Permisos de roles vinculados a servicios para Amazon Inspector - Amazon Inspector

Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.

Permisos de roles vinculados a servicios para Amazon Inspector

Amazon Inspector utiliza la política gestionada denominada AWSServiceRoleForAmazonInspector2. Este rol vinculado a servicios confía en el servicio inspector2.amazonaws.com para asumir el rol.

La política de permisos del rol, que se denomina AmazonInspector2ServiceRolePolicy, permite a Amazon Inspector realizar tareas como las siguientes:

  • Utilice las acciones de Amazon Elastic Compute Cloud (Amazon EC2) para recuperar información sobre sus instancias y rutas de red.

  • Usa AWS Systems Manager acciones para recuperar el inventario de tus EC2 instancias de Amazon y para recuperar información sobre paquetes de terceros a partir de rutas personalizadas.

  • Usa la AWS Systems Manager SendCommand acción para invocar escaneos CIS para las instancias de destino.

  • Utilizar las acciones de Amazon Elastic Container Registry para obtener información acerca de las imágenes de contenedores.

  • Utilice AWS Lambda acciones para recuperar información sobre las funciones de Lambda.

  • Utilice AWS Organizations acciones para describir las cuentas asociadas.

  • Utilice CloudWatch acciones para recuperar información sobre la última vez que se invocaron las funciones de Lambda.

  • Utilizar determinadas acciones de IAM para obtener información acerca de las políticas de IAM que podrían provocar vulnerabilidades de seguridad en el código de Lambda.

  • Utilice las acciones de Amazon Q para escanear el código de las funciones de Lambda. Amazon Inspector utiliza las siguientes acciones de Amazon Q:

    • codeguru-security: CreateScan — Otorga permiso para crear Amazon Q; scan.

    • codeguru-security: GetScan — Concede permiso para recuperar los metadatos escaneados de Amazon Q.

    • codeguru-security: ListFindings — Concede permiso para recuperar los hallazgos generados por Amazon Q.

    • codeguru-security: DeleteScansByCategory — Concede permiso a Amazon Q para eliminar los escaneos iniciados por Amazon Inspector.

    • codeguru-security: BatchGetFindings — Concede permiso para recuperar un lote de hallazgos específicos generados por Amazon Q.

  • Utilice acciones seleccionadas de Elastic Load Balancing para realizar escaneos de red de EC2 instancias que forman parte de los grupos objetivo de Elastic Load Balancing.

  • Utilice las acciones de Amazon ECS y Amazon EKS para permitir el acceso de solo lectura para ver los clústeres y las tareas y describir las tareas.

nota

Amazon Inspector ya no se utiliza CodeGuru para realizar escaneos Lambda. AWS dejará de ofrecer soporte el 20 de CodeGuru noviembre de 2025. Para obtener más información, consulte Fin del soporte de CodeGuru seguridad. Amazon Inspector ahora usa Amazon Q para realizar escaneos Lambda y no requiere los permisos descritos en esta sección.

El rol se configura con la siguiente política de permisos.

JSON

     {
	"Version":"2012-10-17",		 	 	 
	"Statement": [
		{
			"Sid": "TirosPolicy",
			"Effect": "Allow",
			"Action": [
				"directconnect:DescribeConnections",
				"directconnect:DescribeDirectConnectGatewayAssociations",
				"directconnect:DescribeDirectConnectGatewayAttachments",
				"directconnect:DescribeDirectConnectGateways",
				"directconnect:DescribeVirtualGateways",
				"directconnect:DescribeVirtualInterfaces",
				"ec2:DescribeAddresses",
				"ec2:DescribeAvailabilityZones",
				"ec2:DescribeCustomerGateways",
				"ec2:DescribeEgressOnlyInternetGateways",
				"ec2:DescribeInstances",
				"ec2:DescribeInternetGateways",
				"ec2:DescribeManagedPrefixLists",
				"ec2:DescribeNatGateways",
				"ec2:DescribeNetworkAcls",
				"ec2:DescribeNetworkInterfaces",
				"ec2:DescribePrefixLists",
				"ec2:DescribeRegions",
				"ec2:DescribeRouteTables",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeSubnets",
				"ec2:DescribeTransitGatewayAttachments",
				"ec2:DescribeTransitGatewayConnects",
				"ec2:DescribeTransitGatewayPeeringAttachments",
				"ec2:DescribeTransitGatewayRouteTables",
				"ec2:DescribeTransitGatewayVpcAttachments",
				"ec2:DescribeTransitGateways",
				"ec2:DescribeVpcEndpointServiceConfigurations",
				"ec2:DescribeVpcEndpoints",
				"ec2:DescribeVpcPeeringConnections",
				"ec2:DescribeVpcs",
				"ec2:DescribeVpnConnections",
				"ec2:DescribeVpnGateways",
				"ec2:GetManagedPrefixListEntries",
				"ec2:GetTransitGatewayRouteTablePropagations",
				"ec2:SearchTransitGatewayRoutes",
				"elasticloadbalancing:DescribeListeners",
				"elasticloadbalancing:DescribeLoadBalancerAttributes",
				"elasticloadbalancing:DescribeLoadBalancers",
				"elasticloadbalancing:DescribeRules",
				"elasticloadbalancing:DescribeTags",
				"elasticloadbalancing:DescribeTargetGroups",
				"elasticloadbalancing:DescribeTargetGroupAttributes",
				"elasticloadbalancing:DescribeTargetHealth",
				"network-firewall:DescribeFirewall",
				"network-firewall:DescribeFirewallPolicy",
				"network-firewall:DescribeResourcePolicy",
				"network-firewall:DescribeRuleGroup",
				"network-firewall:ListFirewallPolicies",
				"network-firewall:ListFirewalls",
				"network-firewall:ListRuleGroups",
				"tiros:CreateQuery",
				"tiros:GetQueryAnswer"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Sid": "PackageVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"ecr:BatchGetImage",
				"ecr:BatchGetRepositoryScanningConfiguration",
				"ecr:DescribeImages",
				"ecr:DescribeRegistry",
				"ecr:DescribeRepositories",
				"ecr:GetAuthorizationToken",
				"ecr:GetDownloadUrlForLayer",
				"ecr:GetRegistryScanningConfiguration",
				"ecr:ListImages",
				"ecr:PutRegistryScanningConfiguration",
				"organizations:DescribeAccount",
				"organizations:DescribeOrganization",
				"organizations:ListAccounts",
				"ssm:DescribeAssociation",
				"ssm:DescribeAssociationExecutions",
				"ssm:DescribeInstanceInformation",
				"ssm:ListAssociations",
				"ssm:ListResourceDataSync"
			],
			"Resource": "*"
		},
		{
			"Sid": "LambdaPackageVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"lambda:ListFunctions",
				"lambda:GetFunction",
				"lambda:GetLayerVersion",
				"lambda:ListTags",
				"cloudwatch:GetMetricData"
			],
			"Resource": "*"
		},
		{
			"Sid": "GatherInventory",
			"Effect": "Allow",
			"Action": [
				"ssm:CreateAssociation",
				"ssm:StartAssociationsOnce",
				"ssm:UpdateAssociation"
			],
			"Resource": [
				"arn:aws:ec2:*:*:instance/*",
				"arn:aws:ssm:*:*:document/AmazonInspector2-*",
				"arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory",
				"arn:aws:ssm:*:*:managed-instance/*",
				"arn:aws:ssm:*:*:association/*"
			]
		},
		{
			"Sid": "GatherInventoryDeleteAssociation",
			"Effect": "Allow",
			"Action": [
				"ssm:DeleteAssociation"
			],
			"Resource": [
				"arn:aws:ssm:*:*:association/*"
			]
		},
		{
			"Sid": "DataSyncCleanup",
			"Effect": "Allow",
			"Action": [
				"ssm:CreateResourceDataSync",
				"ssm:DeleteResourceDataSync"
			],
			"Resource": [
				"arn:aws:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete"
			]
		},
		{
			"Sid": "ManagedRules",
			"Effect": "Allow",
			"Action": [
				"events:PutRule",
				"events:DeleteRule",
				"events:DescribeRule",
				"events:ListTargetsByRule",
				"events:PutTargets",
				"events:RemoveTargets"
			],
			"Resource": [
				"arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule"
			]
		},
		{
			"Sid": "LambdaCodeVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"codeguru-security:CreateScan",
				"codeguru-security:GetAccountConfiguration",
				"codeguru-security:GetFindings",
				"codeguru-security:GetScan",
				"codeguru-security:ListFindings",
				"codeguru-security:BatchGetFindings",
				"codeguru-security:DeleteScansByCategory"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Sid": "CodeGuruCodeVulnerabilityScanning",
			"Effect": "Allow",
			"Action": [
				"iam:GetRole",
				"iam:GetRolePolicy",
				"iam:GetPolicy",
				"iam:GetPolicyVersion",
				"iam:ListAttachedRolePolicies",
				"iam:ListPolicies",
				"iam:ListPolicyVersions",
				"iam:ListRolePolicies",
				"lambda:ListVersionsByFunction"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"ForAnyValue:StringEquals": {
					"aws:CalledVia": [
						"codeguru-security.amazonaws.com"
					]
				}
			}
		},
		{
			"Sid": "Ec2DeepInspection",
			"Effect": "Allow",
			"Action": [
				"ssm:PutParameter",
				"ssm:GetParameters",
				"ssm:DeleteParameter"
			],
			"Resource": [
				"arn:aws:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowManagementOfServiceLinkedChannel",
			"Effect": "Allow",
			"Action": [
				"cloudtrail:CreateServiceLinkedChannel",
				"cloudtrail:DeleteServiceLinkedChannel"
			],
			"Resource": [
				"arn:aws:cloudtrail:*:*:channel/aws-service-channel/inspector2/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowListServiceLinkedChannels",
			"Effect": "Allow",
			"Action": [
				"cloudtrail:ListServiceLinkedChannels"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowToRunInvokeCisSpecificDocuments",
			"Effect": "Allow",
			"Action": [
				"ssm:SendCommand",
				"ssm:GetCommandInvocation"
			],
			"Resource": [
				"arn:aws:ssm:*:*:document/AmazonInspector2-InvokeInspectorSsmPluginCIS"
			]
		},
		{
			"Sid": "AllowToRunCisCommandsToSpecificResources",
			"Effect": "Allow",
			"Action": [
				"ssm:SendCommand"
			],
			"Resource": [
				"arn:aws:ec2:*:*:instance/*"
			],
			"Condition": {
				"StringEquals": {
					"aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		},
		{
			"Sid": "AllowToPutCloudwatchMetricData",
			"Effect": "Allow",
			"Action": [
				"cloudwatch:PutMetricData"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"StringEquals": {
					"cloudwatch:namespace": "AWS/Inspector2"
				}
			}
		},
		{
			"Sid": "AllowListAccessToECSAndEKS",
			"Effect": "Allow",
			"Action": [
			    "ecs:ListClusters",
			    "ecs:ListTasks",
			    "eks:ListClusters"
			],
			"Resource": [
			    "*"
			],
			"Condition": {
			    "StringEquals": {
			        "aws:ResourceAccount": "${aws:PrincipalAccount}"
			    }
			}
			},
			{
			"Sid": "AllowAccessToECSTasks",
			"Effect": "Allow",
			"Action": [
			    "ecs:DescribeTasks"
			],
			"Resource": "arn:aws:ecs:*:*:task/*",
			"Condition": {
			    "StringEquals": {
			        "aws:ResourceAccount": "${aws:PrincipalAccount}"
				}
			}
		}
	]
}