的服务相关角色权限 GuardDuty

GuardDuty 使用名AWSServiceRoleForAmazonGuardDuty为的服务相关角色 (SLR)。SLR GuardDuty 允许执行以下任务。它还允许 GuardDuty 将检索到的属于该EC2实例的元数据包含在 GuardDuty 可能产生的有关潜在威胁的调查结果中。AWSServiceRoleForAmazonGuardDuty 服务相关角色信任 guardduty.amazonaws.com 服务来代入角色。

权限策略有助于 GuardDuty 执行以下任务：

使用 Amazon EC2 操作管理和检索有关您的EC2实例、映像和网络组件（例如VPCs子网和传输网关）的信息。
当您启用带有亚马逊自动代理的 GuardDuty 运行时监控时，使用 AWS Systems Manager 操作来管理亚马逊EC2实例上的SSM关联EC2。禁用 GuardDuty 自动代理配置后，仅 GuardDuty 考虑那些EC2带有包含标签 (GuardDutyManaged:true) 的实例。
使用 AWS Organizations 操作来描述关联的账户和组织 ID。
使用 Amazon S3 操作检索有关 S3 存储桶和对象的信息。
使用 AWS Lambda 操作来检索有关您的 Lambda 函数和标签的信息。
使用 Amazon EKS 操作管理和检索有关集群的信息，并管理EKS集群上的 Amazon EKS EKS 插件。这些EKS操作还会检索与之关联的标签的相关信息 GuardDuty。
IAM用于在启用恶意软件防护恶意软件防护的服务相关角色权限 EC2之后创建。EC2
使用亚马逊ECS操作管理和检索有关亚马逊ECS集群的信息，并使用管理亚马逊ECS账户设置guarddutyActivate。与 Amazon 相关的操作ECS还会检索与之关联的标签的相关信息 GuardDuty。

该角色使用以下 AWS 托管策略（名为 AmazonGuardDutyServiceRolePolicy）配置。


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "GuardDutyGetDescribeListPolicy",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:DescribeImages",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcPeeringConnections",
                "ec2:DescribeTransitGatewayAttachments",
                "organizations:ListAccounts",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetEncryptionConfiguration",
                "s3:GetBucketTagging",
                "s3:GetAccountPublicAccessBlock",
                "s3:ListAllMyBuckets",
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "lambda:GetFunctionConfiguration",
                "lambda:ListTags",
                "eks:ListClusters",
                "eks:DescribeCluster",
                "ec2:DescribeVpcEndpointServices",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcs",
                "ecs:ListClusters",
                "ecs:DescribeClusters"
            ],
            "Resource": "*"
        },
        {
            "Sid": "GuardDutyCreateSLRPolicy",
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "malware-protection.guardduty.amazonaws.com"
                }
            }
        },
        {
            "Sid": "GuardDutyCreateVpcEndpointPolicy",
            "Effect": "Allow",
            "Action": "ec2:CreateVpcEndpoint",
            "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": "GuardDutyManaged"
                },
                "StringLike": {
                    "ec2:VpceServiceName": [
                        "com.amazonaws.*.guardduty-data",
                        "com.amazonaws.*.guardduty-data-fips"
                    ]
                }
            }
        },
        {
            "Sid": "GuardDutyModifyDeleteVpcEndpointPolicy",
            "Effect": "Allow",
            "Action": [
                "ec2:ModifyVpcEndpoint",
                "ec2:DeleteVpcEndpoints"
            ],
            "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*",
            "Condition": {
                "Null": {
                    "aws:ResourceTag/GuardDutyManaged": false
                }
            }
        },
        {
            "Sid": "GuardDutyCreateModifyVpcEndpointNetworkPolicy",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVpcEndpoint",
                "ec2:ModifyVpcEndpoint"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:vpc/*",
                "arn:aws:ec2:*:*:security-group/*",
                "arn:aws:ec2:*:*:subnet/*"
            ]
        },
        {
             "Sid": "GuardDutyCreateTagsDuringVpcEndpointCreationPolicy",
             "Effect": "Allow",
            "Action": "ec2:CreateTags",
            "Resource": "arn:aws:ec2:*:*:vpc-endpoint/*",
            "Condition": {
                "StringEquals": {
                    "ec2:CreateAction": "CreateVpcEndpoint"
                },
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": "GuardDutyManaged"
                }
            }
        },
        {
            "Sid": "GuardDutySecurityGroupManagementPolicy",
            "Effect": "Allow",
            "Action": [
                "ec2:AuthorizeSecurityGroupIngress",
                "ec2:AuthorizeSecurityGroupEgress",
                "ec2:RevokeSecurityGroupIngress",
                "ec2:RevokeSecurityGroupEgress",
                "ec2:DeleteSecurityGroup"
            ],
            "Resource": "arn:aws:ec2:*:*:security-group/*",
            "Condition": {
                "Null": {
                    "aws:ResourceTag/GuardDutyManaged": false
                }
            }
        },
        {
            "Sid": "GuardDutyCreateSecurityGroupPolicy",
            "Effect": "Allow",
            "Action": "ec2:CreateSecurityGroup",
            "Resource": "arn:aws:ec2:*:*:security-group/*",
            "Condition": {
                "StringLike": {
                    "aws:RequestTag/GuardDutyManaged": "*"
                }
            }
        },
        {
            "Sid": "GuardDutyCreateSecurityGroupForVpcPolicy",
            "Effect": "Allow",
            "Action": "ec2:CreateSecurityGroup",
            "Resource": "arn:aws:ec2:*:*:vpc/*"
        },
        {
            "Sid": "GuardDutyCreateTagsDuringSecurityGroupCreationPolicy",
            "Effect": "Allow",
            "Action": "ec2:CreateTags",
            "Resource": "arn:aws:ec2:*:*:security-group/*",
            "Condition": {
                "StringEquals": {
                    "ec2:CreateAction": "CreateSecurityGroup"
                },
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": "GuardDutyManaged"
                }
            }
        },
        {
            "Sid": "GuardDutyCreateEksAddonPolicy",
            "Effect": "Allow",
            "Action": "eks:CreateAddon",
            "Resource": "arn:aws:eks:*:*:cluster/*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": "GuardDutyManaged"
                }
            }
        },
        {
            "Sid": "GuardDutyEksAddonManagementPolicy",
            "Effect": "Allow",
            "Action": [
                "eks:DeleteAddon",
                "eks:UpdateAddon",
                "eks:DescribeAddon"
            ],
            "Resource": "arn:aws:eks:*:*:addon/*/aws-guardduty-agent/*"
        },
        {
            "Sid": "GuardDutyEksClusterTagResourcePolicy",
            "Effect": "Allow",
            "Action": "eks:TagResource",
            "Resource": "arn:aws:eks:*:*:cluster/*",
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:TagKeys": "GuardDutyManaged"
                }
            }
        },
        {
            "Sid": "GuardDutyEcsPutAccountSettingsDefaultPolicy",
            "Effect": "Allow",
            "Action": "ecs:PutAccountSettingDefault",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ecs:account-setting": [
                        "guardDutyActivate"
                    ]
                 }
            }
        },
        {
            "Sid": "SsmCreateDescribeUpdateDeleteStartAssociationPermission",
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeAssociation",
                "ssm:DeleteAssociation",
                "ssm:UpdateAssociation",
                "ssm:CreateAssociation",
                "ssm:StartAssociationsOnce"
            ],
            "Resource": "arn:aws:ssm:*:*:association/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/GuardDutyManaged": "true"
                }
            }
        },
        {
            "Sid": "SsmAddTagsToResourcePermission",
            "Effect": "Allow",
            "Action": [
                "ssm:AddTagsToResource"
            ],
            "Resource": "arn:aws:arn:aws:ssm:*:*:association/*",
            "Condition":{
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": [
                        "GuardDutyManaged"
                    ]
                },
                "StringEquals": {
                    "aws:ResourceTag/GuardDutyManaged": "true"
                }
            }
        },
        {
            "Sid": "SsmCreateUpdateAssociationInstanceDocumentPermission",
            "Effect": "Allow",
            "Action": [
                "ssm:CreateAssociation",
                "ssm:UpdateAssociation"
            ],
            "Resource": "arn:aws:ssm:*:*:document/AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin"
        },
        {
            "Sid": "SsmSendCommandPermission",
            "Effect": "Allow",
            "Action": "ssm:SendCommand",
            "Resource": [
                "arn:aws:ec2:*:*:instance/*",
                "arn:aws:ssm:*:*:document/AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin"
            ]
        },
        {
            "Sid": "SsmGetCommandStatus",
            "Effect": "Allow",
            "Action": "ssm:GetCommandInvocation",
            "Resource": "*"
        }
   ]
}

下面是附加到 AWSServiceRoleForAmazonGuardDuty 服务相关角色的信任策略：


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "guardduty.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

有关 AmazonGuardDutyServiceRolePolicy 策略更新的详细信息，请参阅 GuardDuty AWS 托管策略的更新。要获得有关此政策变更的自动提醒，请订阅文档历史记录页面上的RSS提要。

为创建服务相关角色 GuardDuty

当您首次启用AWSServiceRoleForAmazonGuardDuty服务相关角色或在以前未启用 GuardDuty 服务的受支持 GuardDuty 地区启用服务相关角色时，系统会自动创建该角色。您也可以使用IAM控制台 AWS CLI、或手动创建服务相关角色。IAM API

重要

为 GuardDuty 委派管理员账户创建的服务相关角色不适用于成员 GuardDuty 账户。

您必须配置权限以允许IAM委托人（例如用户、组或角色）创建、编辑或删除服务相关角色。要成功创建AWSServiceRoleForAmazonGuardDuty服务相关角色，您使用的IAM委托人必须 GuardDuty 具有所需的权限。要授予所需的权限，请将以下策略附加到此用户、组或角色：

注意

更换样本 account ID 在以下示例中，使用您的实际 AWS 账户 ID。


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "guardduty:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": "arn:aws:iam::123456789012:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty",
            "Condition": {
                "StringLike": {
                    "iam:AWSServiceName": "guardduty.amazonaws.com"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PutRolePolicy",
                "iam:DeleteRolePolicy"
            ],
            "Resource": "arn:aws:iam::123456789012:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty"
        }
    ]
}

有关手动创建角色的更多信息，请参阅《IAM用户指南》中的创建服务相关角色。

编辑的服务相关角色 GuardDuty

GuardDuty 不允许您编辑AWSServiceRoleForAmazonGuardDuty服务相关角色。在创建服务相关角色后，您将无法更改角色的名称，因为可能有多种实体引用该角色。但是，您可以使用编辑角色的描述IAM。有关更多信息，请参阅《IAM用户指南》中的编辑服务相关角色。

删除的服务相关角色 GuardDuty

如果不再需要使用某个需要服务相关角色的功能或服务，我们建议您删除该角色。这样您就没有未被主动监控或维护的未使用实体。

重要

如果您为启用了恶意软件防护EC2，则删除AWSServiceRoleForAmazonGuardDuty不会自动删除AWSServiceRoleForAmazonGuardDutyMalwareProtection。如果要删除AWSServiceRoleForAmazonGuardDutyMalwareProtection，请参阅删除恶意软件防护的EC2服务相关角色。

要删除，您必须先 GuardDuty 在所有启用该功能的区域中将其禁用AWSServiceRoleForAmazonGuardDuty。如果您在尝试删除 GuardDuty 服务相关角色时未禁用该服务，则删除将失败。有关更多信息，请参阅暂停或禁用 GuardDuty。

禁用后 GuardDuty，AWSServiceRoleForAmazonGuardDuty不会自动删除。如果您 GuardDuty 再次启用，它将开始使用现有的AWSServiceRoleForAmazonGuardDuty。

使用手动删除服务相关角色 IAM

使用IAM控制台 AWS CLI、或删除AWSServiceRoleForAmazonGuardDuty服务相关角色。IAM API有关更多信息，请参阅《IAM用户指南》中的删除服务相关角色。

支持的 AWS 区域

Amazon GuardDuty 支持在所有可用 AWS 区域的地方 GuardDuty 使用AWSServiceRoleForAmazonGuardDuty服务相关角色。有关当前可用区域的列表，请参阅中的 Amazon GuardDuty 终端节点和配额Amazon Web Services 一般参考。 GuardDuty

Javascript 在您的浏览器中被禁用或不可用。

要使用 Amazon Web Services 文档，必须启用 Javascript。请参阅浏览器的帮助页面以了解相关说明。

文档惯例

使用服务相关角色

恶意软件防护的服务相关角色权限 EC2