翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
AmazonRDSCustomInstanceProfileRolePolicy
説明： Amazon RDS Custom が EC2 インスタンスプロファイルを介してさまざまなオートメーションアクションとデータベース管理タスクを実行できるようにします。
AmazonRDSCustomInstanceProfileRolePolicy は AWS マネージドポリシー です。
このポリシーを使用すると
ユーザー、グループおよびロールに AmazonRDSCustomInstanceProfileRolePolicy をアタッチできます。
ポリシーの詳細
-
タイプ: AWS 管理ポリシー
-
作成日時: 2024 年 2 月 27 日 17:42 UTC
-
編集日時： 2024 年 2 月 27 日 17:42 UTC
-
ARN:
arn:aws:iam::aws:policy/AmazonRDSCustomInstanceProfileRolePolicy
ポリシーのバージョン
ポリシーのバージョン: v1 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを判断します。
JSON ポリシードキュメント
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "ssmAgentPermission1", "Effect" : "Allow", "Action" : [ "ssm:UpdateInstanceInformation" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "ssmAgentPermission2", "Effect" : "Allow", "Action" : [ "ssm:GetManifest", "ssm:PutConfigurePackageResult" ], "Resource" : "*" }, { "Sid" : "ssmAgentPermission3", "Effect" : "Allow", "Action" : [ "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource" : "arn:aws:ssm:*:*:document/*" }, { "Sid" : "ssmAgentPermission4", "Effect" : "Allow", "Action" : [ "ssmmessages:CreateControlChannel", "ssmmessages:OpenControlChannel" ], "Resource" : "*" }, { "Sid" : "ssmAgentPermission5", "Effect" : "Allow", "Action" : [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource" : "*" }, { "Sid" : "createEc2SnapshotPermission1", "Effect" : "Allow", "Action" : [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource" : [ "arn:aws:ec2:*:*:volume/*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createEc2SnapshotPermission2", "Effect" : "Allow", "Action" : [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource" : [ "arn:aws:ec2:*::snapshot/*" ], "Condition" : { "StringLike" : { "aws:RequestTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createEc2SnapshotPermission3", "Effect" : "Allow", "Action" : "ec2:CreateSnapshots", "Resource" : [ "arn:aws:ec2:*:*:instance/*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createTagForEc2SnapshotPermission", "Effect" : "Allow", "Action" : "ec2:CreateTags", "Resource" : "*", "Condition" : { "StringLike" : { "aws:RequestTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction" : [ "CreateSnapshot", "CreateSnapshots" ] } } }, { "Sid" : "rdsCustomS3ObjectPermission", "Effect" : "Allow", "Action" : [ "s3:putObject", "s3:getObject", "s3:getObjectVersion", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource" : [ "arn:aws:s3:::do-not-delete-rds-custom-*/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "rdsCustomS3BucketPermission", "Effect" : "Allow", "Action" : [ "s3:ListBucketVersions", "s3:ListBucketMultipartUploads" ], "Resource" : [ "arn:aws:s3:::do-not-delete-rds-custom-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "readSecretsFromCpPermission", "Effect" : "Allow", "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource" : [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createSecretsOnDpPermission", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource" : [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" ], "Condition" : { "StringLike" : { "aws:RequestTag/AWSRDSCustom" : "custom-oracle-rac" } } }, { "Sid" : "publishCwMetricsPermission", "Effect" : "Allow", "Action" : "cloudwatch:PutMetricData", "Resource" : "*", "Condition" : { "StringEquals" : { "cloudwatch:namespace" : [ "rdscustom/rds-custom-sqlserver-agent", "RDSCustomForOracle/Agent" ] } } }, { "Sid" : "putEventsToEventBusPermission", "Effect" : "Allow", "Action" : "events:PutEvents", "Resource" : "arn:aws:events:*:*:event-bus/default" }, { "Sid" : "cwlUploadPermission", "Effect" : "Allow", "Action" : [ "logs:PutRetentionPolicy", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource" : "arn:aws:logs:*:*:log-group:rds-custom-instance-*" }, { "Sid" : "sendMessageToSqsQueuePermission", "Effect" : "Allow", "Action" : [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueUrl" ], "Resource" : [ "arn:aws:sqs:*:*:do-not-delete-rds-custom-*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : "custom-sqlserver" } } }, { "Sid" : "managePrivateIpOnEniPermission", "Effect" : "Allow", "Action" : [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource" : "arn:aws:ec2:*:*:network-interface/*", "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : "custom-oracle-rac" } } }, { "Sid" : "kmsPermissionWithSecret", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "*", "Condition" : { "ArnLike" : { "kms:EncryptionContext:SecretARN" : "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" }, "StringLike" : { "kms:ViaService" : "secretsmanager.*.amazonaws.com" } } }, { "Sid" : "kmsPermissionWithS3", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "*", "Condition" : { "ArnLike" : { "kms:EncryptionContext:aws:s3:arn" : "arn:aws:s3:::do-not-delete-rds-custom-*" }, "StringLike" : { "kms:ViaService" : "s3.*.amazonaws.com" } } } ] }
詳細はこちら
