기계 번역으로 제공되는 번역입니다. 제공된 번역과 원본 영어의 내용이 상충하는 경우에는 영어 버전이 우선합니다. # AmazonInspector2ServiceRolePolicy **설명**: 보안 평가를 수행하는 데 AWS 서비스 필요한에 대한 액세스 권한을 Amazon Inspector에 부여합니다. `AmazonInspector2ServiceRolePolicy`은(는) [AWS 관리형 정책](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)입니다. ## 이 정책 사용 이 정책은 서비스에서 사용자를 대신하여 작업을 수행할 수 있도록 서비스 연결 역할에 연결됩니다. 사용자, 그룹 또는 역할에 정책을 연결할 수 없습니다. ## 정책 세부 정보 + **유형**: 서비스 연결 역할 정책 + **생성 시간**: 2021년 11월 16일, 20:27 UTC + **편집된 시간:** 2026년 2월 13일, 17:12 UTC + **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AmazonInspector2ServiceRolePolicy` ## 정책 버전 **정책 버전:** v26(기본값) 정책의 기본 버전은 정책에 대한 권한을 정의하는 버전입니다. 정책이 있는 사용자 또는 역할이 AWS 리소스에 대한 액세스를 요청하면는 정책의 기본 버전을 AWS 확인하여 요청을 허용할지 여부를 결정합니다. ## JSON 정책 문서 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "TirosPolicy", "Effect" : "Allow", "Action" : [ "directconnect:DescribeConnections", "directconnect:DescribeDirectConnectGatewayAssociations", "directconnect:DescribeDirectConnectGatewayAttachments", "directconnect:DescribeDirectConnectGateways", "directconnect:DescribeVirtualGateways", "directconnect:DescribeVirtualInterfaces", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", "ec2:DescribeCustomerGateways", "ec2:DescribeEgressOnlyInternetGateways", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeManagedPrefixLists", "ec2:DescribeNatGateways", "ec2:DescribeNetworkAcls", "ec2:DescribeNetworkInterfaces", "ec2:DescribePrefixLists", "ec2:DescribeRegions", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeTransitGatewayAttachments", "ec2:DescribeTransitGatewayConnects", "ec2:DescribeTransitGatewayPeeringAttachments", "ec2:DescribeTransitGatewayRouteTables", "ec2:DescribeTransitGatewayVpcAttachments", "ec2:DescribeTransitGateways", "ec2:DescribeVpcEndpointServiceConfigurations", "ec2:DescribeVpcEndpoints", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:DescribeVpnConnections", "ec2:DescribeVpnGateways", "ec2:GetManagedPrefixListEntries", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:SearchTransitGatewayRoutes", "elasticloadbalancing:DescribeListeners", "elasticloadbalancing:DescribeLoadBalancerAttributes", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeRules", "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetGroupAttributes", "elasticloadbalancing:DescribeTargetHealth", "network-firewall:DescribeFirewall", "network-firewall:DescribeFirewallMetadata", "network-firewall:DescribeFirewallPolicy", "network-firewall:DescribeResourcePolicy", "network-firewall:DescribeRuleGroup", "network-firewall:ListFirewallPolicies", "network-firewall:ListFirewalls", "network-firewall:ListRuleGroups", "tiros:CreateQuery", "tiros:GetQueryAnswer" ], "Resource" : [ "*" ] }, { "Sid" : "PackageVulnerabilityScanning", "Effect" : "Allow", "Action" : [ "ecr:BatchGetImage", "ecr:BatchGetRepositoryScanningConfiguration", "ecr:DescribeImages", "ecr:DescribeRegistry", "ecr:DescribeRepositories", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:GetRegistryScanningConfiguration", "ecr:ListImages", "ecr:PutRegistryScanningConfiguration", "organizations:DescribeAccount", "organizations:DescribeOrganization", "organizations:ListAccounts", "ssm:DescribeAssociation", "ssm:DescribeAssociationExecutions", "ssm:DescribeInstanceInformation", "ssm:ListAssociations", "ssm:ListResourceDataSync" ], "Resource" : "*" }, { "Sid" : "LambdaPackageVulnerabilityScanning", "Effect" : "Allow", "Action" : [ "lambda:ListFunctions", "lambda:GetFunction", "lambda:GetLayerVersion", "lambda:ListTags", "cloudwatch:GetMetricData" ], "Resource" : "*" }, { "Sid" : "GatherInventory", "Effect" : "Allow", "Action" : [ "ssm:CreateAssociation", "ssm:StartAssociationsOnce", "ssm:UpdateAssociation" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonInspector2-*", "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:association/*" ] }, { "Sid" : "GatherInventoryDeleteAssociation", "Effect" : "Allow", "Action" : [ "ssm:DeleteAssociation" ], "Resource" : [ "arn:aws:ssm:*:*:association/*" ] }, { "Sid" : "DataSyncCleanup", "Effect" : "Allow", "Action" : [ "ssm:CreateResourceDataSync", "ssm:DeleteResourceDataSync" ], "Resource" : [ "arn:aws:ssm:*:*:resource-data-sync/InspectorResourceDataSync-do-not-delete" ] }, { "Sid" : "ManagedRules", "Effect" : "Allow", "Action" : [ "events:PutRule", "events:DeleteRule", "events:DescribeRule", "events:ListTargetsByRule", "events:PutTargets", "events:RemoveTargets" ], "Resource" : [ "arn:aws:events:*:*:rule/DO-NOT-DELETE-AmazonInspector*ManagedRule" ] }, { "Sid" : "LambdaCodeVulnerabilityScanning", "Effect" : "Allow", "Action" : [ "codeguru-security:CreateScan", "codeguru-security:GetAccountConfiguration", "codeguru-security:GetFindings", "codeguru-security:GetScan", "codeguru-security:ListFindings", "codeguru-security:BatchGetFindings", "codeguru-security:DeleteScansByCategory" ], "Resource" : [ "*" ] }, { "Sid" : "CodeGuruCodeVulnerabilityScanning", "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "lambda:ListVersionsByFunction" ], "Resource" : [ "*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "codeguru-security.amazonaws.com" ] } } }, { "Sid" : "Ec2DeepInspection", "Effect" : "Allow", "Action" : [ "ssm:PutParameter", "ssm:GetParameters", "ssm:DeleteParameter" ], "Resource" : [ "arn:aws:ssm:*:*:parameter/inspector-aws/service/inspector-linux-application-paths" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowManagementOfServiceLinkedChannel", "Effect" : "Allow", "Action" : [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource" : [ "arn:aws:cloudtrail:*:*:channel/aws-service-channel/inspector2/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowListServiceLinkedChannels", "Effect" : "Allow", "Action" : [ "cloudtrail:ListServiceLinkedChannels" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowToRunInvokeCisSpecificDocuments", "Effect" : "Allow", "Action" : [ "ssm:SendCommand", "ssm:GetCommandInvocation" ], "Resource" : [ "arn:aws:ssm:*:*:document/AmazonInspector2-InvokeInspectorSsmPluginCIS" ] }, { "Sid" : "AllowToRunCisCommandsToSpecificResources", "Effect" : "Allow", "Action" : [ "ssm:SendCommand" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowToPutCloudwatchMetricData", "Effect" : "Allow", "Action" : [ "cloudwatch:PutMetricData" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "cloudwatch:namespace" : "AWS/Inspector2" } } }, { "Sid" : "AllowListAccessToECSAndEKS", "Effect" : "Allow", "Action" : [ "ecs:ListClusters", "ecs:ListTasks", "eks:ListClusters" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowAccessToECSTasks", "Effect" : "Allow", "Action" : [ "ecs:DescribeTasks" ], "Resource" : "arn:aws:ecs:*:*:task/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AllowInspectorEnablementForAwsOrgPolicy", "Effect" : "Allow", "Action" : [ "inspector2:Enable", "inspector2:Disable", "inspector2:EnableDelegatedAdminAccount", "inspector2:AssociateMember" ], "Resource" : "*" }, { "Sid" : "AllowInspectorServiceDelegatedAdminFromAwsOrg", "Effect" : "Allow", "Action" : [ "organizations:ListDelegatedAdministrators" ], "Resource" : "*", "Condition" : { "StringLikeIfExists" : { "organizations:ServicePrincipal" : [ "agentless.inspector2.amazonaws.com", "inspector2.amazonaws.com" ] } } } ] } ``` ## 자세히 알아보기 + [IAM 정책의 버전 관리 이해](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [AWS 관리형 정책을 시작하고 최소 권한으로 전환](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)