翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
AWSQuickSetupPatchPolicyPermissionsBoundary
説明: QuickSetup は、ユーザーに代わって Systems Manager Patch Manager 機能を設定できるようにする IAM ロールを作成しますが、そのようなロール作成時にこのポリシーを使用してアクセス許可の範囲を定義します。
AWSQuickSetupPatchPolicyPermissionsBoundary は AWS マネージドポリシーです。
このポリシーを使用すると
ユーザー、グループおよびロールに AWSQuickSetupPatchPolicyPermissionsBoundary をアタッチできます。
ポリシーの詳細
-
タイプ: AWS マネージドポリシー
-
作成日時: 2024 年 6 月 26 日 09:46 UTC
-
編集日時: 2024 年 6 月 26 日 09:46 UTC
-
ARN:
arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary
ポリシーのバージョン
ポリシーのバージョン: v1 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを適用したユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、AWS はポリシーのデフォルトバージョンを確認し、リクエストを許可するかどうかを判断します。
JSON ポリシードキュメント
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "PatchingAutomationRoleGetPermissions",
"Effect" : "Allow",
"Action" : [
"iam:GetRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
]
},
{
"Sid" : "PatchingAutomationRolePassPermissions",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid" : "DefaultInstanceRolePermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole",
"iam:DeleteRole",
"iam:UpdateRole",
"iam:GetRole"
],
"Condition" : {
"StringLike" : {
"aws:PrincipalTag/QuickSetupManagerID" : "*"
},
"ArnLike" : {
"aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource" : [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid" : "DefaultInstanceRolePassPermissions",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"ec2.amazonaws.com",
"ssm.amazonaws.com"
]
}
}
},
{
"Sid" : "PoliciesAttachPermissions",
"Effect" : "Allow",
"Action" : [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Condition" : {
"ArnEquals" : {
"iam:PolicyARN" : [
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
"arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess"
]
},
"StringLike" : {
"aws:PrincipalTag/QuickSetupManagerID" : "*"
},
"ArnLike" : {
"aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource" : "arn:aws:iam::*:role/*"
},
{
"Sid" : "CreateSLRPermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "ssm.amazonaws.com"
}
}
},
{
"Sid" : "InstanceRoleAddPermissions",
"Effect" : "Allow",
"Action" : [
"iam:AddRoleToInstanceProfile"
],
"Resource" : [
"*"
]
},
{
"Sid" : "ManagedInstanceRoleUpdatePermissions",
"Effect" : "Allow",
"Action" : [
"ssm:UpdateManagedInstanceRole"
],
"Resource" : "*"
},
{
"Sid" : "IAMReadOnlyPermissions",
"Effect" : "Allow",
"Action" : [
"iam:GetInstanceProfile",
"iam:GetRolePolicy",
"iam:ListInstanceProfilesForRole",
"iam:ListRoles"
],
"Resource" : [
"*"
]
},
{
"Sid" : "InstanceProfileCreatePermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateInstanceProfile"
],
"Resource" : [
"arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid" : "InstanceProfileAssociationPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:AssociateIamInstanceProfile"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"ec2:InstanceProfile" : "true"
},
"ArnLike" : {
"ec2:NewInstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid" : "InstanceProfileDisassociationPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DisassociateIamInstanceProfile"
],
"Resource" : "*",
"Condition" : {
"ArnLike" : {
"ec2:InstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid" : "SSMAssociationsPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeAssociationExecutions",
"ssm:UpdateAssociation",
"ssm:DescribeAssociation"
],
"Resource" : [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:ssm:*:*:association/*"
]
},
{
"Sid" : "BaselineS3Permissions",
"Effect" : "Allow",
"Action" : [
"s3:CreateBucket",
"s3:Put*",
"s3:Get*",
"s3:List*",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:DeleteBucket"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : [
"${aws:PrincipalAccount}"
]
}
},
"Resource" : "arn:aws:s3:::aws-quicksetup-patchpolicy-*"
},
{
"Sid" : "PatchingFunctionsPermissions",
"Effect" : "Allow",
"Action" : [
"lambda:InvokeFunction"
],
"Resource" : [
"arn:aws:lambda:*:*:function:baseline-overrides-*",
"arn:aws:lambda:*:*:function:delete-name-tags-*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : [
"${aws:PrincipalAccount}"
]
}
}
},
{
"Sid" : "LoggingPermissions",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*",
"arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*"
]
},
{
"Sid" : "SSMTaggingPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource"
],
"Resource" : "arn:aws:ssm:*:*:managed-instance/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigName-*"
}
}
},
{
"Sid" : "EC2TaggingPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigName-*"
}
}
},
{
"Sid" : "RoleTaggingPermissions",
"Effect" : "Allow",
"Action" : [
"iam:TagRole",
"iam:UntagRole"
],
"Resource" : "*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigId-*"
}
}
},
{
"Sid" : "PatchingReadOnlyPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:GetPatchBaseline",
"ssm:GetInventory",
"ssm:DescribeInstanceInformation",
"ssm:DescribeAssociation",
"ssm:GetAutomationExecution",
"ssm:ListTagsForResource",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeInstances"
],
"Resource" : "*"
},
{
"Sid" : "PatchingAutomationsStartPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:StartAutomationExecution"
],
"Resource" : [
"arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer*",
"arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaseline*",
"arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:automation-definition/QuickSetup-*",
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-*"
]
},
{
"Sid" : "ReadOnlyPermissionsForEnablingExplorer",
"Effect" : "Allow",
"Action" : [
"iam:ListRoles",
"config:DescribeConfigurationRecorders",
"compute-optimizer:GetEnrollmentStatus",
"support:DescribeTrustedAdvisorChecks"
],
"Resource" : "*"
},
{
"Sid" : "ExplorerServiceSettingsPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:UpdateServiceSetting",
"ssm:GetServiceSetting"
],
"Resource" : [
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager",
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase"
]
}
]
}詳細はこちら
