翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。 # SecurityLakeResourceManagementServiceRolePolicy **説明**: Security Lake が作成したリソースを管理するためのアクセスを提供します。 `SecurityLakeResourceManagementServiceRolePolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。 ## このポリシーを使用すると このポリシーは、ユーザーに代わってサービスがアクションを実行することを許可する、サービスリンクロールにアタッチされます。ユーザー、グループおよびロールにこのポリシーはアタッチできません。 ## ポリシーの詳細 + **タイプ**: サービスリンクロールポリシー + **作成日時**: 2024 年 11 月 14 日 22:10 UTC + **編集日時:** 2026 年 2 月 12 日 17:59 UTC + **ARN**: `arn:aws:iam::aws:policy/aws-service-role/SecurityLakeResourceManagementServiceRolePolicy` ## ポリシーのバージョン **ポリシーのバージョン:** v7 (デフォルト) ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを判断します。 ## JSON ポリシードキュメント ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "ReadEventBridgeRules", "Effect" : "Allow", "Action" : [ "events:ListRules" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ManageSecurityLakeEventRules", "Effect" : "Allow", "Action" : [ "events:PutRule" ], "Resource" : "arn:aws:events:*:*:rule/AmazonSecurityLake-*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ManageSecurityLakeLambdaConfigurations", "Effect" : "Allow", "Action" : [ "lambda:GetEventSourceMapping", "lambda:GetFunction", "lambda:PutFunctionConcurrency", "lambda:GetProvisionedConcurrencyConfig", "lambda:GetFunctionConcurrency", "lambda:GetRuntimeManagementConfig", "lambda:PutProvisionedConcurrencyConfig", "lambda:PublishVersion", "lambda:DeleteFunctionConcurrency", "lambda:DeleteEventSourceMapping", "lambda:GetAlias", "lambda:GetPolicy", "lambda:GetFunctionConfiguration", "lambda:UpdateFunctionConfiguration" ], "Resource" : [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLakeMetastoreManager-*-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "DeletePartitionUpdaterLambda", "Effect" : "Allow", "Action" : "lambda:DeleteFunction", "Resource" : "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowListLambdaEventSourceMappings", "Effect" : "Allow", "Action" : [ "lambda:ListEventSourceMappings" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowUpdateLambdaEventSourceMapping", "Effect" : "Allow", "Action" : [ "lambda:UpdateEventSourceMapping" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ArnLike" : { "lambda:FunctionArn" : "arn:aws:lambda:*:*:function:AmazonSecurityLakeMetastoreManager-*-*" } } }, { "Sid" : "AllowUpdateLambdaConfigs", "Effect" : "Allow", "Action" : [ "lambda:UpdateFunctionConfiguration" ], "Resource" : "arn:aws:lambda:*:*:function:AmazonSecurityLakeMetastoreManager-*-*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ManageSecurityLakeGlueResources", "Effect" : "Allow", "Action" : [ "glue:CreatePartition", "glue:BatchCreatePartition", "glue:GetTable", "glue:GetTables", "glue:UpdateTable", "glue:GetDatabase" ], "Resource" : [ "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:catalog" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowDataLakeConfigurationManagement", "Effect" : "Allow", "Action" : [ "s3:ListBucket", "s3:PutObject", "s3:GetObjectAttributes", "s3:GetBucketNotification", "s3:PutBucketNotification", "s3:GetLifecycleConfiguration", "s3:PutLifecycleConfiguration", "s3:GetEncryptionConfiguration", "s3:GetReplicationConfiguration" ], "Resource" : [ "arn:aws:s3:::aws-security-data-lake*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowMetaDataCompactionAndManagement", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:DeleteObject", "s3:RestoreObject" ], "Resource" : [ "arn:aws:s3:::aws-security-data-lake*/metadata/*.avro", "arn:aws:s3:::aws-security-data-lake*/metadata/*.metadata.json" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ReadSecurityLakeLambdaLogs", "Effect" : "Allow", "Action" : [ "logs:DescribeLogStreams", "logs:StartQuery", "logs:GetLogEvents", "logs:GetQueryResults", "logs:GetLogRecord" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/lambda/AmazonSecurityLakeMetastoreManager-*-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ManageSecurityLakeSQSQueue", "Effect" : "Allow", "Action" : [ "sqs:StartMessageMoveTask", "sqs:DeleteMessage", "sqs:GetQueueUrl", "sqs:ListDeadLetterSourceQueues", "sqs:ChangeMessageVisibility", "sqs:ListMessageMoveTasks", "sqs:ReceiveMessage", "sqs:SendMessage", "sqs:GetQueueAttributes", "sqs:SetQueueAttributes" ], "Resource" : [ "arn:aws:sqs:*:*:SecurityLake_*", "arn:aws:sqs:*:*:AmazonSecurityLakeManager-*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowDataLakeManagement", "Effect" : "Allow", "Action" : [ "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] } ``` ## 詳細情報 + [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [AWS 管理ポリシーの使用を開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)