本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
AmazonRDSCustomInstanceProfileRolePolicy
說明:允許 Amazon RDS 自訂透過 EC2 執行個體設定檔執行各種自動化動作和資料庫管理任務。
AmazonRDSCustomInstanceProfileRolePolicy
是AWS 受管理的策略。
使用此政策
您可以附加AmazonRDSCustomInstanceProfileRolePolicy
至您的使用者、群組和角色。
政策詳情
-
類型: AWS 受管理的策略
-
創建時間:世界標準時間:2024 年 2 月 27 日, 17:42
-
編輯時間:世界標準時間 2024 年 2 月 27 日 17:42
-
ARN:
arn:aws:iam::aws:policy/AmazonRDSCustomInstanceProfileRolePolicy
政策版本
策略版本:v1(預設值)
原則的預設版本是定義原則權限的版本。當具有策略的使用者或角色發出要求以存取 AWS 資源時,請 AWS 檢查原則的預設版本,以決定是否允許該要求。
政策文件
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "ssmAgentPermission1", "Effect" : "Allow", "Action" : [ "ssm:UpdateInstanceInformation" ], "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "ssmAgentPermission2", "Effect" : "Allow", "Action" : [ "ssm:GetManifest", "ssm:PutConfigurePackageResult" ], "Resource" : "*" }, { "Sid" : "ssmAgentPermission3", "Effect" : "Allow", "Action" : [ "ssm:GetDocument", "ssm:DescribeDocument" ], "Resource" : "arn:aws:ssm:*:*:document/*" }, { "Sid" : "ssmAgentPermission4", "Effect" : "Allow", "Action" : [ "ssmmessages:CreateControlChannel", "ssmmessages:OpenControlChannel" ], "Resource" : "*" }, { "Sid" : "ssmAgentPermission5", "Effect" : "Allow", "Action" : [ "ec2messages:AcknowledgeMessage", "ec2messages:DeleteMessage", "ec2messages:FailMessage", "ec2messages:GetEndpoint", "ec2messages:GetMessages", "ec2messages:SendReply" ], "Resource" : "*" }, { "Sid" : "createEc2SnapshotPermission1", "Effect" : "Allow", "Action" : [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource" : [ "arn:aws:ec2:*:*:volume/*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createEc2SnapshotPermission2", "Effect" : "Allow", "Action" : [ "ec2:CreateSnapshot", "ec2:CreateSnapshots" ], "Resource" : [ "arn:aws:ec2:*::snapshot/*" ], "Condition" : { "StringLike" : { "aws:RequestTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createEc2SnapshotPermission3", "Effect" : "Allow", "Action" : "ec2:CreateSnapshots", "Resource" : [ "arn:aws:ec2:*:*:instance/*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createTagForEc2SnapshotPermission", "Effect" : "Allow", "Action" : "ec2:CreateTags", "Resource" : "*", "Condition" : { "StringLike" : { "aws:RequestTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ], "ec2:CreateAction" : [ "CreateSnapshot", "CreateSnapshots" ] } } }, { "Sid" : "rdsCustomS3ObjectPermission", "Effect" : "Allow", "Action" : [ "s3:putObject", "s3:getObject", "s3:getObjectVersion", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Resource" : [ "arn:aws:s3:::do-not-delete-rds-custom-*/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "rdsCustomS3BucketPermission", "Effect" : "Allow", "Action" : [ "s3:ListBucketVersions", "s3:ListBucketMultipartUploads" ], "Resource" : [ "arn:aws:s3:::do-not-delete-rds-custom-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "readSecretsFromCpPermission", "Effect" : "Allow", "Action" : [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource" : [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : [ "custom-oracle", "custom-sqlserver", "custom-oracle-rac" ] } } }, { "Sid" : "createSecretsOnDpPermission", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret", "secretsmanager:TagResource" ], "Resource" : [ "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" ], "Condition" : { "StringLike" : { "aws:RequestTag/AWSRDSCustom" : "custom-oracle-rac" } } }, { "Sid" : "publishCwMetricsPermission", "Effect" : "Allow", "Action" : "cloudwatch:PutMetricData", "Resource" : "*", "Condition" : { "StringEquals" : { "cloudwatch:namespace" : [ "rdscustom/rds-custom-sqlserver-agent", "RDSCustomForOracle/Agent" ] } } }, { "Sid" : "putEventsToEventBusPermission", "Effect" : "Allow", "Action" : "events:PutEvents", "Resource" : "arn:aws:events:*:*:event-bus/default" }, { "Sid" : "cwlUploadPermission", "Effect" : "Allow", "Action" : [ "logs:PutRetentionPolicy", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource" : "arn:aws:logs:*:*:log-group:rds-custom-instance-*" }, { "Sid" : "sendMessageToSqsQueuePermission", "Effect" : "Allow", "Action" : [ "sqs:SendMessage", "sqs:ReceiveMessage", "sqs:DeleteMessage", "sqs:GetQueueUrl" ], "Resource" : [ "arn:aws:sqs:*:*:do-not-delete-rds-custom-*" ], "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : "custom-sqlserver" } } }, { "Sid" : "managePrivateIpOnEniPermission", "Effect" : "Allow", "Action" : [ "ec2:AssignPrivateIpAddresses", "ec2:UnassignPrivateIpAddresses" ], "Resource" : "arn:aws:ec2:*:*:network-interface/*", "Condition" : { "StringLike" : { "aws:ResourceTag/AWSRDSCustom" : "custom-oracle-rac" } } }, { "Sid" : "kmsPermissionWithSecret", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "*", "Condition" : { "ArnLike" : { "kms:EncryptionContext:SecretARN" : "arn:aws:secretsmanager:*:*:secret:do-not-delete-rds-custom-*" }, "StringLike" : { "kms:ViaService" : "secretsmanager.*.amazonaws.com" } } }, { "Sid" : "kmsPermissionWithS3", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "*", "Condition" : { "ArnLike" : { "kms:EncryptionContext:aws:s3:arn" : "arn:aws:s3:::do-not-delete-rds-custom-*" }, "StringLike" : { "kms:ViaService" : "s3.*.amazonaws.com" } } } ] }