翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
# AmazonInspector2ThirdPartyServiceRolePolicy
**説明**: Amazon Inspector がマルチクラウドリソーススキャンのためにユーザーに代わってアクションを実行するためのアクセス許可を付与します。
`AmazonInspector2ThirdPartyServiceRolePolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。
## このポリシーを使用すると
このポリシーは、ユーザーに代わってサービスがアクションを実行することを許可する、サービスリンクロールにアタッチされます。ユーザー、グループおよびロールにこのポリシーはアタッチできません。
## ポリシーの詳細
+ **タイプ**: サービスリンクロールポリシー
+ **作成日時**: 2026 年 6 月 26 日 15:27 UTC
+ **編集日時:** 2026 年 6 月 26 日 15:27 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ThirdPartyServiceRolePolicy`
## ポリシーのバージョン
**ポリシーのバージョン:** v1 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。
## JSON ポリシードキュメント
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "MultiCloudResourceDiscovery",
"Effect" : "Allow",
"Action" : [
"resource-explorer-2:Search"
],
"Resource" : "arn:aws:resource-explorer-2:*:*:view/ServiceViewForInspector*/service-view"
},
{
"Sid" : "MultiCloudStreamingAccess",
"Effect" : "Allow",
"Action" : [
"resource-explorer-2:CreateStreamingAccessForService",
"resource-explorer-2:ListStreamingAccessForServices",
"resource-explorer-2:DeleteStreamingAccessForService"
],
"Resource" : "*"
},
{
"Sid" : "MultiCloudSsmAssociationWrite",
"Effect" : "Allow",
"Action" : [
"ssm:CreateAssociation",
"ssm:UpdateAssociation",
"ssm:DeleteAssociation",
"ssm:StartAssociationsOnce"
],
"Resource" : [
"arn:aws:ssm:*:*:document/AWS-InstallDistributorPackageOnAzure*",
"arn:aws:ssm:*:*:association/*"
]
},
{
"Sid" : "MultiCloudSsmAssociationDescribe",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeAssociation"
],
"Resource" : "arn:aws:ssm:*:*:association/*"
},
{
"Sid" : "MultiCloudSsmAssociationList",
"Effect" : "Allow",
"Action" : [
"ssm:ListAssociations",
"ssm:DescribeAssociationExecutions",
"ssm:DescribeAssociationExecutionTargets"
],
"Resource" : "*"
},
{
"Sid" : "MultiCloudSsmGetDocument",
"Effect" : "Allow",
"Action" : [
"ssm:GetDocument"
],
"Resource" : [
"arn:aws:ssm:*:*:document/AmazonInspector2-*",
"arn:aws:ssm:*:*:document/AWS-InstallDistributorPackageOnAzure*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "MultiCloudSsmAutomation",
"Effect" : "Allow",
"Action" : [
"ssm:StartAutomationExecution",
"ssm:GetAutomationExecution",
"ssm:DescribeAutomationExecutions",
"ssm:DescribeAutomationStepExecutions",
"ssm:StopAutomationExecution"
],
"Resource" : [
"arn:aws:ssm:*:*:document/AWS-InstallDistributorPackageOnAzure*",
"arn:aws:ssm:*:*:automation-execution/*"
]
},
{
"Sid" : "MultiCloudCloudConnectorManagement",
"Effect" : "Allow",
"Action" : [
"ssm:CreateCloudConnector",
"ssm:UpdateCloudConnector",
"ssm:DeleteCloudConnector",
"ssm:GetCloudConnector",
"ssm:ListCloudConnectors",
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource",
"ssm:ListTagsForResource"
],
"Resource" : "arn:aws:ssm:*:*:cloud-connector/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "MultiCloudSsmPassRole",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : [
"arn:aws:iam::*:role/Inspector2SSMFederationRole*",
"arn:aws:iam::*:role/Inspector2SSMDispatchRole*",
"arn:aws:iam::*:role/Inspector2SSMAssumeRole*",
"arn:aws:iam::*:role/Inspector2VmScannerRole*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "ssm.amazonaws.com"
}
}
},
{
"Sid" : "MultiCloudIamGetRole",
"Effect" : "Allow",
"Action" : "iam:GetRole",
"Resource" : [
"arn:aws:iam::*:role/Inspector2SSMFederationRole*",
"arn:aws:iam::*:role/Inspector2SSMDispatchRole*",
"arn:aws:iam::*:role/Inspector2SSMAssumeRole*",
"arn:aws:iam::*:role/Inspector2VmScannerRole*"
]
},
{
"Sid" : "MultiCloudConfigSLRecWrite",
"Effect" : "Allow",
"Action" : [
"config:PutThirdPartyServiceLinkedConfigurationRecorder",
"config:DeleteServiceLinkedConfigurationRecorder",
"config:DescribeConfigurationRecorders"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "MultiCloudConfigConnectorRead",
"Effect" : "Allow",
"Action" : [
"config:ListConfigurationRecorders",
"config:GetConnector"
],
"Resource" : "*"
},
{
"Sid" : "MultiCloudConfigMetrics",
"Effect" : "Allow",
"Action" : [
"cloudwatch:GetMetricData"
],
"Resource" : "*"
},
{
"Sid" : "AllowGetWebIdentityToken",
"Effect" : "Allow",
"Action" : "sts:GetWebIdentityToken",
"Resource" : "*",
"Condition" : {
"Null" : {
"sts:IdentityTokenAudience" : "false"
},
"ForAnyValue:StringLike" : {
"sts:IdentityTokenAudience" : [
"api://AzureADTokenExchange"
]
}
}
},
{
"Sid" : "MultiCloudSsmSLRCreation",
"Effect" : "Allow",
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
}
]
}
```
## 詳細情報
+ [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [AWS 管理ポリシーの使用を開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)