Le traduzioni sono generate tramite traduzione automatica. In caso di conflitto tra il contenuto di una traduzione e la versione originale in Inglese, quest'ultima prevarrà.
BedrockAgentCoreFullAccess
Descrizione: Fornisce accesso completo a Bedrock AgentCore e accesso limitato ai servizi correlati
BedrockAgentCoreFullAccessè una politica AWS gestita.
Utilizzo di questa politica
Puoi collegarti BedrockAgentCoreFullAccess ai tuoi utenti, gruppi e ruoli.
Dettagli della politica
-
Tipo: politica AWS gestita
-
Ora di creazione: 16 luglio 2025, 13:37 UTC
-
Ora modificata: 16 luglio 2025, 13:37 UTC
-
ARN:
arn:aws:iam::aws:policy/BedrockAgentCoreFullAccess
Versione della politica
Versione della politica: v1 (predefinita)
La versione predefinita della politica è la versione che definisce le autorizzazioni per la politica. Quando un utente o un ruolo con la politica effettua una richiesta di accesso a una AWS risorsa, AWS controlla la versione predefinita della politica per determinare se consentire la richiesta.
Documento di policy JSON
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "BedrockAgentCoreFullAccess", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:*" ], "Resource" : "arn:aws:bedrock-agentcore:*:*:*" }, { "Sid" : "IAMListAccess", "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles" ], "Resource" : "arn:aws:iam::*:role/*" }, { "Sid" : "BedrockAgentCorePassRoleAccess", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/*BedrockAgentCore*", "Condition" : { "StringEquals" : { "iam:PassedToService" : "bedrock-agentcore.amazonaws.com" } } }, { "Sid" : "SecretsManagerAccess", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret", "secretsmanager:PutSecretValue", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:bedrock-agentcore*" }, { "Sid" : "BedrockAgentCoreKMSReadAccess", "Effect" : "Allow", "Action" : [ "kms:ListKeys", "kms:DescribeKey" ], "Resource" : [ "arn:aws:kms:*:*:key/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockAgentCoreKMSAccess", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : [ "arn:aws:kms:*:*:key/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "bedrock-agentcore.amazonaws.com" ] } } }, { "Sid" : "BedrockAgentCoreS3Access", "Effect" : "Allow", "Action" : [ "s3:GetObject" ], "Resource" : [ "arn:aws:s3:::bedrock-agentcore-gateway-*" ], "Condition" : { "StringEquals" : { "aws:CalledViaLast" : "bedrock-agentcore.amazonaws.com", "s3:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockAgentCoreGatewayLambdaAccess", "Effect" : "Allow", "Action" : [ "lambda:ListFunctions" ], "Resource" : [ "arn:aws:lambda:*:*:*" ] }, { "Sid" : "LoggingAccess", "Effect" : "Allow", "Action" : [ "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*", "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*", "arn:aws:logs:*:*:log-group:aws/spans:*" ] }, { "Sid" : "ObservabilityReadOnlyPermissions", "Effect" : "Allow", "Action" : [ "application-autoscaling:DescribeScalingPolicies", "application-signals:BatchGet*", "application-signals:Get*", "application-signals:List*", "autoscaling:Describe*", "cloudwatch:BatchGet*", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "oam:ListSinks", "rum:BatchGet*", "rum:Get*", "rum:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "xray:BatchGet*", "xray:Get*", "xray:List*", "xray:StartTraceRetrieval", "xray:CancelTraceRetrieval", "logs:DescribeLogGroups", "logs:StartLiveTail", "logs:StopLiveTail" ], "Resource" : "*" }, { "Sid" : "TransactionSearchXRayPermissions", "Effect" : "Allow", "Action" : [ "xray:GetTraceSegmentDestination", "xray:UpdateTraceSegmentDestination", "xray:GetIndexingRules", "xray:UpdateIndexingRule" ], "Resource" : "*" }, { "Sid" : "TransactionSearchLogGroupPermissions", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutRetentionPolicy" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*", "arn:aws:logs:*:*:log-group:aws/spans:*" ] }, { "Sid" : "TransactionSearchLogsPermissions", "Effect" : "Allow", "Action" : [ "logs:DescribeResourcePolicies" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TransactionSearchApplicationSignalsPermissions", "Effect" : "Allow", "Action" : [ "application-signals:StartDiscovery" ], "Resource" : "*" }, { "Sid" : "CloudWatchApplicationSignalsCreateServiceLinkedRolePermissions", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals", "Condition" : { "StringLike" : { "iam:AWSServiceName" : "application-signals.cloudwatch.amazonaws.com" } } }, { "Sid" : "CloudWatchApplicationSignalsGetRolePermissions", "Effect" : "Allow", "Action" : "iam:GetRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals" } ] }
Ulteriori informazioni
