本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
描述：提供管理 AWS Config 记录器资源和资源（包括日志、指标）的遥测设置的权限。 AWS
AWSObservabilityAdminTelemetryEnablementServiceRolePolicy 是一项 AWS 托管式策略。
使用此策略
此附加到服务相关角色的策略允许服务代表您执行操作。您无法将此策略附加到您的用户、组或角色。
策略详细信息
-
类型：服务相关角色策略
-
创建时间：2025 年 8 月 1 日 18:04 UTC
-
编辑时间：世界标准时间 2025 年 12 月 2 日 01:19
-
ARN:
arn:aws:iam::aws:policy/aws-service-role/AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
策略版本
策略版本：v2（默认）
此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。
JSON 策略文档
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "TelemetryOperations", "Effect" : "Allow", "Action" : [ "ec2:DescribeFlowLogs", "ec2:DescribeVpcs", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:ListLogGroups" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TagOperationForEC2", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}", "ec2:CreateAction" : "CreateFlowLogs" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TagOperationForLogs", "Effect" : "Allow", "Action" : [ "logs:TagResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TelemetryOperationsForVPCLogs", "Effect" : "Allow", "Action" : [ "ec2:CreateFlowLogs" ], "Resource" : "arn:aws:ec2:*:*:vpc/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForVPCFlowLogs", "Effect" : "Allow", "Action" : [ "ec2:CreateFlowLogs" ], "Resource" : "arn:aws:ec2:*:*:vpc-flow-log/*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TelemetryOperationsForLogs", "Effect" : "Allow", "Action" : [ "ec2:DeleteFlowLogs", "logs:CreateDelivery", "logs:CreateLogGroup", "logs:PutResourcePolicy", "logs:PutRetentionPolicy", "logs:PutDeliveryDestination", "logs:PutDeliverySource", "logs:CreateLogStream", "logs:DescribeLogGroups" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForEKSApiLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/api" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSAuditLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/audit" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSAuthenticatorLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/authenticator" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSControllerManagerLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/controllerManager" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSSchedulerLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/scheduler" : "true" } } }, { "Sid" : "TelemetryOperationsForWafLoggingConfigurations", "Effect" : "Allow", "Action" : [ "wafv2:PutLoggingConfiguration" ], "Resource" : "arn:aws:wafv2:*:*:regional/webacl/*", "Condition" : { "ArnLike" : { "wafv2:LogDestinationResource" : "arn:aws:logs:*:*:log-group:*" }, "StringEquals" : { "wafv2:LogScope" : "CloudwatchTelemetryRuleManaged", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForWafLogDelivery", "Effect" : "Allow", "Action" : [ "logs:CreateLogDelivery" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "wafv2.amazonaws.com" ] }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForELB", "Effect" : "Allow", "Action" : [ "elasticloadbalancing:AllowVendedLogDeliveryForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForBedrock", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:AllowVendedLogDeliveryForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForCloudTrailLogs", "Effect" : "Allow", "Action" : [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:UpdateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource" : "arn:aws:cloudtrail:*:*:channel/aws-service-channel/cloudwatch/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForManagedLogs", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:PutResourcePolicy", "logs:PutRetentionPolicy" ], "Resource" : [ "arn:aws:logs:*:*:log-group:aws/cloudtrail", "arn:aws:logs:*:*:log-group:aws/cloudtrail/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingListOperations", "Effect" : "Allow", "Action" : [ "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingGetOperations", "Effect" : "Allow", "Action" : [ "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListTagsForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingConfigCreation", "Effect" : "Allow", "Action" : [ "route53resolver:CreateResolverQueryLogConfig", "route53resolver:TagResource" ], "Resource" : "arn:aws:route53resolver:*:*:resolver-query-log-config/*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingConfigAssociation", "Effect" : "Allow", "Action" : [ "route53resolver:AssociateResolverQueryLogConfig" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForRoute53LogDeliverySLR", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : "arn:*:iam::*:role/aws-service-role/route53resolver.amazonaws.com/AWSServiceRoleForRoute53Resolver", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "route53resolver.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "BoolIfExists" : { "aws:ViaAWSService" : "true" } } }, { "Sid" : "TelemetryOperationsForRoute53LogDelivery", "Effect" : "Allow", "Action" : [ "logs:CreateLogDelivery" ], "Resource" : "*" }, { "Sid" : "IAMOperationsForConfigServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig" ], "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "config.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "BoolIfExists" : { "aws:ViaAWSService" : "true" } } }, { "Sid" : "ManagementOperationsForServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "config:PutServiceLinkedConfigurationRecorder", "config:DeleteServiceLinkedConfigurationRecorder", "config:AssociateResourceTypes", "config:DisassociateResourceTypes" ], "Resource" : [ "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForObservabilityAdmin_TelemetryEnablement/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ReadOperationsForServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "config:DescribeConfigurationRecorders" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "config:ConfigurationRecorderServicePrincipal" : [ "telemetry-enablement.observabilityadmin.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] }
了解更多信息
