本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # CloudwatchApplicationInsightsServiceLinkedRolePolicy **描述**：Cloudwatch Application Insights 服务相关角色策略 `CloudwatchApplicationInsightsServiceLinkedRolePolicy` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 此附加到服务相关角色的策略允许服务代表您执行操作。您无法将此策略附加到您的用户、组或角色。 ## 策略详细信息 + **类型**：服务相关角色策略 + **创建时间**：2018 年 12 月 1 日 16:22 UTC + **编辑时间：**2024 年 7 月 25 日 16:24 UTC + **ARN**: `arn:aws:iam::aws:policy/aws-service-role/CloudwatchApplicationInsightsServiceLinkedRolePolicy` ## 策略版本 **策略版本：**v25（默认） 此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "CloudWatch", "Effect" : "Allow", "Action" : [ "cloudwatch:DescribeAlarmHistory", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:PutAnomalyDetector", "cloudwatch:DeleteAnomalyDetector", "cloudwatch:DescribeAnomalyDetectors" ], "Resource" : [ "*" ] }, { "Sid" : "CloudWatchLogs", "Effect" : "Allow", "Action" : [ "logs:FilterLogEvents", "logs:GetLogEvents", "logs:DescribeLogStreams", "logs:DescribeLogGroups" ], "Resource" : [ "*" ] }, { "Sid" : "EventBridge", "Effect" : "Allow", "Action" : [ "events:DescribeRule" ], "Resource" : [ "*" ] }, { "Sid" : "CloudFormation", "Effect" : "Allow", "Action" : [ "cloudFormation:CreateStack", "cloudFormation:UpdateStack", "cloudFormation:DeleteStack", "cloudFormation:DescribeStackResources", "cloudFormation:UpdateTerminationProtection" ], "Resource" : [ "arn:aws:cloudformation:*:*:stack/ApplicationInsights-*" ] }, { "Sid" : "CloudFormationStacks", "Effect" : "Allow", "Action" : [ "cloudFormation:DescribeStacks", "cloudFormation:ListStackResources", "cloudFormation:ListStacks" ], "Resource" : [ "*" ] }, { "Sid" : "Tag", "Effect" : "Allow", "Action" : [ "tag:GetResources" ], "Resource" : [ "*" ] }, { "Sid" : "ResourceGroups", "Effect" : "Allow", "Action" : [ "resource-groups:ListGroupResources", "resource-groups:GetGroupQuery", "resource-groups:GetGroup" ], "Resource" : [ "*" ] }, { "Sid" : "ApplicationInsightsResourceGroup", "Effect" : "Allow", "Action" : [ "resource-groups:CreateGroup", "resource-groups:DeleteGroup" ], "Resource" : [ "arn:aws:resource-groups:*:*:group/ApplicationInsights-*" ] }, { "Sid" : "ElasticLoadBalancing", "Effect" : "Allow", "Action" : [ "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth" ], "Resource" : [ "*" ] }, { "Sid" : "AutoScaling", "Effect" : "Allow", "Action" : [ "autoscaling:DescribeAutoScalingGroups" ], "Resource" : [ "*" ] }, { "Sid" : "SSMParameter", "Effect" : "Allow", "Action" : [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:RemoveTagsFromResource", "ssm:GetParameters" ], "Resource" : "arn:aws:ssm:*:*:parameter/AmazonCloudWatch-ApplicationInsights-*" }, { "Sid" : "SSMAssociation", "Effect" : "Allow", "Action" : [ "ssm:CreateAssociation", "ssm:UpdateAssociation", "ssm:DeleteAssociation", "ssm:DescribeAssociation" ], "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:association/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSEC2-ApplicationInsightsCloudwatchAgentInstallAndConfigure", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Sid" : "SSMOpsItem", "Effect" : "Allow", "Action" : [ "ssm:GetOpsItem", "ssm:CreateOpsItem", "ssm:DescribeOpsItems", "ssm:UpdateOpsItem", "ssm:DescribeInstanceInformation" ], "Resource" : [ "*" ] }, { "Sid" : "SSMTags", "Effect" : "Allow", "Action" : [ "ssm:AddTagsToResource" ], "Resource" : "arn:aws:ssm:*:*:opsitem/*" }, { "Sid" : "SSMGetCommandInvocation", "Effect" : "Allow", "Action" : [ "ssm:ListCommandInvocations", "ssm:GetCommandInvocation" ], "Resource" : [ "*" ] }, { "Sid" : "SSMSendCommand", "Effect" : "Allow", "Action" : "ssm:SendCommand", "Resource" : [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:document/AWSEC2-CheckPerformanceCounterSets", "arn:aws:ssm:*:*:document/AWS-ConfigureAWSPackage", "arn:aws:ssm:*:*:document/AWSEC2-DetectWorkload", "arn:aws:ssm:*:*:document/AmazonCloudWatch-ManageAgent" ] }, { "Sid" : "EC2", "Effect" : "Allow", "Action" : [ "ec2:DescribeInstances", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcs", "ec2:DescribeVpcAttribute", "ec2:DescribeNatGateways" ], "Resource" : [ "*" ] }, { "Sid" : "RDS", "Effect" : "Allow", "Action" : [ "rds:DescribeDBInstances", "rds:DescribeDBClusters" ], "Resource" : [ "*" ] }, { "Sid" : "Lambda", "Effect" : "Allow", "Action" : [ "lambda:ListFunctions", "lambda:GetFunctionConfiguration", "lambda:ListEventSourceMappings" ], "Resource" : [ "*" ] }, { "Sid" : "EventBridgeManagedRule", "Effect" : "Allow", "Action" : [ "events:PutRule", "events:PutTargets", "events:RemoveTargets", "events:DeleteRule" ], "Resource" : [ "arn:aws:events:*:*:rule/AmazonCloudWatch-ApplicationInsights-*" ] }, { "Sid" : "XRay", "Effect" : "Allow", "Action" : [ "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:GetTimeSeriesServiceStatistics", "xray:GetTraceGraph" ], "Resource" : [ "*" ] }, { "Sid" : "DynamoDB", "Effect" : "Allow", "Action" : [ "dynamodb:ListTables", "dynamodb:DescribeTable", "dynamodb:DescribeContributorInsights", "dynamodb:DescribeTimeToLive" ], "Resource" : [ "*" ] }, { "Sid" : "ApplicationAutoscaling", "Effect" : "Allow", "Action" : [ "application-autoscaling:DescribeScalableTargets" ], "Resource" : [ "*" ] }, { "Sid" : "S3", "Effect" : "Allow", "Action" : [ "s3:ListAllMyBuckets", "s3:GetMetricsConfiguration", "s3:GetReplicationConfiguration" ], "Resource" : [ "*" ] }, { "Sid" : "States", "Effect" : "Allow", "Action" : [ "states:ListStateMachines", "states:DescribeExecution", "states:DescribeStateMachine", "states:GetExecutionHistory" ], "Resource" : [ "*" ] }, { "Sid" : "APIGateway", "Effect" : "Allow", "Action" : [ "apigateway:GET" ], "Resource" : [ "*" ] }, { "Sid" : "ECS", "Effect" : "Allow", "Action" : [ "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeServices", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:DescribeTaskSets", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListServices", "ecs:ListTasks" ], "Resource" : [ "*" ] }, { "Sid" : "ECSCluster", "Effect" : "Allow", "Action" : [ "ecs:UpdateClusterSettings" ], "Resource" : [ "arn:aws:ecs:*:*:cluster/*" ] }, { "Sid" : "EKS", "Effect" : "Allow", "Action" : [ "eks:DescribeCluster", "eks:DescribeFargateProfile", "eks:DescribeNodegroup", "eks:ListClusters", "eks:ListFargateProfiles", "eks:ListNodegroups", "fsx:DescribeFileSystems", "fsx:DescribeVolumes" ], "Resource" : [ "*" ] }, { "Sid" : "SNS", "Effect" : "Allow", "Action" : [ "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:GetSMSAttributes", "sns:ListSubscriptionsByTopic", "sns:ListTopics" ], "Resource" : [ "*" ] }, { "Sid" : "SQS", "Effect" : "Allow", "Action" : [ "sqs:ListQueues" ], "Resource" : "*" }, { "Sid" : "CloudWatchLogsDeleteSubscriptionFilter", "Effect" : "Allow", "Action" : [ "logs:DeleteSubscriptionFilter" ], "Resource" : [ "arn:aws:logs:*:*:log-group:*" ] }, { "Sid" : "CloudWatchLogsCreateSubscriptionFilter", "Effect" : "Allow", "Action" : [ "logs:PutSubscriptionFilter" ], "Resource" : [ "arn:aws:logs:*:*:log-group:*", "arn:aws:logs:*:*:destination:AmazonCloudWatch-ApplicationInsights-LogIngestionDestination*" ] }, { "Sid" : "EFS", "Effect" : "Allow", "Action" : [ "elasticfilesystem:DescribeFileSystems" ], "Resource" : [ "*" ] }, { "Sid" : "Route53", "Effect" : "Allow", "Action" : [ "route53:GetHostedZone", "route53:GetHealthCheck", "route53:ListHostedZones", "route53:ListHealthChecks", "route53:ListQueryLoggingConfigs" ], "Resource" : [ "*" ] }, { "Sid" : "Route53Resolver", "Effect" : "Allow", "Action" : [ "route53resolver:ListFirewallRuleGroupAssociations", "route53resolver:GetFirewallRuleGroup", "route53resolver:ListFirewallRuleGroups", "route53resolver:ListResolverEndpoints", "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations", "route53resolver:GetResolverEndpoint", "route53resolver:GetFirewallRuleGroupAssociation" ], "Resource" : [ "*" ] } ] } ``` ## 了解更多信息 + [了解 IAM policy 版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略，转向最低权限权限](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)