翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
説明: ログ、メトリクスなどのリソースの AWS Config レコーダー AWS リソースとテレメトリ設定を管理するためのアクセスを提供します。
AWSObservabilityAdminTelemetryEnablementServiceRolePolicy は AWS マネージドポリシーです。
このポリシーを使用すると
このポリシーは、ユーザーに代わってサービスがアクションを実行することを許可する、サービスリンクロールにアタッチされます。ユーザー、グループおよびロールにこのポリシーはアタッチできません。
ポリシーの詳細
-
タイプ: サービスリンクロールポリシー
-
作成日時: 2025 年 8 月 1 日 18:04 UTC
-
編集日時: 2025 年 12 月 2 日 01:19 UTC
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
ポリシーのバージョン
ポリシーのバージョン: v2 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。
JSON ポリシードキュメント
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "TelemetryOperations", "Effect" : "Allow", "Action" : [ "ec2:DescribeFlowLogs", "ec2:DescribeVpcs", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:ListLogGroups" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TagOperationForEC2", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}", "ec2:CreateAction" : "CreateFlowLogs" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TagOperationForLogs", "Effect" : "Allow", "Action" : [ "logs:TagResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TelemetryOperationsForVPCLogs", "Effect" : "Allow", "Action" : [ "ec2:CreateFlowLogs" ], "Resource" : "arn:aws:ec2:*:*:vpc/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForVPCFlowLogs", "Effect" : "Allow", "Action" : [ "ec2:CreateFlowLogs" ], "Resource" : "arn:aws:ec2:*:*:vpc-flow-log/*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TelemetryOperationsForLogs", "Effect" : "Allow", "Action" : [ "ec2:DeleteFlowLogs", "logs:CreateDelivery", "logs:CreateLogGroup", "logs:PutResourcePolicy", "logs:PutRetentionPolicy", "logs:PutDeliveryDestination", "logs:PutDeliverySource", "logs:CreateLogStream", "logs:DescribeLogGroups" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForEKSApiLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/api" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSAuditLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/audit" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSAuthenticatorLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/authenticator" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSControllerManagerLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/controllerManager" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSSchedulerLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/scheduler" : "true" } } }, { "Sid" : "TelemetryOperationsForWafLoggingConfigurations", "Effect" : "Allow", "Action" : [ "wafv2:PutLoggingConfiguration" ], "Resource" : "arn:aws:wafv2:*:*:regional/webacl/*", "Condition" : { "ArnLike" : { "wafv2:LogDestinationResource" : "arn:aws:logs:*:*:log-group:*" }, "StringEquals" : { "wafv2:LogScope" : "CloudwatchTelemetryRuleManaged", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForWafLogDelivery", "Effect" : "Allow", "Action" : [ "logs:CreateLogDelivery" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "wafv2.amazonaws.com" ] }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForELB", "Effect" : "Allow", "Action" : [ "elasticloadbalancing:AllowVendedLogDeliveryForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForBedrock", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:AllowVendedLogDeliveryForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForCloudTrailLogs", "Effect" : "Allow", "Action" : [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:UpdateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource" : "arn:aws:cloudtrail:*:*:channel/aws-service-channel/cloudwatch/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForManagedLogs", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:PutResourcePolicy", "logs:PutRetentionPolicy" ], "Resource" : [ "arn:aws:logs:*:*:log-group:aws/cloudtrail", "arn:aws:logs:*:*:log-group:aws/cloudtrail/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingListOperations", "Effect" : "Allow", "Action" : [ "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingGetOperations", "Effect" : "Allow", "Action" : [ "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListTagsForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingConfigCreation", "Effect" : "Allow", "Action" : [ "route53resolver:CreateResolverQueryLogConfig", "route53resolver:TagResource" ], "Resource" : "arn:aws:route53resolver:*:*:resolver-query-log-config/*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingConfigAssociation", "Effect" : "Allow", "Action" : [ "route53resolver:AssociateResolverQueryLogConfig" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForRoute53LogDeliverySLR", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : "arn:*:iam::*:role/aws-service-role/route53resolver.amazonaws.com/AWSServiceRoleForRoute53Resolver", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "route53resolver.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "BoolIfExists" : { "aws:ViaAWSService" : "true" } } }, { "Sid" : "TelemetryOperationsForRoute53LogDelivery", "Effect" : "Allow", "Action" : [ "logs:CreateLogDelivery" ], "Resource" : "*" }, { "Sid" : "IAMOperationsForConfigServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig" ], "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "config.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "BoolIfExists" : { "aws:ViaAWSService" : "true" } } }, { "Sid" : "ManagementOperationsForServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "config:PutServiceLinkedConfigurationRecorder", "config:DeleteServiceLinkedConfigurationRecorder", "config:AssociateResourceTypes", "config:DisassociateResourceTypes" ], "Resource" : [ "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForObservabilityAdmin_TelemetryEnablement/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ReadOperationsForServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "config:DescribeConfigurationRecorders" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "config:ConfigurationRecorderServicePrincipal" : [ "telemetry-enablement.observabilityadmin.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] }
詳細はこちら
