Les traductions sont fournies par des outils de traduction automatique. En cas de conflit entre le contenu d'une traduction et celui de la version originale en anglais, la version anglaise prévaudra.

AWSFinOpsAgentServiceRolePolicy

Descriptif: Fournit AWS FinOps Accès des agents aux fonctionnalités de facturation, de gestion des coûts, d'utilisation, d'optimisation et de configuration des ressources pour générer des informations sur les coûts et les économies, et leur permettre de gérer leur propre Amazon EventBridge règles pour les flux de travail configurés.

AWSFinOpsAgentServiceRolePolicy est un AWS politique gérée.

Utilisation de cette politique

Cette politique est associée à un rôle lié à un service qui permet au service d'effectuer des actions en votre nom. Vous pouvez attacher cette politique à vos utilisateurs, groupes ou rôles.

Détails de la politique

Version de la politique

Version de la politique : v1 (par défaut)

La version par défaut de la politique est la version qui définit les autorisations pour la politique. Lorsqu'un utilisateur ou un rôle doté de la politique demande l'accès à un AWS ressource, AWS vérifie la version par défaut de la politique pour déterminer si la demande doit être autorisée.

Document de politique JSON

{
  "Version" : "2012-10-17",
  "Statement" : [
    {
      "Sid" : "CostExplorerReadAndAnalyzeAccess",
      "Effect" : "Allow",
      "Action" : [
        "ce:DescribeCostCategoryDefinition",
        "ce:GetAnomalies",
        "ce:GetAnomalyMonitors",
        "ce:GetCommitmentPurchaseAnalysis",
        "ce:GetCostAndUsage",
        "ce:GetCostAndUsageComparisons",
        "ce:GetCostAndUsageWithResources",
        "ce:GetCostCategories",
        "ce:GetCostComparisonDrivers",
        "ce:GetCostForecast",
        "ce:GetDimensionValues",
        "ce:GetReservationCoverage",
        "ce:GetReservationPurchaseRecommendation",
        "ce:GetReservationUtilization",
        "ce:GetSavingsPlanPurchaseRecommendationDetails",
        "ce:GetSavingsPlansCoverage",
        "ce:GetSavingsPlansPurchaseRecommendation",
        "ce:GetSavingsPlansUtilization",
        "ce:GetSavingsPlansUtilizationDetails",
        "ce:GetTags",
        "ce:GetUsageForecast",
        "ce:ListCommitmentPurchaseAnalyses",
        "ce:ListCostAllocationTagBackfillHistory",
        "ce:ListCostAllocationTags",
        "ce:ListCostCategoryDefinitions",
        "ce:ListCostCategoryResourceAssociations",
        "ce:ListSavingsPlansPurchaseRecommendationGeneration",
        "ce:ListTagsForResource",
        "ce:StartCommitmentPurchaseAnalysis",
        "ce:StartSavingsPlansPurchaseRecommendationGeneration"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "CostAndUsageReportReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "bcm-data-exports:GetExport",
        "bcm-data-exports:ListExports",
        "cur:DescribeReportDefinitions"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "BillingReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "billing:GetBillingData",
        "billing:GetBillingDetails",
        "billing:GetBillingNotifications",
        "billing:GetBillingPreferences",
        "billing:GetBillingView",
        "billing:GetContractInformation",
        "billing:GetCreditAllocationHistory",
        "billing:GetCredits",
        "billing:GetEnterpriseSupportChargeSummary",
        "billing:GetEnterpriseSupportContractDetails",
        "billing:GetIAMAccessPreference",
        "billing:GetResourcePolicy",
        "billing:GetSellerOfRecord",
        "billing:ListBillingViews",
        "billing:ListEnterpriseSupportLinkedAccountCharges",
        "billing:ListSourceViewsForBillingView"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "BillingConductorReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "billingconductor:GetBillingGroupCostReport",
        "billingconductor:ListAccountAssociations",
        "billingconductor:ListBillingGroupCostReports",
        "billingconductor:ListBillingGroups",
        "billingconductor:ListCustomLineItemVersions",
        "billingconductor:ListCustomLineItems",
        "billingconductor:ListPricingPlans",
        "billingconductor:ListPricingPlansAssociatedWithPricingRule",
        "billingconductor:ListPricingRules",
        "billingconductor:ListPricingRulesAssociatedToPricingPlan",
        "billingconductor:ListResourcesAssociatedToCustomLineItem",
        "billingconductor:ListTagsForResource"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "BudgetsReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "budgets:DescribeBudgetAction",
        "budgets:DescribeBudgetActionHistories",
        "budgets:DescribeBudgetActionsForAccount",
        "budgets:DescribeBudgetActionsForBudget",
        "budgets:ListTagsForResource",
        "budgets:ViewBudget"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "InvoicingReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "invoicing:BatchGetInvoiceProfile",
        "invoicing:GetInvoiceCorrection",
        "invoicing:GetInvoiceEmailDeliveryPreferences",
        "invoicing:GetInvoicePDF",
        "invoicing:GetInvoiceUnit",
        "invoicing:GetProcurementPortalPreference",
        "invoicing:ListInvoiceCorrections",
        "invoicing:ListInvoiceSummaries",
        "invoicing:ListInvoiceUnits",
        "invoicing:ListProcurementPortalPreferences",
        "invoicing:ListProcurementPortalSuppliers",
        "invoicing:ListProcurementPortals",
        "invoicing:ListTagsForResource"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "PurchaseOrderReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "purchase-orders:GetPurchaseOrder",
        "purchase-orders:ListPurchaseOrderInvoices",
        "purchase-orders:ListPurchaseOrders",
        "purchase-orders:ListTagsForResource",
        "purchase-orders:ViewPurchaseOrders"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "FreeTierReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "freetier:GetAccountActivity",
        "freetier:GetAccountPlanState",
        "freetier:GetFreeTierAlertPreference",
        "freetier:GetFreeTierUsage",
        "freetier:ListAccountActivities"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "CreditProgramReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "mapcredits:ListAssociatedPrograms",
        "mapcredits:ListQuarterCredits",
        "mapcredits:ListQuarterSpend"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "PricingReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "pricing:DescribeServices",
        "pricing:GetAttributeValues",
        "pricing:GetProducts"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "PricingCalculatorReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "bcm-pricing-calculator:GetPreferences",
        "bcm-pricing-calculator:GetWorkloadEstimate",
        "bcm-pricing-calculator:ListWorkloadEstimateUsage",
        "bcm-pricing-calculator:ListWorkloadEstimates"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "OrganizationStructureReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "account:GetRegionOptStatus",
        "account:ListRegions",
        "consolidatedbilling:GetAccountBillingRole",
        "consolidatedbilling:ListLinkedAccounts",
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:ListAccounts",
        "organizations:ListChildren",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListParents",
        "organizations:ListRoots"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "AwsOrgsScopedAccess",
      "Effect" : "Allow",
      "Action" : [
        "organizations:ListDelegatedAdministrators"
      ],
      "Resource" : "*",
      "Condition" : {
        "StringLikeIfExists" : {
          "organizations:ServicePrincipal" : [
            "finops-agent.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid" : "CostOptimizationHubReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "cost-optimization-hub:GetPreferences",
        "cost-optimization-hub:GetRecommendation",
        "cost-optimization-hub:ListEfficiencyMetrics",
        "cost-optimization-hub:ListEnrollmentStatuses",
        "cost-optimization-hub:ListRecommendationSummaries",
        "cost-optimization-hub:ListRecommendations"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "ComputeOptimizerReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "compute-optimizer:DescribeRecommendationExportJobs",
        "compute-optimizer:GetAutoScalingGroupRecommendations",
        "compute-optimizer:GetEBSVolumeRecommendations",
        "compute-optimizer:GetEC2InstanceRecommendations",
        "compute-optimizer:GetEC2RecommendationProjectedMetrics",
        "compute-optimizer:GetECSServiceRecommendationProjectedMetrics",
        "compute-optimizer:GetECSServiceRecommendations",
        "compute-optimizer:GetEffectiveRecommendationPreferences",
        "compute-optimizer:GetEnrollmentStatus",
        "compute-optimizer:GetEnrollmentStatusesForOrganization",
        "compute-optimizer:GetIdleRecommendations",
        "compute-optimizer:GetLambdaFunctionRecommendations",
        "compute-optimizer:GetLicenseRecommendations",
        "compute-optimizer:GetRDSDatabaseRecommendationProjectedMetrics",
        "compute-optimizer:GetRDSDatabaseRecommendations",
        "compute-optimizer:GetRecommendationPreferences",
        "compute-optimizer:GetRecommendationSummaries"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "CostOptimizationAutomationReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "aco-automation:GetAutomationEvent",
        "aco-automation:GetAutomationRule",
        "aco-automation:GetEnrollmentConfiguration",
        "aco-automation:ListAccounts",
        "aco-automation:ListAutomationEventSteps",
        "aco-automation:ListAutomationEventSummaries",
        "aco-automation:ListAutomationEvents",
        "aco-automation:ListAutomationRulePreview",
        "aco-automation:ListAutomationRulePreviewSummaries",
        "aco-automation:ListAutomationRules",
        "aco-automation:ListRecommendedActionSummaries",
        "aco-automation:ListRecommendedActions",
        "aco-automation:ListTagsForResource"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "SavingsPlansReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "savingsplans:DescribeSavingsPlanRates",
        "savingsplans:DescribeSavingsPlans",
        "savingsplans:DescribeSavingsPlansOfferingRates",
        "savingsplans:DescribeSavingsPlansOfferings",
        "savingsplans:ListTagsForResource"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "ComputeResourceReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingPolicies",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribeAutoScalingInstances",
        "ec2:DescribeAddresses",
        "ec2:DescribeInstanceTypes",
        "ec2:DescribeInstances",
        "ec2:DescribeNatGateways",
        "ec2:DescribeReservedInstances",
        "ec2:DescribeSnapshots",
        "ec2:DescribeVolumes",
        "ec2:DescribeVpcEndpoints"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "LambdaResourceReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "lambda:GetFunctionConfiguration",
        "lambda:ListFunctions",
        "lambda:ListProvisionedConcurrencyConfigs"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "ContainerResourceReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "ecs:ListClusters",
        "ecs:ListServices"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "DatabaseResourceReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "dynamodb:DescribeContinuousBackups",
        "dynamodb:DescribeTable",
        "dynamodb:ListTables",
        "elasticache:DescribeCacheClusters",
        "elasticache:DescribeReplicationGroups",
        "elasticache:DescribeReservedCacheNodes",
        "elasticache:DescribeSnapshots",
        "memorydb:DescribeClusters",
        "memorydb:DescribeSnapshots",
        "rds:DescribeDBClusterSnapshots",
        "rds:DescribeDBClusters",
        "rds:DescribeDBEngineVersions",
        "rds:DescribeDBInstances",
        "rds:DescribeDBSnapshots",
        "rds:DescribeReservedDBInstances",
        "redshift:DescribeClusterSnapshots",
        "redshift:DescribeClusters",
        "redshift:DescribeReservedNodes"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "StorageResourceReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning",
        "s3:GetIntelligentTieringConfiguration",
        "s3:GetInventoryConfiguration",
        "s3:GetLifecycleConfiguration",
        "s3:GetReplicationConfiguration",
        "s3:GetStorageLensConfiguration",
        "s3:ListAllMyBuckets"
      ],
      "Resource" : "*",
      "Condition" : {
        "StringEquals" : {
          "aws:ResourceAccount" : "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid" : "MachineLearningResourceReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "sagemaker:DescribeEndpoint",
        "sagemaker:DescribeEndpointConfig",
        "sagemaker:DescribeNotebookInstance",
        "sagemaker:ListApps",
        "sagemaker:ListDomains",
        "sagemaker:ListEndpointConfigs",
        "sagemaker:ListEndpoints",
        "sagemaker:ListNotebookInstances"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "WorkspacesReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "workspaces:DescribeWorkspaces",
        "workspaces:DescribeWorkspacesConnectionStatus"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "ResourceDiscoveryReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "ram:GetResourceShares",
        "resource-explorer-2:GetIndex",
        "resource-explorer-2:ListIndexes",
        "resource-explorer-2:Search",
        "tag:GetResources"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "UtilizationMetricsReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "LogConfigurationReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "logs:DescribeLogGroups",
        "logs:DescribeSubscriptionFilters"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "CloudTrailConfigurationReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetEventSelectors",
        "cloudtrail:GetTrailStatus",
        "cloudtrail:LookupEvents"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "HealthEventReadAccess",
      "Effect" : "Allow",
      "Action" : [
        "health:DescribeEvents"
      ],
      "Resource" : "*"
    },
    {
      "Sid" : "EventBridgeManagedRuleManagementWritePermissions",
      "Effect" : "Allow",
      "Action" : [
        "events:DeleteRule",
        "events:DisableRule",
        "events:EnableRule",
        "events:PutRule",
        "events:PutTargets",
        "events:RemoveTargets"
      ],
      "Resource" : "arn:aws:events:*:*:rule/*",
      "Condition" : {
        "StringEquals" : {
          "events:ManagedBy" : "finops-agent.amazonaws.com"
        }
      }
    },
    {
      "Sid" : "EventBridgeManagedRuleManagementReadPermissions",
      "Effect" : "Allow",
      "Action" : [
        "events:DescribeRule",
        "events:ListTargetsByRule"
      ],
      "Resource" : "arn:aws:events:*:*:rule/*"
    }
  ]
}

En savoir plus