翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
AWSQuickSetupPatchPolicyPermissionsBoundary
説明: QuickSetup は、ユーザーに代わって Systems Manager Patch Manager 機能を設定できるようにする IAM ロールを作成しますが、そのようなロール作成時にこのポリシーを使用してアクセス許可の範囲を定義します。
AWSQuickSetupPatchPolicyPermissionsBoundary は AWS マネージドポリシーです。
このポリシーを使用すると
ユーザー、グループおよびロールに AWSQuickSetupPatchPolicyPermissionsBoundary をアタッチできます。
ポリシーの詳細
-
タイプ: AWS マネージドポリシー
-
作成日時: 2024 年 6 月 26 日 09:46 UTC
-
編集日時: 2024 年 6 月 26 日 09:46 UTC
-
ARN:
arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary
ポリシーのバージョン
ポリシーのバージョン: v1 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを適用したユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、AWS はポリシーのデフォルトバージョンを確認し、リクエストを許可するかどうかを判断します。
JSON ポリシードキュメント
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "PatchingAutomationRoleGetPermissions", "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : [ "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" ] }, { "Sid" : "PatchingAutomationRolePassPermissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ssm.amazonaws.com" ] } } }, { "Sid" : "DefaultInstanceRolePermissions", "Effect" : "Allow", "Action" : [ "iam:CreateRole", "iam:DeleteRole", "iam:UpdateRole", "iam:GetRole" ], "Condition" : { "StringLike" : { "aws:PrincipalTag/QuickSetupManagerID" : "*" }, "ArnLike" : { "aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" } }, "Resource" : [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid" : "DefaultInstanceRolePassPermissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com", "ssm.amazonaws.com" ] } } }, { "Sid" : "PoliciesAttachPermissions", "Effect" : "Allow", "Action" : [ "iam:AttachRolePolicy", "iam:DetachRolePolicy" ], "Condition" : { "ArnEquals" : { "iam:PolicyARN" : [ "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess" ] }, "StringLike" : { "aws:PrincipalTag/QuickSetupManagerID" : "*" }, "ArnLike" : { "aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*" } }, "Resource" : "arn:aws:iam::*:role/*" }, { "Sid" : "CreateSLRPermissions", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "ssm.amazonaws.com" } } }, { "Sid" : "InstanceRoleAddPermissions", "Effect" : "Allow", "Action" : [ "iam:AddRoleToInstanceProfile" ], "Resource" : [ "*" ] }, { "Sid" : "ManagedInstanceRoleUpdatePermissions", "Effect" : "Allow", "Action" : [ "ssm:UpdateManagedInstanceRole" ], "Resource" : "*" }, { "Sid" : "IAMReadOnlyPermissions", "Effect" : "Allow", "Action" : [ "iam:GetInstanceProfile", "iam:GetRolePolicy", "iam:ListInstanceProfilesForRole", "iam:ListRoles" ], "Resource" : [ "*" ] }, { "Sid" : "InstanceProfileCreatePermissions", "Effect" : "Allow", "Action" : [ "iam:CreateInstanceProfile" ], "Resource" : [ "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" ] }, { "Sid" : "InstanceProfileAssociationPermissions", "Effect" : "Allow", "Action" : [ "ec2:AssociateIamInstanceProfile" ], "Resource" : "*", "Condition" : { "Null" : { "ec2:InstanceProfile" : "true" }, "ArnLike" : { "ec2:NewInstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid" : "InstanceProfileDisassociationPermissions", "Effect" : "Allow", "Action" : [ "ec2:DisassociateIamInstanceProfile" ], "Resource" : "*", "Condition" : { "ArnLike" : { "ec2:InstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup" } } }, { "Sid" : "SSMAssociationsPermissions", "Effect" : "Allow", "Action" : [ "ssm:DescribeAssociationExecutions", "ssm:UpdateAssociation", "ssm:DescribeAssociation" ], "Resource" : [ "arn:aws:ssm:*:*:document/AWSQuickSetup-*", "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid" : "BaselineS3Permissions", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:Put*", "s3:Get*", "s3:List*", "s3:DeleteObject", "s3:DeleteObjectVersion", "s3:DeleteBucket" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : [ "${aws:PrincipalAccount}" ] } }, "Resource" : "arn:aws:s3:::aws-quicksetup-patchpolicy-*" }, { "Sid" : "PatchingFunctionsPermissions", "Effect" : "Allow", "Action" : [ "lambda:InvokeFunction" ], "Resource" : [ "arn:aws:lambda:*:*:function:baseline-overrides-*", "arn:aws:lambda:*:*:function:delete-name-tags-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : [ "${aws:PrincipalAccount}" ] } } }, { "Sid" : "LoggingPermissions", "Effect" : "Allow", "Action" : [ "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*", "arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*" ] }, { "Sid" : "SSMTaggingPermissions", "Effect" : "Allow", "Action" : [ "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource" ], "Resource" : "arn:aws:ssm:*:*:managed-instance/*", "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : "QSConfigName-*" } } }, { "Sid" : "EC2TaggingPermissions", "Effect" : "Allow", "Action" : [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : "QSConfigName-*" } } }, { "Sid" : "RoleTaggingPermissions", "Effect" : "Allow", "Action" : [ "iam:TagRole", "iam:UntagRole" ], "Resource" : "*", "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : "QSConfigId-*" } } }, { "Sid" : "PatchingReadOnlyPermissions", "Effect" : "Allow", "Action" : [ "ssm:GetPatchBaseline", "ssm:GetInventory", "ssm:DescribeInstanceInformation", "ssm:DescribeAssociation", "ssm:GetAutomationExecution", "ssm:ListTagsForResource", "ec2:DescribeIamInstanceProfileAssociations", "ec2:DescribeInstances" ], "Resource" : "*" }, { "Sid" : "PatchingAutomationsStartPermissions", "Effect" : "Allow", "Action" : [ "ssm:StartAutomationExecution" ], "Resource" : [ "arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer*", "arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaseline*", "arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*", "arn:aws:ssm:*:*:automation-definition/QuickSetup-*", "arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-*" ] }, { "Sid" : "ReadOnlyPermissionsForEnablingExplorer", "Effect" : "Allow", "Action" : [ "iam:ListRoles", "config:DescribeConfigurationRecorders", "compute-optimizer:GetEnrollmentStatus", "support:DescribeTrustedAdvisorChecks" ], "Resource" : "*" }, { "Sid" : "ExplorerServiceSettingsPermissions", "Effect" : "Allow", "Action" : [ "ssm:UpdateServiceSetting", "ssm:GetServiceSetting" ], "Resource" : [ "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager", "arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor", "arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase" ] } ] }
詳細はこちら
