Amazon Inspector 無代理程式掃描的服務連結角色許可

Amazon Inspector 無代理程式掃描使用名為 的服務連結角色AWSServiceRoleForAmazonInspector2Agentless。此 SLR 允許 Amazon Inspector 在您的帳戶中建立 Amazon EBS 磁碟區快照，然後從該快照存取資料。此服務連結角色信任agentless.inspector2.amazonaws.com服務擔任該角色。

重要

此服務連結角色中的陳述式可防止 Amazon Inspector 對您使用 InspectorEc2Exclusion標籤從掃描中排除的任何 EC2 執行個體執行無代理程式掃描。此外，當用於加密磁碟區的 KMS 金鑰具有 InspectorEc2Exclusion標籤時，陳述式會防止 Amazon Inspector 從磁碟區存取加密的資料。如需詳細資訊，請參閱從 Amazon Inspector 掃描排除執行個體。

名為 的角色的許可政策AmazonInspector2AgentlessServiceRolePolicy允許 Amazon Inspector 執行任務，例如：

• 使用 Amazon Elastic Compute Cloud (Amazon EC2) 動作來擷取 EC2 執行個體、磁碟區和快照的相關資訊。

  • 使用 Amazon EC2 標記動作來標記快照，以便使用InspectorScan標籤金鑰進行掃描。

  • 使用 Amazon EC2 快照動作建立快照、使用InspectorScan標籤金鑰標記快照，然後刪除已使用InspectorScan標籤金鑰標記的 Amazon EBS 磁碟區的快照。

• 使用 Amazon EBS 動作從標記標籤InspectorScan索引鍵的快照擷取資訊。

• 使用選取 AWS KMS 解密動作來解密使用 AWS KMS 客戶受管金鑰加密的快照。當用於加密快照的 KMS 金鑰加上標籤時，Amazon Inspector 不會解密快照InspectorEc2Exclusion。

角色是使用下列許可政策來設定。

JSON

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "InstanceIdentification",
			"Effect": "Allow",
			"Action": [
				"ec2:DescribeInstances",
				"ec2:DescribeVolumes",
				"ec2:DescribeSnapshots"
			],
			"Resource": "*"
		},
		{
			"Sid": "GetSnapshotData",
			"Effect": "Allow",
			"Action": [
				"ebs:ListSnapshotBlocks",
				"ebs:GetSnapshotBlock"
			],
			"Resource": "arn:aws:ec2:*:*:snapshot/*",
			"Condition": {
				"StringLike": {
					"aws:ResourceTag/InspectorScan": "*"
				}
			}
		},
		{
			"Sid": "CreateSnapshotsAnyInstanceOrVolume",
			"Effect": "Allow",
			"Action": "ec2:CreateSnapshots",
			"Resource": [
				"arn:aws:ec2:*:*:instance/*",
				"arn:aws:ec2:*:*:volume/*"
			]
		},
		{
			"Sid": "DenyCreateSnapshotsOnExcludedInstances",
			"Effect": "Deny",
			"Action": "ec2:CreateSnapshots",
			"Resource": "arn:aws:ec2:*:*:instance/*",
			"Condition": {
				"StringEquals": {
					"ec2:ResourceTag/InspectorEc2Exclusion": "true"
				}
			}
		},
		{
			"Sid": "CreateSnapshotsOnAnySnapshotOnlyWithTag",
			"Effect": "Allow",
			"Action": "ec2:CreateSnapshots",
			"Resource": "arn:aws:ec2:*:*:snapshot/*",
			"Condition": {
				"Null": {
					"aws:TagKeys": "false"
				},
				"ForAllValues:StringEquals": {
					"aws:TagKeys": "InspectorScan"
				}
			}
		},
		{
			"Sid": "CreateOnlyInspectorScanTagOnlyUsingCreateSnapshots",
			"Effect": "Allow",
			"Action": "ec2:CreateTags",
			"Resource": "arn:aws:ec2:*:*:snapshot/*",
			"Condition": {
				"StringLike": {
					"ec2:CreateAction": "CreateSnapshots"
				},
				"Null": {
					"aws:TagKeys": "false"
				},
				"ForAllValues:StringEquals": {
					"aws:TagKeys": "InspectorScan"
				}
			}
		},
		{
			"Sid": "DeleteOnlySnapshotsTaggedForScanning",
			"Effect": "Allow",
			"Action": "ec2:DeleteSnapshot",
			"Resource": "arn:aws:ec2:*:*:snapshot/*",
			"Condition": {
				"StringLike": {
					"ec2:ResourceTag/InspectorScan": "*"
				}
			}
		},
		{
			"Sid": "DenyKmsDecryptForExcludedKeys",
			"Effect": "Deny",
			"Action": "kms:Decrypt",
			"Resource": "arn:aws:kms:*:*:key/*",
			"Condition": {
				"StringEquals": {
					"aws:ResourceTag/InspectorEc2Exclusion": "true"
				}
			}
		},
		{
			"Sid": "DecryptSnapshotBlocksVolContext",
			"Effect": "Allow",
			"Action": "kms:Decrypt",
			"Resource": "arn:aws:kms:*:*:key/*",
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				},
				"StringLike": {
					"kms:ViaService": "ec2.*.amazonaws.com",
					"kms:EncryptionContext:aws:ebs:id": "vol-*"
				}
			}
		},
		{
			"Sid": "DecryptSnapshotBlocksSnapContext",
			"Effect": "Allow",
			"Action": "kms:Decrypt",
			"Resource": "arn:aws:kms:*:*:key/*",
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				},
				"StringLike": {
					"kms:ViaService": "ec2.*.amazonaws.com",
					"kms:EncryptionContext:aws:ebs:id": "snap-*"
				}
			}
		},
		{
			"Sid": "DescribeKeysForEbsOperations",
			"Effect": "Allow",
			"Action": "kms:DescribeKey",
			"Resource": "arn:aws:kms:*:*:key/*",
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				},
				"StringLike": {
					"kms:ViaService": "ec2.*.amazonaws.com"
				}
			}
		},
		{
			"Sid": "ListKeyResourceTags",
			"Effect": "Allow",
			"Action": "kms:ListResourceTags",
			"Resource": "arn:aws:kms:*:*:key/*"
		}
	]
}