翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
# AWSControlTowerAccountServiceRolePolicy
**説明**: AWS Control Tower が自動アカウント設定と一元化されたガバナンスを提供する AWS サービスをユーザーに代わって呼び出すことを許可します。
`AWSControlTowerAccountServiceRolePolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。
## このポリシーを使用すると
このポリシーは、ユーザーに代わってサービスがアクションを実行することを許可する、サービスリンクロールにアタッチされます。ユーザー、グループおよびロールにこのポリシーはアタッチできません。
## ポリシーの詳細
+ **タイプ**: サービスリンクロールポリシー
+ **作成日時**: 2023 年 6 月 5 日 22:04 UTC
+ **編集日時:** 2026 年 2 月 12 日 18:01 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSControlTowerAccountServiceRolePolicy`
## ポリシーのバージョン
**ポリシーのバージョン:** v10 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。
## JSON ポリシードキュメント
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "AllowPutRuleOnSpecificSourcesAndDetailTypes",
"Effect" : "Allow",
"Action" : "events:PutRule",
"Resource" : "arn:aws:events:*:*:rule/*ControlTower*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"events:source" : "aws.securityhub"
},
"ForAllValues:StringEquals" : {
"events:detail-type" : "Security Hub Findings - Imported"
},
"Null" : {
"events:detail-type" : "false"
},
"StringEquals" : {
"events:ManagedBy" : "controltower.amazonaws.com"
}
}
},
{
"Sid" : "AllowOtherOperationsOnRulesManagedByControlTower",
"Effect" : "Allow",
"Action" : [
"events:DeleteRule",
"events:EnableRule",
"events:DisableRule",
"events:PutTargets",
"events:RemoveTargets"
],
"Resource" : "arn:aws:events:*:*:rule/*ControlTower*",
"Condition" : {
"StringEquals" : {
"events:ManagedBy" : "controltower.amazonaws.com"
}
}
},
{
"Sid" : "AllowDescribeOperationsOnRulesManagedByControlTower",
"Effect" : "Allow",
"Action" : [
"events:DescribeRule",
"events:ListTargetsByRule"
],
"Resource" : "arn:aws:events:*:*:rule/*ControlTower*"
},
{
"Sid" : "AllowControlTowerToPublishSecurityNotifications",
"Effect" : "Allow",
"Action" : "sns:publish",
"Resource" : "arn:aws:sns:*:*:aws-controltower-AggregateSecurityNotifications",
"Condition" : {
"StringEquals" : {
"aws:PrincipalAccount" : "${aws:ResourceAccount}"
}
}
},
{
"Sid" : "AllowActionsForSecurityHubIntegration",
"Effect" : "Allow",
"Action" : [
"securityhub:DescribeStandardsControls",
"securityhub:GetEnabledStandards"
],
"Resource" : "arn:aws:securityhub:*:*:hub/default"
},
{
"Sid" : "AllowDeleteConfigRule",
"Effect" : "Allow",
"Action" : [
"config:DeleteConfigRule"
],
"Resource" : "arn:aws:config:*:*:config-rule/aws-service-rule/controltower.*/*"
},
{
"Sid" : "AllowPutConfigRule",
"Effect" : "Allow",
"Action" : [
"config:PutConfigRule"
],
"Resource" : "arn:aws:config:*:*:config-rule/aws-service-rule/controltower.*/*"
},
{
"Sid" : "AllowConfigTagResource",
"Effect" : "Allow",
"Action" : [
"config:TagResource"
],
"Resource" : "arn:aws:config:*:*:config-rule/aws-service-rule/controltower.*/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/aws-control-tower" : "managed-by-control-tower"
}
}
},
{
"Sid" : "AllowConfigRulesDescribe",
"Effect" : "Allow",
"Action" : [
"config:DescribeConfigRules"
],
"Resource" : "*"
},
{
"Sid" : "AllowControlTowerToCreateConfigAggregator",
"Effect" : "Allow",
"Action" : [
"config:PutConfigurationAggregator"
],
"Resource" : [
"arn:aws:config:*:*:config-aggregator/aws-service-config-aggregator/controltower.amazonaws.com/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowControlTowerToManageConfigAggregator",
"Effect" : "Allow",
"Action" : [
"config:DeleteConfigurationAggregator",
"config:DescribeAggregateComplianceByConfigRules",
"config:SelectAggregateResourceConfig"
],
"Resource" : [
"arn:aws:config:*:*:config-aggregator/aws-service-config-aggregator/controltower.amazonaws.com/config-aggregator-*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowControlTowerToTagConfigAggregator",
"Effect" : "Allow",
"Action" : [
"config:TagResource"
],
"Resource" : [
"arn:aws:config:*:*:config-aggregator/aws-service-config-aggregator/controltower.amazonaws.com/*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/aws-control-tower" : "managed-by-control-tower",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowControlTowerToPassAggregatorRoleToConfig",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "config.amazonaws.com",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowDescribeConfigurationAggregators",
"Effect" : "Allow",
"Action" : [
"config:DescribeConfigurationAggregators"
],
"Resource" : [
"*"
]
},
{
"Sid" : "AllowListDelegatedAdministratorsForConfig",
"Effect" : "Allow",
"Action" : [
"organizations:ListDelegatedAdministrators"
],
"Resource" : [
"*"
],
"Condition" : {
"StringEquals" : {
"organizations:ServicePrincipal" : "config.amazonaws.com"
}
}
},
{
"Sid" : "AllowListDescribeOrganization",
"Effect" : "Allow",
"Action" : [
"organizations:DescribeOrganization"
],
"Resource" : [
"*"
]
},
{
"Sid" : "AllowActionsForCloudFormationHooksIntegration",
"Effect" : "Allow",
"Action" : [
"cloudformation:SetTypeConfiguration",
"cloudformation:DeactivateType",
"cloudformation:ActivateType"
],
"Resource" : "arn:aws:cloudformation:*:*:type/hook/AWS-ControlTower*"
}
]
}
```
## 詳細情報
+ [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [AWS 管理ポリシーの使用を開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)