Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.

AWS kebijakan terkelola untuk Amazon Lex V2

Kebijakan AWS terkelola adalah kebijakan mandiri yang dibuat dan dikelola oleh AWS. AWS Kebijakan terkelola dirancang untuk memberikan izin bagi banyak kasus penggunaan umum sehingga Anda dapat mulai menetapkan izin kepada pengguna, grup, dan peran.

Perlu diingat bahwa kebijakan AWS terkelola mungkin tidak memberikan izin hak istimewa paling sedikit untuk kasus penggunaan spesifik Anda karena tersedia untuk digunakan semua pelanggan. AWS Kami menyarankan Anda untuk mengurangi izin lebih lanjut dengan menentukan kebijakan yang dikelola pelanggan yang khusus untuk kasus penggunaan Anda.

Anda tidak dapat mengubah izin yang ditentukan dalam kebijakan AWS terkelola. Jika AWS memperbarui izin yang ditentukan dalam kebijakan AWS terkelola, pembaruan akan memengaruhi semua identitas utama (pengguna, grup, dan peran) yang dilampirkan kebijakan tersebut. AWS kemungkinan besar akan memperbarui kebijakan AWS terkelola saat baru Layanan AWS diluncurkan atau operasi API baru tersedia untuk layanan yang ada.

Untuk informasi selengkapnya, lihat Kebijakan terkelola AWS dalam Panduan Pengguna IAM.

Kebijakan terkelola AWS: AmazonLexReadOnly

Anda dapat melampirkan kebijakan AmazonLexReadOnly ke identitas IAM Anda.

Kebijakan ini memberikan izin hanya-baca yang memungkinkan pengguna melihat semua tindakan di Amazon Lex V2 dan layanan pembuatan model Amazon Lex.

Detail izin

Kebijakan ini mencakup izin berikut:

JSON

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonLexReadOnlyStatement1",
            "Effect": "Allow",
            "Action": [
                "lex:GetBot",
                "lex:GetBotAlias",
                "lex:GetBotAliases",
                "lex:GetBots",
                "lex:GetBotChannelAssociation",
                "lex:GetBotChannelAssociations",
                "lex:GetBotVersions",
                "lex:GetBuiltinIntent",
                "lex:GetBuiltinIntents",
                "lex:GetBuiltinSlotTypes",
                "lex:GetIntent",
                "lex:GetIntents",
                "lex:GetIntentVersions",
                "lex:GetSlotType",
                "lex:GetSlotTypes",
                "lex:GetSlotTypeVersions",
                "lex:GetUtterancesView",
                "lex:DescribeBot",
                "lex:DescribeBotAlias",
                "lex:DescribeBotChannel",
                "lex:DescribeBotLocale",
                "lex:DescribeBotRecommendation",
                "lex:DescribeBotReplica",
                "lex:DescribeBotVersion",
                "lex:DescribeExport",
                "lex:DescribeImport",
                "lex:DescribeIntent",
                "lex:DescribeResourcePolicy",
                "lex:DescribeSlot",
                "lex:DescribeSlotType",
                "lex:ListBots",
                "lex:ListBotLocales",
                "lex:ListBotAliases",
                "lex:ListBotAliasReplicas",
                "lex:ListBotChannels",
                "lex:ListBotRecommendations",
                "lex:ListBotReplicas",
                "lex:ListBotVersions",
                "lex:ListBotVersionReplicas",
                "lex:ListBuiltInIntents",
                "lex:ListBuiltInSlotTypes",
                "lex:ListExports",
                "lex:ListImports",
                "lex:ListIntents",
                "lex:ListRecommendedIntents",
                "lex:ListSlots",
                "lex:ListSlotTypes",
                "lex:ListTagsForResource",
                "lex:SearchAssociatedTranscripts",
                "lex:ListCustomVocabularyItems"
            ],
            "Resource": "*"
        }
    ]
}

Kebijakan terkelola AWS: AmazonLexRunBotsOnly

Anda dapat melampirkan kebijakan AmazonLexRunBotsOnly ke identitas IAM Anda.

Kebijakan ini memberikan izin hanya-baca yang memungkinkan akses untuk menjalankan bot percakapan Amazon Lex V2 dan Amazon Lex.

Detail izin

Kebijakan ini mencakup izin berikut:

JSON

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "lex:PostContent",
                "lex:PostText",
                "lex:PutSession",
                "lex:GetSession",
                "lex:DeleteSession",
                "lex:RecognizeText",
                "lex:RecognizeUtterance",
                "lex:StartConversation"
            ],
            "Resource": "*"
        }
    ]
}

Kebijakan terkelola AWS: AmazonLexFullAccess

Anda dapat melampirkan kebijakan AmazonLexFullAccess ke identitas IAM Anda.

Kebijakan ini memberikan izin administratif yang memungkinkan pengguna untuk membuat, membaca, memperbarui, dan menghapus sumber daya Amazon Lex V2 dan Amazon Lex; dan menjalankan bot percakapan Amazon Lex V2 dan Amazon Lex.

Detail izin

Kebijakan ini mencakup izin berikut:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AmazonLexFullAccessStatement1",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DescribeAlarmsForMetric",
                "kms:DescribeKey",
                "kms:ListAliases",
                "lambda:GetPolicy",
                "lambda:ListFunctions",
                "lambda:ListAliases",
                "lambda:ListVersionsByFunction"
                "lex:*",
                "polly:DescribeVoices",
                "polly:SynthesizeSpeech",
                "kendra:ListIndices",
                "iam:ListRoles",
                "s3:ListAllMyBuckets",
                "logs:DescribeLogGroups",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "AmazonLexFullAccessStatement2",
            "Effect": "Allow",
            "Action": [
                "bedrock:ListFoundationModels"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel"
            ],
            "Resource": "arn:aws:bedrock:*::foundation-model/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:AddPermission",
                "lambda:RemovePermission"
            ],
            "Resource": "arn:aws:lambda:*:*:function:AmazonLex*",
            "Condition": {
                "StringEquals": {
                    "lambda:Principal": "lex.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement3",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:GetRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots",
                "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels",
                "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*",
                "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*",
                "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*"
            ]
        },
        {
            "Sid": "AmazonLexFullAccessStatement4",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "lex.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement5",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "channels.lex.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement6",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "lexv2.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement7",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "channels.lexv2.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement8",
            "Effect": "Allow",
            "Action": [
                "iam:CreateServiceLinkedRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:AWSServiceName": "replication.lexv2.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement9",
            "Effect": "Allow",
            "Action": [
                "iam:DeleteServiceLinkedRole",
                "iam:GetServiceLinkedRoleDeletionStatus"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots",
                "arn:aws:iam::*:role/aws-service-role/channels.lex.amazonaws.com/AWSServiceRoleForLexChannels",
                "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*",
                "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*",                
                "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*"
            ]
        },
        {
            "Sid": "AmazonLexFullAccessStatement10",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/lex.amazonaws.com/AWSServiceRoleForLexBots"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "lex.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement11",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/lexv2.amazonaws.com/AWSServiceRoleForLexV2Bots*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "lexv2.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement12",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/channels.lexv2.amazonaws.com/AWSServiceRoleForLexV2Channels*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "channels.lexv2.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Sid": "AmazonLexFullAccessStatement13",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:aws:iam::*:role/aws-service-role/replication.lexv2.amazonaws.com/AWSServiceRoleForLexV2Replication*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "lexv2.amazonaws.com"
                    ]
                }
            }
        }
    ]
}

Kebijakan terkelola AWS: AmazonLexReplicationPolicy

Anda tidak dapat melampirkan AmazonLexReplicationPolicy ke entitas IAM Anda. Kebijakan ini dilampirkan pada peran terkait layanan yang memungkinkan Amazon Lex V2 melakukan tindakan atas nama Anda. Untuk informasi selengkapnya, lihat Menggunakan peran terkait layanan untuk Amazon Lex V2.

Kebijakan ini memberikan izin administratif yang memungkinkan Amazon Lex V2 mereplikasi AWS sumber daya di seluruh Wilayah atas nama Anda. Anda dapat melampirkan kebijakan ini untuk mengizinkan peran mereplikasi sumber daya dengan mudah, termasuk bot, lokal, versi, alias, maksud, jenis slot, slot, dan kosakata khusus.

Detail izin

Kebijakan ini mencakup izin berikut.

{
    "Version": "2012-10-17",
    "Statement": [
	{
		"Sid": "ReplicationPolicyStatement1",
		"Effect": "Allow",
		"Action": [
			"lex:BuildBotLocale",
			"lex:ListBotLocales",
			"lex:CreateBotAlias",
			"lex:UpdateBotAlias",
			"lex:DeleteBotAlias",
			"lex:DescribeBotAlias",
			"lex:CreateBotVersion",
			"lex:DeleteBotVersion",
			"lex:DescribeBotVersion",
			"lex:CreateExport",
			"lex:DescribeBot",
			"lex:UpdateExport",
			"lex:DescribeExport",
			"lex:DescribeBotLocale",
			"lex:DescribeIntent",
			"lex:ListIntents",
			"lex:DescribeSlotType",
			"lex:ListSlotTypes",
			"lex:DescribeSlot",
			"lex:ListSlots",
			"lex:DescribeCustomVocabulary",
			"lex:StartImport",
			"lex:DescribeImport",
			"lex:CreateBot",
			"lex:UpdateBot",
			"lex:DeleteBot",
			"lex:CreateBotLocale",
			"lex:UpdateBotLocale",
			"lex:DeleteBotLocale",
			"lex:CreateIntent",
			"lex:UpdateIntent",
			"lex:DeleteIntent",
			"lex:CreateSlotType",
			"lex:UpdateSlotType",
			"lex:DeleteSlotType",
			"lex:CreateSlot",
			"lex:UpdateSlot",
			"lex:DeleteSlot",
			"lex:CreateCustomVocabulary",
			"lex:UpdateCustomVocabulary",
			"lex:DeleteCustomVocabulary",
			"lex:DeleteBotChannel",
			"lex:ListTagsForResource",
			"lex:TagResource",
			"lex:UntagResource",
			"lex:CreateResourcePolicy",
			"lex:DeleteResourcePolicy",
			"lex:DescribeResourcePolicy",
			"lex:UpdateResourcePolicy"
		],
		"Resource": [
			"arn:aws:lex:*:*:bot/*",
			"arn:aws:lex:*:*:bot-alias/*"
		]
	},
	{
		"Sid": "ReplicationPolicyStatement2",
		"Effect": "Allow",
		"Action": [
			"lex:CreateUploadUrl",
			"lex:ListBots"
		],
		"Resource": "*"
	},
	{
		"Sid": "ReplicationPolicyStatement3",
		"Effect": "Allow",
		"Action": [
			"iam:PassRole"
		],
		"Resource": "*",
		"Condition": {
			"StringEquals": {
				"iam:PassedToService": "lexv2.amazonaws.com"
			}
		}
	}
    ]
}

Kebijakan terkelola AWS: AmazonLex V2 BedrockAgentPolicy

kebijakan untuk agen Amazon Bedrock

JSON

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Sid": "BedrockAgentInvokePolicy",
        "Action": [
            "bedrock:InvokeAgent"
        ],
        "Resource": [
            "arn:aws:bedrock:{region}:{accountId}:agent/[agentId]"
        ],
        "Condition": {
          "StringEquals": { 
            "aws:ResourceAccount": "{accountId}" 
        }
      }
    }
  ]
}
        

Respons

JSON

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Sid": "LexV2TrustPolicy",
      "Principal": {
        "Service": "lexv2.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{accountId}"
        }
      }
    }
  ]
}
        

Kebijakan terkelola AWS: AmazonLex V2 BedrockKnowledgeBasePolicy

kebijakan untuk basis pengetahuan Amazon Bedrock

JSON

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Sid": "BedrockKnowledgeBaseReadWritePolicy",
        "Action": [
	    "bedrock:RetrieveAndGenerate",
	    "bedrock:Retrieve"
        ],
        "Resource": [
            "arn:aws:bedrock:{region}:{accountId}:knowledge-base/[knowledgeBaseId]"
        ],
        "Condition": {
          "StringEquals": { 
            "aws:ResourceAccount": "{accountId}" 
        }
      }
    }
  ]
}
        

Respons

JSON

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Sid": "LexV2TrustPolicy",
      "Principal": {
        "Service": "lexv2.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
     "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{accountId}"
        }
      }
    }
  ]
}
        

Kebijakan terkelola AWS: AmazonLex V2 BedrockAgentPolicyInternal

kebijakan internal untuk agen Amazon Bedrock

JSON

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Sid": "BedrockAgentInvokePolicy",
        "Action": [
            "bedrock:InvokeAgent"
        ],
        "Resource": [
            "arn:aws:bedrock:{region}:{accountId}:agent/[agentId]"
        ],
        "Condition": {
          "StringEquals": { 
            "aws:ResourceAccount": "{accountId}" 
        }
      }
    }
  ]
}
        

Respons

JSON

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Sid": "LexV2InternalTrustPolicy",
      "Principal": {
        "Service": "lexv2.aws.internal"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{accountId}"
        }
      }
    }
  ]
}
        

Kebijakan terkelola AWS: AmazonLex V2 BedrockKnowledgeBasePolicyInternal

kebijakan internal untuk basis pengetahuan Amazon Bedrock

JSON

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Sid": "BedrockKnowledgeBaseReadWritePolicy",
        "Action": [
	    "bedrock:RetrieveAndGenerate",
	    "bedrock:Retrieve"
        ],
        "Resource": [
            "arn:aws:bedrock:{region}:{accountId}:knowledge-base/[knowledgeBaseId]"
        ],
        "Condition": {
          "StringEquals": { 
            "aws:ResourceAccount": "{accountId}" 
        }
      }
    }
  ]
}
        

Respons

JSON

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "LexV2InternalTrustPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "lexv2.aws.internal"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{accountId}"
        }
      }
    }
  ]
}
        

Amazon Lex V2 memperbarui kebijakan AWS terkelola

Lihat detail tentang pembaruan kebijakan AWS terkelola untuk Amazon Lex V2 sejak layanan ini mulai melacak perubahan ini. Untuk peringatan otomatis tentang perubahan pada halaman ini, berlangganan umpan RSS di halaman Amazon Lex V2Riwayat dokumen untuk Amazon Lex V2.