翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
ワークフローモニターIAMポリシー
ワークフローモニターが複数の とやり取りする AWS シグナルマップの作成、 CloudWatch と EventBridge リソースの構築、および AWS CloudFormation テンプレート。ワークフローモニターはさまざまなサービスとやり取りするため、特定の AWS Identity and Access Management （IAM) ポリシーは、これらのサービスに割り当てる必要があります。次の例は、管理者ロールとオペレーターIAMロールの両方に必要なIAMポリシーを示しています。
管理者IAMポリシー
次のポリシー例は、管理者レベルのワークフローモニタリングIAMポリシー用です。このロールにより、ワークフローモニターリソースと、ワークフローモニターとやり取りするサポートされているサービスリソースの作成と管理が可能になります。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Describe*", "cloudwatch:Get*", "cloudwatch:PutAnomalyDetector", "cloudwatch:PutMetricData", "cloudwatch:PutMetricAlarm", "cloudwatch:PutCompositeAlarm", "cloudwatch:PutDashboard", "cloudwatch:DeleteAlarms", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DeleteDashboards", "cloudwatch:TagResource", "cloudwatch:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudfront:List*", "cloudfront:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:List*", "events:Describe*", "events:CreateEventBus", "events:PutRule", "events:PutTargets", "events:EnableRule", "events:DisableRule", "events:DeleteRule", "events:RemoveTargets", "events:TagResource", "events:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:TagLogGroup", "logs:TagResource", "logs:UntagLogGroup", "logs:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediaconnect:List*", "mediaconnect:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "medialive:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage:List*", "mediapackage:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackagev2:List*", "mediapackagev2:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage-vod:List*", "mediapackage-vod:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediatailor:List*", "mediatailor:Describe*", "mediatailor:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "resource-groups:ListGroups", "resource-groups:GetGroup", "resource-groups:GetTags", "resource-groups:GetGroupQuery", "resource-groups:GetGroupConfiguration", "resource-groups:CreateGroup", "resource-groups:UngroupResources", "resource-groups:GroupResources", "resource-groups:DeleteGroup", "resource-groups:UpdateGroupQuery", "resource-groups:UpdateGroup", "resource-groups:Tag", "resource-groups:Untag" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:*" ], "Resource": "arn:aws:s3:::workflow-monitor-templates*" }, { "Effect": "Allow", "Action": [ "sns:TagResource", "sns:UntagResource" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "tag:Get*", "tag:Describe*", "tag:TagResources", "tag:UntagResources" ], "Resource": "*" } ] }
オペレーターIAMポリシー
次のポリシー例は、オペレータレベルのワークフローモニタリングIAMポリシー用です。このロールは、ワークフローモニターリソースと、ワークフローモニターとやり取りするサポートされているサービスリソースへの制限付き読み取り専用アクセスを許可します。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:List*", "cloudwatch:Describe*", "cloudwatch:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudformation:List*", "cloudformation:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "cloudfront:List*", "cloudfront:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ec2:DescribeNetworkInterfaces" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "events:List*", "events:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediaconnect:List*", "mediaconnect:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "medialive:List*", "medialive:Get*", "medialive:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage:List*", "mediapackage:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackagev2:List*", "mediapackagev2:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediapackage-vod:List*", "mediapackage-vod:Describe*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "mediatailor:List*", "mediatailor:Describe*", "mediatailor:Get*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:Get*", "s3:List*" ], "Resource": "arn:aws:s3:::workflow-monitor-templates*" }, { "Effect": "Allow", "Action": [ "tag:Get*", "tag:Describe*" ], "Resource": "*" } ] }
