本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。 # DevOps Agent IAM 許可 AWS DevOps Agent 使用服務特定的 AWS Identity and Access Management (IAM) 動作來控制對其功能和功能的存取。這些動作決定使用者可以在 AWS DevOps Agent 主控台和 Operator Web 應用程式中執行的動作。這與代理程式本身用來調查 資源 AWS 的服務 API 許可不同。 如需限制客服人員存取的詳細資訊，請參閱[在 AWS 帳戶中限制客服人員存取。](https://docs.aws.amazon.com/devopsagent/latest/userguide/aws-devops-agent-security-limiting-agent-access-in-an-aws-account.html) ## 客服人員空間管理動作 這些動作控制對 Agent Space 組態和管理的存取： + **aidevops：GetAgentSpace** – 允許使用者檢視客服人員空間的詳細資訊，包括其組態、狀態和相關聯的帳戶。使用者需要此許可才能在 AWS 管理主控台中存取 代理程式空間。 + **aidevops：GetAssociation** – 允許使用者檢視特定帳戶關聯的詳細資訊，包括 IAM 角色組態和連線狀態。 + **aidevops：ListAssociations** – 允許使用者列出為客服人員空間設定的所有 AWS 帳戶關聯，包括主要和次要帳戶。 ## 調查和執行動作 這些動作控制對事件調查功能的存取： + **aidevops：ListExecutions** – 允許使用者檢視執行中繼資料，包括 ID、狀態等，以進行與任務相關聯的調查、緩解、評估和聊天對話。 + **aidevops：ListJournalRecords** – 允許使用者存取詳細日誌，其中顯示客服人員在調查、緩解、評估和聊天對話期間所諮詢的推理步驟、採取的動作和資料來源。這有助於了解客服人員如何得出結論。 ## 聊天管理動作 Chat 需要下列 IAM 許可才能運作： + **aidevops：ListChats** – 允許使用者列出和存取聊天對話歷史記錄。 + **aidevops：CreateChat** – 允許使用者建立新的聊天對話。 + **aidevops：SendMessage** – 允許使用者提交查詢並接收串流回應。 ## 拓撲和探索動作 這些動作控制對應用程式資源映射功能的存取： + **aidevops：DiscoverTopology** – 允許使用者觸發代理程式空間的拓撲探索和映射。此動作會啟動掃描 AWS 帳戶和建置應用程式資源拓撲的程序。 ## 預防和建議動作 這些動作控制對預防功能的存取： + **aidevops：ListGoals** – 允許使用者根據最近的事件模式，檢視客服人員正在努力的預防目標。 + **aidevops：ListRecommendations** – 允許使用者檢視預防功能產生的所有建議，包括其優先順序和類別。 + **aidevops：GetRecommendation** – 允許使用者檢視特定建議的詳細資訊，包括其會阻止的事件和實作指引。 ## 待處理項目任務管理動作 這些動作可控制將建議管理為待處理任務的能力： + **aidevops：CreateBacklogTask** – 允許使用者建立事件調查或預防評估任務。 + **aidevops：UpdateBacklogTask** – 允許使用者核准緩解計劃或取消主動調查或評估。 + **aidevops：GetBacklogTask** – 允許使用者擷取特定任務的詳細資訊。 + **aidevops：ListBacklogTasks** – 允許使用者列出代理程式空間的任務，依任務類型、狀態、優先順序或建立時間篩選。 ## 知識管理動作 這些動作可控制新增和管理代理程式在調查期間可以使用的自訂知識的能力： + **aidevops：CreateKnowledgeItem** – 允許使用者新增自訂知識項目，例如技能、故障診斷指南或客服人員應參考的應用程式特定資訊。 + **aidevops：ListKnowledgeItems** – 允許使用者檢視為客服人員空間設定的所有知識項目。 + **aidevops：GetKnowledgeItem** – 允許使用者擷取特定知識項目的詳細資訊。 + **aidevops：UpdateKnowledgeItem** – 允許使用者修改現有知識項目，以保持資訊為最新狀態。 + **aidevops：DeleteKnowledgeItem** – 允許使用者移除不再相關的知識項目。 ## AWS 支援整合動作 這些動作會控制與 AWS 支援案例的整合： + **aidevops：InitiateChatForCase** – 允許使用者直接從調查中使用 AWS Support 啟動聊天工作階段，並自動提供有關事件的內容。 + **aidevops：EndChatForCase** – 允許使用者結束作用中的 AWS 支援案例聊天工作階段。 + **aidevops：DescribeSupportLevel** – 允許使用者檢查帳戶的 AWS 支援計劃層級，以判斷可用的支援選項。 ## 用量和監控動作 這些動作會控制對用量資訊的存取： + **aidevops：GetAccountUsage** – 允許使用者檢視調查時數、預防評估時數和聊天請求的 AWS DevOps 代理程式每月配額，以及當月的用量。 ## 常見的 IAM 政策範例 ### 管理員政策 此政策授予 all AWS DevOps Agent 功能的完整存取權： ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "aidevops:*", "Resource": "*" } ] } ``` ### 運算子政策 此政策授予沒有管理功能的調查和預防功能的存取權： ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aidevops:GetAgentSpace", "aidevops:InvokeAgent", "aidevops:ListExecutions", "aidevops:ListJournalRecords", "aidevops:ListAssociations", "aidevops:GetAssociation", "aidevops:DiscoverTopology", "aidevops:ListRecommendations", "aidevops:GetRecommendation", "aidevops:CreateBacklogTask", "aidevops:UpdateBacklogTask", "aidevops:GetBacklogTask", "aidevops:ListBacklogTasks", "aidevops:ListKnowledgeItems", "aidevops:GetKnowledgeItem", "aidevops:InitiateChatForCase", "aidevops:EndChatForCase", "aidevops:ListChats", "aidevops:CreateChat", "aidevops:SendMessage", "aidevops:ListGoals", "aidevops:CreateKnowledgeItem", "aidevops:UpdateKnowledgeItem", "aidevops:DescribeSupportLevel", "aidevops:ListPendingMessages" ], "Resource": "*" } ] } ``` ### 唯讀政策 此政策授予僅檢視的調查和建議存取權： ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "aidevops:GetAgentSpace", "aidevops:ListAssociations", "aidevops:GetAssociation", "aidevops:ListExecutions", "aidevops:ListJournalRecords", "aidevops:ListRecommendations", "aidevops:GetRecommendation", "aidevops:ListBacklogTasks", "aidevops:GetBacklogTask", "aidevops:ListKnowledgeItems", "aidevops:GetKnowledgeItem", "aidevops:GetAccountUsage" ], "Resource": "*" } ] } ``` ## 使用適用於 AWS DevOps 代理程式的服務連結角色 AWS DevOps 代理程式使用 AWS Identity and Access Management (IAM) [服務連結角色](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html)。服務連結角色是直接連結至 AWS DevOps 代理程式的唯一 IAM 角色類型。服務連結角色由 AWS DevOps Agent 預先定義，並包含該服務代表您呼叫其他 AWS 服務所需的所有許可。 ### 服務連結角色許可 `AWSServiceRoleForAIDevOps` 服務連結角色信任 `aidevops.amazonaws.com` 服務委託人來擔任角色。 角色使用`AWSServiceRoleForAIDevOpsPolicy`具有下列許可的 受管政策： + `cloudwatch:PutMetricData` – 將用量指標發佈至 `AWS/AIDevOps` CloudWatch 命名空間。受`cloudwatch:namespace`條件限制，只允許`AWS/AIDevOps`命名空間。 + `vpc-lattice:CreateResourceGateway` – 建立私有連線的 VPC Lattice 資源閘道。受 `aws:RequestTag/AWSAIDevOpsManaged`條件限制，因此服務只能建立帶有 `AWSAIDevOpsManaged`標籤的資源閘道。 + `vpc-lattice:TagResource` – 標記 VPC Lattice 資源閘道。由 `aws:RequestTag/AWSAIDevOpsManaged`條件範圍。 + `vpc-lattice:DeleteResourceGateway` – 刪除 VPC Lattice 資源閘道。受 `aws:ResourceTag/AWSAIDevOpsManaged`條件限制，因此服務只能刪除其建立的資源閘道。 + `vpc-lattice:GetResourceGateway` – 擷取 VPC Lattice 資源閘道的相關資訊。受 `aws:ResourceTag/AWSAIDevOpsManaged`條件限制，因此服務只能讀取其建立的資源閘道。 + `ec2:DescribeVpcs`、`ec2:DescribeSubnets`、 `ec2:DescribeSecurityGroups` – 擷取設定資源閘道所需的 VPC 聯網資源相關資訊。這些唯讀動作適用於所有 VPC 資源，因為 EC2 API 不支援描述呼叫的資源層級許可。 + `iam:CreateServiceLinkedRole` – 建立資源閘道操作所需的 VPC Lattice 服務連結角色。此許可僅限於`vpc-lattice.amazonaws.com`服務主體，不能用於為任何其他服務建立服務連結角色。 ### 建立 服務連結角色 您不需要手動建立 `AWSServiceRoleForAIDevOps` 服務連結角色。當您開始使用 AWS DevOps Agent 時，服務會為您建立服務連結角色。 若要允許服務代表您建立角色，您必須擁有 `iam:CreateServiceLinkedRole`許可。建議使用 `iam:AWSServiceName`條件來限定此許可`aidevops.amazonaws.com`，以便 遵循最低權限原則。如需更多資訊，請參閱[服務連結角色許可權限](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#service-linked-role-permissions)。 ### 編輯 服務連結角色 您不能編輯 `AWSServiceRoleForAIDevOps` 服務連結角色。建立角色之後，您無法變更角色的名稱，因為各種實體可能會依名稱參考角色。然而，您可使用 IAM 來編輯角色描述。如需詳細資訊，請參閱[編輯服務連結角色](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#edit-service-linked-role)。 ### 刪除 服務連結角色 如果您不再需要使用 AWS DevOps Agent，我們建議您刪除`AWSServiceRoleForAIDevOps`服務連結角色。您必須先移除在客服人員空間中設定的任何私有連線，才能刪除角色。刪除服務連結角色不會自動移除先前由服務建立`AWSAIDevOpsManaged`、以 標記的 VPC Lattice 資源閘道。如果不再需要這些資源閘道，您應該手動將其刪除。如需詳細資訊，請參閱[刪除服務連結角色](https://docs.aws.amazon.com/IAM/latest/UserGuide/using-service-linked-roles.html#delete-service-linked-role)。 ## AWS 適用於 AWS DevOps 代理程式的受管政策 AWS 透過提供由 建立和管理的獨立 IAM 政策，解決許多常見的使用案例 AWS。這些 AWS 受管政策會授予常見使用案例的必要許可，讓您不必調查需要哪些許可。如需詳細資訊，請參閱《\$1IAM 使用者指南》中的 [AWS 受管政策](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 下列 AWS 受管政策是 AWS DevOps Agent 特有的，您可以連接到您帳戶中的使用者。 ### AIDevOpsAgentReadOnlyAccess 透過 AWS 管理主控台提供 Amazon DevOps 代理程式的唯讀存取權 ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "AIDevOpsAgentReadOnlyAccess", "Effect": "Allow", "Action": [ "aidevops:Get*", "aidevops:List*", "aidevops:SearchServiceAccessibleResource" ], "Resource": "*" } ] } ``` ### AIDevOpsAgentFullAccess 透過 AWS 管理主控台提供 Amazon DevOps 代理程式的完整存取權 ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "AIDevOpsAgentSpaceAccess", "Effect": "Allow", "Action": [ "aidevops:CreateAgentSpace", "aidevops:DeleteAgentSpace", "aidevops:GetAgentSpace", "aidevops:ListAgentSpaces", "aidevops:UpdateAgentSpace" ], "Resource": "*" }, { "Sid": "AIDevOpsServiceAccess", "Effect": "Allow", "Action": [ "aidevops:DeregisterService", "aidevops:GetService", "aidevops:ListServices", "aidevops:RegisterService", "aidevops:SearchServiceAccessibleResource" ], "Resource": "*" }, { "Sid": "AIDevOpsAssociationAccess", "Effect": "Allow", "Action": [ "aidevops:AssociateService", "aidevops:DisassociateService", "aidevops:GetAssociation", "aidevops:ListAssociations", "aidevops:UpdateAssociation", "aidevops:ValidateAwsAssociations" ], "Resource": "*" }, { "Sid": "AIDevOpsWebhookAccess", "Effect": "Allow", "Action": [ "aidevops:ListWebhooks" ], "Resource": "*" }, { "Sid": "AIDevOpsOperatorAppAccess", "Effect": "Allow", "Action": [ "aidevops:DisableOperatorApp", "aidevops:EnableOperatorApp", "aidevops:GetOperatorApp", "aidevops:UpdateOperatorAppIdpConfig" ], "Resource": "*" }, { "Sid": "AIDevOpsKnowledgeAccess", "Effect": "Allow", "Action": [ "aidevops:CreateKnowledgeItem", "aidevops:DeleteKnowledgeItem", "aidevops:GetKnowledgeItem", "aidevops:ListKnowledgeItems", "aidevops:ListKnowledgeItemVersions", "aidevops:UpdateKnowledgeItem" ], "Resource": "*" }, { "Sid": "AIDevOpsBacklogAccess", "Effect": "Allow", "Action": [ "aidevops:CreateBacklogTask", "aidevops:GetBacklogTask", "aidevops:ListBacklogTasks", "aidevops:ListGoals", "aidevops:UpdateBacklogTask", "aidevops:UpdateGoal" ], "Resource": "*" }, { "Sid": "AIDevOpsRecommendationAccess", "Effect": "Allow", "Action": [ "aidevops:GetRecommendation", "aidevops:ListRecommendations", "aidevops:UpdateRecommendation" ], "Resource": "*" }, { "Sid": "AIDevOpsAgentChatAccess", "Effect": "Allow", "Action": [ "aidevops:CreateChat", "aidevops:ListChats", "aidevops:ListPendingMessages", "aidevops:SendMessage" ], "Resource": "*" }, { "Sid": "AIDevOpsJournalAccess", "Effect": "Allow", "Action": [ "aidevops:ListExecutions", "aidevops:ListJournalRecords" ], "Resource": "*" }, { "Sid": "AIDevOpsTopologyAccess", "Effect": "Allow", "Action": [ "aidevops:DiscoverTopology" ], "Resource": "*" }, { "Sid": "AIDevOpsSupportAccess", "Effect": "Allow", "Action": [ "aidevops:DescribeSupportLevel", "aidevops:EndChatForCase", "aidevops:InitiateChatForCase" ], "Resource": "*" }, { "Sid": "AIDevOpsUsageAccess", "Effect": "Allow", "Action": [ "aidevops:GetAccountUsage" ], "Resource": "*" }, { "Sid": "AIDevOpsTaggingAccess", "Effect": "Allow", "Action": [ "aidevops:ListTagsForResource", "aidevops:TagResource", "aidevops:UntagResource" ], "Resource": "*" }, { "Sid": "AIDevOpsVendedLogs", "Effect": "Allow", "Action": [ "aidevops:AllowVendedLogDeliveryForResource" ], "Resource": "*" } ] } ``` ### AIDevOpsOperatorAppAccessPolicy 提供對 代理程式空間使用 AWS DevOps 運算子 Web 應用程式的存取權。 ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowOperatorAgentSpaceActions", "Effect": "Allow", "Action": [ "aidevops:GetAgentSpace", "aidevops:GetAssociation", "aidevops:ListAssociations", "aidevops:CreateBacklogTask", "aidevops:GetBacklogTask", "aidevops:UpdateBacklogTask", "aidevops:ListBacklogTasks", "aidevops:ListJournalRecords", "aidevops:DiscoverTopology", "aidevops:ListGoals", "aidevops:ListRecommendations", "aidevops:ListExecutions", "aidevops:GetRecommendation", "aidevops:UpdateRecommendation", "aidevops:CreateKnowledgeItem", "aidevops:ListKnowledgeItems", "aidevops:ListKnowledgeItemVersions", "aidevops:GetKnowledgeItem", "aidevops:UpdateKnowledgeItem", "aidevops:DeleteKnowledgeItem", "aidevops:ListPendingMessages", "aidevops:InitiateChatForCase", "aidevops:EndChatForCase", "aidevops:DescribeSupportLevel", "aidevops:ListChats", "aidevops:CreateChat", "aidevops:SendMessage" ], "Resource": "arn:aws:aidevops:*:*:agentspace/${aws:PrincipalTag/AgentSpaceId}", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowOperatorAccountActions", "Effect": "Allow", "Action": [ "aidevops:GetAccountUsage" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSupportOperatorActions", "Effect": "Allow", "Action": [ "support:DescribeCases", "support:InitiateChatForCase", "support:DescribeSupportLevel" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } ``` ### AIDevOpsAgentAccessPolicy 提供 AWS DevOps 代理程式執行調查和分析客戶 AWS 資源所需的許可。 ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "AIOPSServiceAccess", "Effect": "Allow", "Action": [ "access-analyzer:GetAnalyzer", "access-analyzer:List*", "acm-pca:Describe*", "acm-pca:GetCertificate", "acm-pca:GetCertificateAuthorityCertificate", "acm-pca:GetCertificateAuthorityCsr", "acm-pca:List*", "acm:DescribeCertificate", "acm:GetAccountConfiguration", "aidevops:GetKnowledgeItem", "aidevops:ListKnowledgeItems", "airflow:List*", "amplify:GetApp", "amplify:GetBranch", "amplify:GetDomainAssociation", "amplify:List*", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "aoss:BatchGetVpcEndpoint", "aoss:GetAccessPolicy", "aoss:GetSecurityConfig", "aoss:GetSecurityPolicy", "aoss:List*", "appconfig:GetApplication", "appconfig:GetConfigurationProfile", "appconfig:GetEnvironment", "appconfig:GetHostedConfigurationVersion", "appconfig:List*", "appflow:Describe*", "appflow:List*", "application-autoscaling:Describe*", "application-signals:BatchGetServiceLevelObjectiveBudgetReport", "application-signals:GetService", "application-signals:GetServiceLevelObjective", "application-signals:List*", "applicationinsights:Describe*", "applicationinsights:List*", "apprunner:Describe*", "apprunner:List*", "appstream:Describe*", "appstream:List*", "appsync:GetApiAssociation", "appsync:GetDataSource", "appsync:GetDomainName", "appsync:GetFunction", "appsync:GetGraphqlApi", "appsync:GetGraphqlApiEnvironmentVariables", "appsync:GetIntrospectionSchema", "appsync:GetResolver", "appsync:GetSourceApiAssociation", "appsync:List*", "aps:Describe*", "aps:List*", "arc-zonal-shift:GetManagedResource", "arc-zonal-shift:List*", "athena:GetCapacityAssignmentConfiguration", "athena:GetCapacityReservation", "athena:GetDataCatalog", "athena:GetNamedQuery", "athena:GetPreparedStatement", "athena:GetWorkGroup", "athena:List*", "auditmanager:GetAssessment", "auditmanager:List*", "autoscaling:Describe*", "backup-gateway:GetHypervisor", "backup-gateway:List*", "backup:Describe*", "backup:GetBackupPlan", "backup:GetBackupSelection", "backup:GetBackupVaultAccessPolicy", "backup:GetBackupVaultNotifications", "backup:GetRestoreTestingPlan", "backup:GetRestoreTestingSelection", "backup:List*", "batch:DescribeComputeEnvironments", "batch:DescribeJobQueues", "batch:DescribeSchedulingPolicies", "batch:List*", "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentAlias", "bedrock:GetAgentKnowledgeBase", "bedrock:GetDataSource", "bedrock:GetGuardrail", "bedrock:GetKnowledgeBase", "bedrock:List*", "budgets:Describe*", "budgets:List*", "ce:Describe*", "ce:GetAnomalyMonitors", "ce:GetAnomalySubscriptions", "ce:List*", "chatbot:Describe*", "chatbot:GetMicrosoftTeamsChannelConfiguration", "chatbot:List*", "cleanrooms-ml:GetTrainingDataset", "cleanrooms-ml:List*", "cleanrooms:GetAnalysisTemplate", "cleanrooms:GetCollaboration", "cleanrooms:GetConfiguredTable", "cleanrooms:GetConfiguredTableAnalysisRule", "cleanrooms:GetConfiguredTableAssociation", "cleanrooms:GetMembership", "cleanrooms:List*", "cloudformation:Describe*", "cloudformation:GetResource", "cloudformation:GetStackPolicy", "cloudformation:GetTemplate", "cloudformation:List*", "cloudfront:Describe*", "cloudfront:GetCachePolicy", "cloudfront:GetCloudFrontOriginAccessIdentity", "cloudfront:GetContinuousDeploymentPolicy", "cloudfront:GetDistribution", "cloudfront:GetDistributionConfig", "cloudfront:GetFunction", "cloudfront:GetKeyGroup", "cloudfront:GetMonitoringSubscription", "cloudfront:GetOriginAccessControl", "cloudfront:GetOriginRequestPolicy", "cloudfront:GetPublicKey", "cloudfront:GetRealtimeLogConfig", "cloudfront:GetResponseHeadersPolicy", "cloudfront:List*", "cloudtrail:Describe*", "cloudtrail:GetChannel", "cloudtrail:GetEventConfiguration", "cloudtrail:GetEventDataStore", "cloudtrail:GetEventSelectors", "cloudtrail:GetInsightSelectors", "cloudtrail:GetQueryResults", "cloudtrail:GetResourcePolicy", "cloudtrail:GetTrail", "cloudtrail:GetTrailStatus", "cloudtrail:List*", "cloudtrail:LookupEvents", "cloudtrail:StartQuery", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:GetDashboard", "cloudwatch:GetInsightRuleReport", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:GetMetricStream", "cloudwatch:GetService", "cloudwatch:GetServiceLevelObjective", "cloudwatch:List*", "codeartifact:Describe*", "codeartifact:GetDomainPermissionsPolicy", "codeartifact:GetRepositoryPermissionsPolicy", "codeartifact:List*", "codebuild:BatchGetFleets", "codebuild:List*", "codecommit:GetRepository", "codecommit:GetRepositoryTriggers", "codedeploy:BatchGetDeployments", "codedeploy:BatchGetDeploymentTargets", "codedeploy:GetApplication", "codedeploy:GetDeploymentConfig", "codedeploy:GetDeploymentTarget", "codedeploy:List*", "codeguru-profiler:Describe*", "codeguru-profiler:GetNotificationConfiguration", "codeguru-profiler:GetPolicy", "codeguru-profiler:List*", "codeguru-reviewer:Describe*", "codeguru-reviewer:List*", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:List*", "codestar-connections:GetConnection", "codestar-connections:GetRepositoryLink", "codestar-connections:GetSyncConfiguration", "codestar-connections:List*", "codestar-notifications:Describe*", "codestar-notifications:List*", "cognito-identity:DescribeIdentityPool", "cognito-identity:GetIdentityPoolRoles", "cognito-identity:ListIdentityPools", "cognito-identity:ListTagsForResource", "cognito-idp:AdminListGroupsForUser", "cognito-idp:DescribeIdentityProvider", "cognito-idp:DescribeResourceServer", "cognito-idp:DescribeRiskConfiguration", "cognito-idp:DescribeUserImportJob", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolDomain", "cognito-idp:GetGroup", "cognito-idp:GetLogDeliveryConfiguration", "cognito-idp:GetUICustomization", "cognito-idp:GetUserPoolMfaConfig", "cognito-idp:GetWebACLForResource", "cognito-idp:ListGroups", "cognito-idp:ListIdentityProviders", "cognito-idp:ListResourceServers", "cognito-idp:ListUserPoolClients", "cognito-idp:ListUserPools", "cognito-idp:ListTagsForResource", "comprehend:Describe*", "comprehend:List*", "config:Describe*", "config:GetStoredQuery", "config:List*", "connect:Describe*", "connect:GetTaskTemplate", "connect:List*", "databrew:Describe*", "databrew:List*", "datapipeline:Describe*", "datapipeline:GetPipelineDefinition", "datapipeline:List*", "datasync:Describe*", "datasync:List*", "deadline:GetFarm", "deadline:GetFleet", "deadline:GetLicenseEndpoint", "deadline:GetMonitor", "deadline:GetQueue", "deadline:GetQueueEnvironment", "deadline:GetQueueFleetAssociation", "deadline:GetStorageProfile", "deadline:List*", "detective:GetMembers", "detective:List*", "devicefarm:GetDevicePool", "devicefarm:GetInstanceProfile", "devicefarm:GetNetworkProfile", "devicefarm:GetProject", "devicefarm:GetTestGridProject", "devicefarm:GetVPCEConfiguration", "devicefarm:List*", "devops-guru:Describe*", "devops-guru:GetResourceCollection", "devops-guru:List*", "dms:Describe*", "dms:List*", "ds:Describe*", "dynamodb:Describe*", "dynamodb:GetResourcePolicy", "dynamodb:List*", "ec2:Describe*", "ec2:GetAssociatedEnclaveCertificateIamRoles", "ec2:GetIpamPoolAllocations", "ec2:GetIpamPoolCidrs", "ec2:GetManagedPrefixListEntries", "ec2:GetNetworkInsightsAccessScopeContent", "ec2:GetSnapshotBlockPublicAccessState", "ec2:GetTransitGatewayMulticastDomainAssociations", "ec2:GetTransitGatewayRouteTableAssociations", "ec2:GetTransitGatewayRouteTablePropagations", "ec2:GetVerifiedAccessEndpointPolicy", "ec2:GetVerifiedAccessGroupPolicy", "ec2:GetVerifiedAccessInstanceWebAcl", "ec2:SearchLocalGatewayRoutes", "ec2:SearchTransitGatewayRoutes", "ecr:Describe*", "ecr:GetLifecyclePolicy", "ecr:GetRegistryPolicy", "ecr:GetRepositoryPolicy", "ecr:List*", "ecs:Describe*", "ecs:List*", "eks:AccessKubernetesApi", "eks:Describe*", "eks:List*", "elasticache:Describe*", "elasticache:List*", "elasticbeanstalk:Describe*", "elasticbeanstalk:List*", "elasticfilesystem:Describe*", "elasticloadbalancing:GetResourcePolicy", "elasticloadbalancing:GetTrustStoreCaCertificatesBundle", "elasticloadbalancing:GetTrustStoreRevocationContent", "elasticloadbalancing:Describe*", "elasticmapreduce:Describe*", "elasticmapreduce:List*", "emr-containers:Describe*", "emr-containers:List*", "emr-serverless:GetApplication", "emr-serverless:List*", "es:Describe*", "es:List*", "events:Describe*", "events:List*", "evidently:GetExperiment", "evidently:GetFeature", "evidently:GetLaunch", "evidently:GetProject", "evidently:GetSegment", "evidently:List*", "firehose:Describe*", "firehose:List*", "fis:GetExperimentTemplate", "fis:GetTargetAccountConfiguration", "fis:List*", "fms:GetNotificationChannel", "fms:GetPolicy", "fms:List*", "forecast:Describe*", "forecast:List*", "frauddetector:BatchGetVariable", "frauddetector:Describe*", "frauddetector:GetDetectors", "frauddetector:GetDetectorVersion", "frauddetector:GetEntityTypes", "frauddetector:GetEventTypes", "frauddetector:GetExternalModels", "frauddetector:GetLabels", "frauddetector:GetListElements", "frauddetector:GetListsMetadata", "frauddetector:GetModelVersion", "frauddetector:GetOutcomes", "frauddetector:GetRules", "frauddetector:GetVariables", "frauddetector:List*", "fsx:Describe*", "gamelift:Describe*", "gamelift:List*", "globalaccelerator:Describe*", "globalaccelerator:List*", "glue:GetDatabase", "glue:GetDatabases", "glue:GetJob", "glue:GetRegistry", "glue:GetSchema", "glue:GetSchemaVersion", "glue:GetTable", "glue:GetTags", "glue:GetTrigger", "glue:List*", "glue:querySchemaVersionMetadata", "grafana:Describe*", "grafana:List*", "greengrass:Describe*", "greengrass:GetDeployment", "greengrass:List*", "groundstation:GetConfig", "groundstation:GetDataflowEndpointGroup", "groundstation:GetMissionProfile", "groundstation:List*", "guardduty:GetDetector", "guardduty:GetFilter", "guardduty:GetIPSet", "guardduty:GetMalwareProtectionPlan", "guardduty:GetMasterAccount", "guardduty:GetMembers", "guardduty:GetThreatIntelSet", "guardduty:List*", "health:DescribeEvents", "health:DescribeEventDetails", "healthlake:Describe*", "healthlake:List*", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetInstanceProfile", "iam:GetLoginProfile", "iam:GetOpenIDConnectProvider", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRole", "iam:GetRolePolicy", "iam:GetSAMLProvider", "iam:GetServerCertificate", "iam:GetServiceLinkedRoleDeletionStatus", "iam:GetUser", "iam:GetUserPolicy", "iam:ListAttachedRolePolicies", "iam:ListOpenIDConnectProviders", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListServerCertificates", "iam:ListVirtualMFADevices", "identitystore:DescribeGroup", "identitystore:DescribeGroupMembership", "identitystore:ListGroupMemberships", "identitystore:ListGroups", "imagebuilder:GetComponent", "imagebuilder:GetContainerRecipe", "imagebuilder:GetDistributionConfiguration", "imagebuilder:GetImage", "imagebuilder:GetImagePipeline", "imagebuilder:GetImageRecipe", "imagebuilder:GetInfrastructureConfiguration", "imagebuilder:GetLifecyclePolicy", "imagebuilder:GetWorkflow", "imagebuilder:List*", "inspector2:List*", "inspector:Describe*", "inspector:List*", "internetmonitor:GetMonitor", "internetmonitor:List*", "iot:Describe*", "iot:GetPackage", "iot:GetPackageVersion", "iot:GetPolicy", "iot:GetThingShadow", "iot:GetTopicRule", "iot:GetTopicRuleDestination", "iot:GetV2LoggingOptions", "iot:List*", "iotanalytics:Describe*", "iotanalytics:List*", "iotevents:Describe*", "iotevents:List*", "iotsitewise:Describe*", "iotsitewise:List*", "iotwireless:GetDestination", "iotwireless:GetDeviceProfile", "iotwireless:GetFuotaTask", "iotwireless:GetMulticastGroup", "iotwireless:GetNetworkAnalyzerConfiguration", "iotwireless:GetServiceProfile", "iotwireless:GetWirelessDevice", "iotwireless:GetWirelessGateway", "iotwireless:GetWirelessGatewayTaskDefinition", "iotwireless:List*", "ivs:GetChannel", "ivs:GetEncoderConfiguration", "ivs:GetPlaybackRestrictionPolicy", "ivs:GetRecordingConfiguration", "ivs:GetStage", "ivs:List*", "ivschat:GetLoggingConfiguration", "ivschat:GetRoom", "ivschat:List*", "kafka:Describe*", "kafka:GetClusterPolicy", "kafka:List*", "kafkaconnect:Describe*", "kafkaconnect:List*", "kendra:Describe*", "kendra:List*", "kinesis:Describe*", "kinesis:GetResourcePolicy", "kinesis:List*", "kinesisanalytics:Describe*", "kinesisanalytics:List*", "kinesisvideo:Describe*", "kms:DescribeKey", "kms:ListResourceTags", "kms:ListKeys", "kms:GetKeyPolicy", "kms:GetKeyRotationStatus", "kms:ListAliases", "kms:ListKeyRotations", "lakeformation:Describe*", "lakeformation:GetLFTag", "lakeformation:GetResourceLFTags", "lakeformation:List*", "lambda:GetAlias", "lambda:GetCodeSigningConfig", "lambda:GetEventSourceMapping", "lambda:GetFunctionCodeSigningConfig", "lambda:GetFunctionConfiguration", "lambda:GetFunctionEventInvokeConfig", "lambda:GetFunctionRecursionConfig", "lambda:GetFunctionUrlConfig", "lambda:GetLayerVersion", "lambda:GetLayerVersionPolicy", "lambda:GetPolicy", "lambda:GetProvisionedConcurrencyConfig", "lambda:GetRuntimeManagementConfig", "lambda:List*", "launchwizard:GetDeployment", "launchwizard:List*", "license-manager:GetLicense", "license-manager:List*", "lightsail:GetAlarms", "lightsail:GetBuckets", "lightsail:GetCertificates", "lightsail:GetContainerServices", "lightsail:GetDisk", "lightsail:GetDisks", "lightsail:GetInstance", "lightsail:GetInstances", "lightsail:GetLoadBalancer", "lightsail:GetLoadBalancers", "lightsail:GetLoadBalancerTlsCertificates", "lightsail:GetStaticIp", "lightsail:GetStaticIps", "logs:Describe*", "logs:FilterLogEvents", "logs:GetDataProtectionPolicy", "logs:GetDelivery", "logs:GetDeliveryDestination", "logs:GetDeliveryDestinationPolicy", "logs:GetDeliverySource", "logs:GetLogAnomalyDetector", "logs:GetLogDelivery", "logs:GetLogGroupFields", "logs:GetQueryResults", "logs:List*", "logs:StartQuery", "logs:StopLiveTail", "logs:StopQuery", "logs:TestMetricFilter", "m2:GetApplication", "m2:GetEnvironment", "m2:List*", "macie2:GetAllowList", "macie2:GetCustomDataIdentifier", "macie2:GetFindingsFilter", "macie2:GetMacieSession", "macie2:List*", "mediaconnect:Describe*", "mediaconnect:List*", "medialive:Describe*", "medialive:GetCloudWatchAlarmTemplate", "medialive:GetCloudWatchAlarmTemplateGroup", "medialive:GetEventBridgeRuleTemplate", "medialive:GetEventBridgeRuleTemplateGroup", "medialive:GetSignalMap", "medialive:List*", "mediapackage-vod:Describe*", "mediapackage-vod:List*", "mediapackage:Describe*", "mediapackage:List*", "mediapackagev2:GetChannel", "mediapackagev2:GetChannelGroup", "mediapackagev2:GetChannelPolicy", "mediapackagev2:GetOriginEndpoint", "mediapackagev2:GetOriginEndpointPolicy", "mediapackagev2:List*", "memorydb:Describe*", "memorydb:List*", "mobiletargeting:GetInAppTemplate", "mobiletargeting:List*", "mq:Describe*", "mq:List*", "network-firewall:Describe*", "network-firewall:List*", "networkmanager:Describe*", "networkmanager:GetConnectAttachment", "networkmanager:GetConnectPeer", "networkmanager:GetCoreNetwork", "networkmanager:GetCoreNetworkPolicy", "networkmanager:GetCustomerGatewayAssociations", "networkmanager:GetDevices", "networkmanager:GetLinkAssociations", "networkmanager:GetLinks", "networkmanager:GetSites", "networkmanager:GetSiteToSiteVpnAttachment", "networkmanager:GetTransitGatewayPeering", "networkmanager:GetTransitGatewayRegistrations", "networkmanager:GetTransitGatewayRouteTableAttachment", "networkmanager:GetVpcAttachment", "networkmanager:List*", "oam:GetLink", "oam:GetSink", "oam:GetSinkPolicy", "oam:List*", "omics:GetAnnotationStore", "omics:GetReferenceStore", "omics:GetRunGroup", "omics:GetSequenceStore", "omics:GetVariantStore", "omics:GetWorkflow", "omics:List*", "organizations:Describe*", "organizations:List*", "osis:GetPipeline", "osis:List*", "payment-cryptography:GetAlias", "payment-cryptography:GetKey", "payment-cryptography:List*", "pca-connector-ad:GetConnector", "pca-connector-ad:GetDirectoryRegistration", "pca-connector-ad:GetServicePrincipalName", "pca-connector-ad:GetTemplate", "pca-connector-ad:GetTemplateGroupAccessControlEntry", "pca-connector-ad:List*", "pca-connector-scep:GetChallengeMetadata", "pca-connector-scep:GetConnector", "pca-connector-scep:List*", "personalize:Describe*", "personalize:List*", "pi:DescribeDimensionKeys", "pi:GetResourceMetadata", "pi:GetResourceMetrics", "pi:ListAvailableResourceDimensions", "pi:ListAvailableResourceMetrics", "pipes:Describe*", "pipes:List*", "proton:GetEnvironmentTemplate", "proton:GetServiceTemplate", "proton:List*", "qbusiness:GetApplication", "qbusiness:GetDataSource", "qbusiness:GetIndex", "qbusiness:GetPlugin", "qbusiness:GetRetriever", "qbusiness:GetWebExperience", "qbusiness:List*", "ram:GetPermission", "ram:GetResourceShares", "ram:List*", "rds:Describe*", "rds:List*", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:List*", "redshift:Describe*", "refactor-spaces:GetApplication", "refactor-spaces:GetEnvironment", "refactor-spaces:GetRoute", "refactor-spaces:List*", "rekognition:Describe*", "rekognition:List*", "resiliencehub:Describe*", "resiliencehub:List*", "resource-explorer-2:GetDefaultView", "resource-explorer-2:GetIndex", "resource-explorer-2:GetView", "resource-explorer-2:List*", "resource-explorer-2:Search", "resource-groups:GetGroup", "resource-groups:GetGroupConfiguration", "resource-groups:GetGroupQuery", "resource-groups:GetTags", "resource-groups:List*", "route53-recovery-control-config:Describe*", "route53-recovery-control-config:List*", "route53-recovery-readiness:GetCell", "route53-recovery-readiness:GetReadinessCheck", "route53-recovery-readiness:GetRecoveryGroup", "route53-recovery-readiness:GetResourceSet", "route53-recovery-readiness:List*", "route53:GetDNSSEC", "route53:GetHealthCheck", "route53:GetHealthCheckStatus", "route53:GetHostedZone", "route53:List*", "route53profiles:GetProfile", "route53profiles:GetProfileAssociation", "route53profiles:GetProfileResourceAssociation", "route53profiles:List*", "route53resolver:GetFirewallDomainList", "route53resolver:GetFirewallRuleGroup", "route53resolver:GetFirewallRuleGroupAssociation", "route53resolver:GetOutpostResolver", "route53resolver:GetResolverConfig", "route53resolver:GetResolverQueryLogConfig", "route53resolver:GetResolverQueryLogConfigAssociation", "route53resolver:GetResolverRule", "route53resolver:GetResolverRuleAssociation", "route53resolver:List*", "rum:GetAppMonitor", "rum:List*", "s3-outposts:ListEndpoints", "s3-outposts:ListOutpostsWithS3", "s3:GetAccessGrant", "s3:GetAccessGrantsInstance", "s3:GetAccessGrantsLocation", "s3:GetAccessPoint", "s3:GetAccessPointConfigurationForObjectLambda", "s3:GetAccessPointForObjectLambda", "s3:GetAccessPointPolicy", "s3:GetAccessPointPolicyForObjectLambda", "s3:GetAccessPointPolicyStatusForObjectLambda", "s3:GetBucketAbac", "s3:GetBucketAcl", "s3:GetBucketCORS", "s3:GetBucketLocation", "s3:GetBucketLogging", "s3:GetBucketMetadataTableConfiguration", "s3:GetBucketNotification", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketOwnershipControls", "s3:GetBucketPolicy", "s3:GetBucketPublicAccessBlock", "s3:GetBucketTagging", "s3:GetBucketVersioning", "s3:GetEncryptionConfiguration", "s3:GetLifecycleConfiguration", "s3:GetMultiRegionAccessPoint", "s3:GetMultiRegionAccessPointPolicy", "s3:GetMultiRegionAccessPointPolicyStatus", "s3:GetReplicationConfiguration", "s3:GetStorageLensConfiguration", "s3:GetStorageLensConfigurationTagging", "s3:GetStorageLensGroup", "s3:ListAllMyBuckets", "sagemaker:Describe*", "sagemaker:List*", "scheduler:GetSchedule", "scheduler:GetScheduleGroup", "scheduler:List*", "schemas:Describe*", "schemas:GetResourcePolicy", "schemas:List*", "secretsmanager:Describe*", "secretsmanager:GetResourcePolicy", "secretsmanager:List*", "securityhub:BatchGetAutomationRules", "securityhub:BatchGetSecurityControls", "securityhub:Describe*", "securityhub:GetConfigurationPolicy", "securityhub:GetConfigurationPolicyAssociation", "securityhub:GetEnabledStandards", "securityhub:GetFindingAggregator", "securityhub:GetInsights", "securityhub:List*", "securitylake:GetSubscriber", "securitylake:List*", "servicecatalog:Describe*", "servicecatalog:GetApplication", "servicecatalog:GetAttributeGroup", "servicecatalog:List*", "servicequotas:GetServiceQuota", "ses:Describe*", "ses:GetAccount", "ses:GetAddonInstance", "ses:GetAddonSubscription", "ses:GetArchive", "ses:GetConfigurationSet", "ses:GetConfigurationSetEventDestinations", "ses:GetContactList", "ses:GetDedicatedIpPool", "ses:GetDedicatedIps", "ses:GetEmailIdentity", "ses:GetEmailTemplate", "ses:GetIngressPoint", "ses:GetRelay", "ses:GetRuleSet", "ses:GetTemplate", "ses:GetTrafficPolicy", "ses:List*", "shield:Describe*", "shield:List*", "signer:GetSigningProfile", "signer:List*", "sns:GetDataProtectionPolicy", "sns:GetSubscriptionAttributes", "sns:GetTopicAttributes", "sns:List*", "sqs:GetQueueAttributes", "sqs:GetQueueUrl", "sqs:List*", "ssm-contacts:GetContact", "ssm-contacts:GetContactChannel", "ssm-contacts:List*", "ssm-incidents:GetReplicationSet", "ssm-incidents:GetResponsePlan", "ssm-incidents:List*", "ssm-sap:GetApplication", "ssm-sap:List*", "ssm:Describe*", "ssm:GetDefaultPatchBaseline", "ssm:GetDocument", "ssm:GetParameters", "ssm:GetPatchBaseline", "ssm:GetResourcePolicies", "ssm:List*", "sso:GetInlinePolicyForPermissionSet", "sso:GetManagedApplicationInstance", "sso:GetPermissionsBoundaryForPermissionSet", "sso:GetSharedSsoConfiguration", "sso:ListAccountAssignments", "sso:ListApplicationAssignments", "sso:ListApplications", "sso:ListCustomerManagedPolicyReferencesInPermissionSet", "sso:ListInstances", "sso:ListManagedPoliciesInPermissionSet", "sso:ListTagsForResource", "states:GetExecutionHistory", "states:Describe*", "states:List*", "support:CreateCase", "support:DescribeCases", "synthetics:Describe*", "synthetics:GetCanary", "synthetics:GetCanaryRuns", "synthetics:GetGroup", "synthetics:List*", "tag:GetResources", "timestream:Describe*", "timestream:List*", "transfer:Describe*", "transfer:List*", "verifiedpermissions:GetIdentitySource", "verifiedpermissions:GetPolicy", "verifiedpermissions:GetPolicyStore", "verifiedpermissions:GetPolicyTemplate", "verifiedpermissions:GetSchema", "verifiedpermissions:List*", "vpc-lattice:GetAccessLogSubscription", "vpc-lattice:GetAuthPolicy", "vpc-lattice:GetListener", "vpc-lattice:GetResourcePolicy", "vpc-lattice:GetRule", "vpc-lattice:GetService", "vpc-lattice:GetServiceNetwork", "vpc-lattice:GetServiceNetworkServiceAssociation", "vpc-lattice:GetServiceNetworkVpcAssociation", "vpc-lattice:GetTargetGroup", "vpc-lattice:List*", "wafv2:GetIPSet", "wafv2:GetLoggingConfiguration", "wafv2:GetRegexPatternSet", "wafv2:GetRuleGroup", "wafv2:GetWebACL", "wafv2:GetWebACLForResource", "wafv2:List*", "workspaces-web:GetBrowserSettings", "workspaces-web:GetIdentityProvider", "workspaces-web:GetNetworkSettings", "workspaces-web:GetPortal", "workspaces-web:GetPortalServiceProviderMetadata", "workspaces-web:GetTrustStore", "workspaces-web:GetUserAccessLoggingSettings", "workspaces-web:GetUserSettings", "workspaces-web:List*", "workspaces:Describe*", "xray:BatchGetTraces", "xray:GetGroup", "xray:GetGroups", "xray:GetSamplingRules", "xray:GetServiceGraph", "xray:GetTraceSummaries", "xray:List*" ], "Resource": "*" }, { "Sid": "AIOPSAPIGatewayAccess", "Effect": "Allow", "Action": [ "apigateway:GET" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis/*/deployments", "arn:aws:apigateway:*::/restapis/*/deployments/*", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations", "arn:aws:apigateway:*::/restapis/*/resources/*/methods/*/integrations/*", "arn:aws:apigateway:*::/restapis/*/stages", "arn:aws:apigateway:*::/restapis/*/stages/*", "arn:aws:apigateway:*::/apis", "arn:aws:apigateway:*::/apis/*", "arn:aws:apigateway:*::/apis/*/deployments", "arn:aws:apigateway:*::/apis/*/deployments/*", "arn:aws:apigateway:*::/apis/*/integrations", "arn:aws:apigateway:*::/apis/*/integrations/*", "arn:aws:apigateway:*::/apis/*/stages", "arn:aws:apigateway:*::/apis/*/stages/*", "arn:aws:apigateway:*::/domainnames/*" ] } ] } ```