolicy-version"></a>

**Versi kebijakan:** v1 (default)

Versi default kebijakan adalah versi yang menentukan izin untuk kebijakan. Ketika pengguna atau peran dengan kebijakan membuat permintaan untuk mengakses AWS sumber daya, AWS memeriksa versi default kebijakan untuk menentukan apakah akan mengizinkan permintaan. 

## Dokumen kebijakan JSON
<a name="AmazonQuickSuiteAccessPolicy-json"></a>

```
{
  "Version" : "2012-10-17",
  "Statement" : [
    {
      "Sid" : "quicksight",
      "Effect" : "Allow",
      "Action" : "quicksight:*",
      "Resource" : "*"
    },
    {
      "Sid" : "identitystore",
      "Effect" : "Allow",
      "Action" : [
        "identitystore:ListUsers",
        "identitystore:ListGroups",
        "identitystore:DescribeUser",
        "identitystore:DescribeGroup",
        "identitystore:CreateUser",
        "identitystore:CreateGroup",
        "identitystore:UpdateUser",
        "identitystore:UpdateGroup",
        "identitystore:DeleteUser",
        "identitystore:DeleteGroup",
        "identitystore:ReserveUser",
        "identitystore:GetUserId",
        "identitystore:GetGroupId",
        "identitystore:ListGroupMembershipsForMember"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "ssoControlPlane",
      "Effect" : "Allow",
      "Action" : [
        "sso:DescribeInstance",
        "sso:ListInstances",
        "sso:DescribeRegisteredRegions",
        "sso:CreateApplication",
        "sso:UpdateApplication",
        "sso:DeleteApplication",
        "sso:DescribeApplication",
        "sso:ListApplications",
        "sso:PutApplicationAuthenticationMethod",
        "sso:PutApplicationGrant",
        "sso:ListApplicationGrants",
        "sso:PutApplicationAccessScope",
        "sso:DeleteApplicationAccessScope",
        "sso:ListApplicationAccessScopes",
        "sso:CreateApplicationAssignment",
        "sso:DeleteApplicationAssignment",
        "sso:PutApplicationAssignmentConfiguration",
        "sso:AssociateProfile",
        "sso:DisassociateProfile",
        "sso:ListProfiles",
        "sso:GetProfile",
        "sso:ListDirectoryAssociations",
        "sso:SearchGroups"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "ssoOauthRuntime",
      "Effect" : "Allow",
      "Action" : [
        "sso-oauth:CreateTokenWithIAM",
        "sso-oauth:IntrospectTokenWithIAM",
        "sso-oauth:RevokeTokenWithIAM"
      ],
      "Resource" : "arn:aws:sso::*:application/*"
    },
    {
      "Sid" : "signin",
      "Effect" : "Allow",
      "Action" : "signin:CreateOAuth2Token",
      "Resource" : [
        "arn:aws:signin:*:*:*"
      ],
      "Condition" : {
        "StringEquals" : {
          "aws:ResourceAccount" : "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid" : "stsSelf",
      "Effect" : "Allow",
      "Action" : [
        "sts:AssumeRole",
        "sts:SetContext",
        "sts:TagSession"
      ],
      "Resource" : [
        "arn:aws:iam::*:role/AmazonQuickSuiteAccessRole"
      ],
      "Condition" : {
        "StringEquals" : {
          "aws:ResourceAccount" : "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid" : "passRoleSelf",
      "Effect" : "Allow",
      "Action" : "iam:PassRole",
      "Resource" : [
        "arn:aws:iam::*:role/AmazonQuickSuiteAccessRole"
      ],
      "Condition" : {
        "StringEquals" : {
          "aws:ResourceAccount" : "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid" : "userSubscriptions",
      "Effect" : "Allow",
      "Action" : [
        "user-subscriptions:SetOverageConfig",
        "user-subscriptions:GetCurrentPlanDetails",
        "user-subscriptions:ListApplicationClaims",
        "user-subscriptions:CreateUpdatePlanPreview",
        "user-subscriptions:UpdateClaim",
        "user-subscriptions:CreateClaim"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "organizations",
      "Effect" : "Allow",
      "Action" : [
        "organizations:DescribeOrganization",
        "organizations:ListAWSServiceAccessForOrganization"
      ],
      "Resource" : "*"
    }
  ]
}
```

## Pelajari selengkapnya
<a name="AmazonQuickSuiteAccessPolicy-learn-more"></a>
+ [Buat kumpulan izin menggunakan AWS kebijakan yang dikelola di Pusat Identitas IAM](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) 
+ [Menambahkan dan menghapus izin identitas IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) 
+ [Memahami pembuatan versi untuk kebijakan IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Memulai dengan AWS kebijakan terkelola dan bergerak menuju izin hak istimewa terendah](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)