AWS 新一代彈性中樞的 受管政策

AWS 受管政策是由 建立和管理的獨立政策 AWS。 AWS 受管政策旨在為許多常用案例提供許可，以便您可以開始將許可指派給使用者、群組和角色。

請記住， AWS 受管政策可能不會授予特定使用案例的最低權限許可，因為這些許可可供所有 AWS 客戶使用。我們建議您定義特定於使用案例的客戶管理政策，以便進一步減少許可。

您無法變更 AWS 受管政策中定義的許可。如果 AWS 更新 AWS 受管政策中定義的許可，則更新會影響政策連接的所有委託人身分 （使用者、群組和角色）。當新 AWS 服務啟動或新 API 操作可用於現有服務時， AWS 最有可能更新 AWS 受管政策。

AWSResilienceHubV2AssessmentExecutionPolicy

您可以將 AWSResilienceHubV2AssessmentExecutionPolicy 連接至您的 IAM 身分。執行評估時，此政策會授予其他服務的唯讀存取許可， AWS 以進行彈性探索、評估和管理。

許可詳細資訊

此政策會授予萬用字元唯讀許可，這些許可可能會在輸出中包含敏感資訊。

此政策包含以下許可：

下列 IAM 政策提供次世代彈性中樞在執行評估時存取其他 AWS 服務所需的許可。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSResilienceHubV2ReadResourceConfigStatement",
            "Effect": "Allow",
            "Action": [
                "acm:DescribeCertificate",
                "acm:GetCertificate",
                "acm:ListCertificates",
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingPolicies",
                "arc-region-switch:GetRegionSwitchStatus",
                "arc-region-switch:ListRegionSwitchAZSummaries",
                "arc-zonal-shift:GetManagedResource",
                "arc-zonal-shift:ListManagedResources",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "backup:DescribeBackupVault",
                "backup:GetBackupPlan",
                "backup:GetBackupSelection",
                "backup:ListBackupPlans",
                "backup:ListBackupSelections",
                "cloudformation:DescribeStacks",
                "cloudformation:GetTemplate",
                "cloudformation:ListStackResources",
                "cloudfront:GetDistribution",
                "cloudfront:ListDistributions",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricData",
                "cloudwatch:ListMetrics",
                "config:DescribeConfigRules",
                "config:ListDiscoveredResources",
                "datasync:DescribeTask",
                "datasync:ListLocations",
                "datasync:ListTasks",
                "dlm:GetLifecyclePolicies",
                "dlm:GetLifecyclePolicy",
                "docdb-elastic:GetCluster",
                "docdb-elastic:ListClusters",
                "drs:DescribeJobs",
                "drs:DescribeSourceServers",
                "drs:GetReplicationConfiguration",
                "ds:DescribeDirectories",
                "dsql:GetCluster",
                "dsql:ListClusters",
                "dynamodb:DescribeContinuousBackups",
                "dynamodb:DescribeGlobalTable",
                "dynamodb:DescribeTable",
                "dynamodb:ListGlobalTables",
                "dynamodb:ListTagsOfResource",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeFastSnapshotRestores",
                "ec2:DescribeFleets",
                "ec2:DescribeInstances",
                "ec2:DescribeNatGateways",
                "ec2:DescribeRegions",
                "ec2:DescribeSnapshots",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVolumes",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeVpcs",
                "ecr:DescribeRepositories",
                "ecs:DescribeCapacityProviders",
                "ecs:DescribeClusters",
                "ecs:DescribeContainerInstances",
                "ecs:DescribeServices",
                "ecs:DescribeTaskDefinition",
                "ecs:ListContainerInstances",
                "ecs:ListServices",
                "eks:DescribeCluster",
                "eks:DescribeFargateProfile",
                "eks:DescribeNodegroup",
                "eks:ListFargateProfiles",
                "eks:ListNodegroups",
                "elasticache:DescribeCacheClusters",
                "elasticache:DescribeGlobalReplicationGroups",
                "elasticache:DescribeReplicationGroups",
                "elasticache:DescribeSnapshots",
                "elasticfilesystem:DescribeFileSystems",
                "elasticfilesystem:DescribeMountTargets",
                "elasticfilesystem:DescribeReplicationConfigurations",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeTargetHealth",
                "events:DescribeEventBus",
                "events:DescribeRule",
                "events:ListRules",
                "events:ListTargets",
                "firehose:DescribeDeliveryStream",
                "firehose:ListDeliveryStreams",
                "fis:GetExperiment",
                "fis:GetExperimentTemplate",
                "fis:ListExperimentTemplates",
                "fis:ListExperiments",
                "fsx:DescribeFileSystems",
                "globalaccelerator:DescribeAccelerator",
                "globalaccelerator:DescribeEndpointGroup",
                "globalaccelerator:DescribeListener",
                "globalaccelerator:ListAccelerators",
                "globalaccelerator:ListEndpointGroups",
                "globalaccelerator:ListListeners",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:ListAttachedRolePolicies",
                "kafka:DescribeCluster",
                "kafka:DescribeClusterV2",
                "kafka:GetBootstrapBrokers",
                "kafka:ListClusters",
                "kafka:ListClustersV2",
                "kafkaconnect:DescribeConnector",
                "kafkaconnect:ListConnectors",
                "kinesis:DescribeStream",
                "kinesis:ListStreams",
                "lambda:GetFunctionConcurrency",
                "lambda:GetFunctionConfiguration",
                "lambda:ListAliases",
                "lambda:ListEventSourceMappings",
                "lambda:ListFunctionEventInvokeConfigs",
                "lambda:ListVersionsByFunction",
                "memorydb:DescribeClusters",
                "memorydb:DescribeMultiRegionClusters",
                "network-firewall:DescribeFirewall",
                "network-firewall:DescribeFirewallPolicy",
                "network-firewall:ListFirewallPolicies",
                "network-firewall:ListFirewalls",
                "qldb:DescribeLedger",
                "qldb:ListLedgers",
                "ram:GetResourceShareAssociations",
                "ram:ListResources",
                "rds:DescribeDBClusterSnapshots",
                "rds:DescribeDBClusters",
                "rds:DescribeDBInstanceAutomatedBackups",
                "rds:DescribeDBInstances",
                "rds:DescribeDBProxies",
                "rds:DescribeDBSnapshots",
                "rds:DescribeGlobalClusters",
                "redshift:DescribeClusterSnapshots",
                "redshift:DescribeClusters",
                "resource-groups:GetGroup",
                "resource-groups:ListGroupResources",
                "route53:GetHealthCheck",
                "route53:GetHostedZone",
                "route53:ListHealthChecks",
                "route53:ListHostedZones",
                "route53:ListResourceRecordSets",
                "route53-recovery-control-config:ListClusters",
                "route53-recovery-control-config:ListControlPanels",
                "route53-recovery-control-config:ListRoutingControls",
                "route53-recovery-readiness:GetReadinessCheckStatus",
                "route53-recovery-readiness:GetResourceSet",
                "route53-recovery-readiness:ListReadinessChecks",
                "route53resolver:ListFirewallRuleGroupAssociations",
                "route53resolver:ListResolverEndpoints",
                "route53resolver:ListResolverRules",
                "s3:ListBucket",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecrets",
                "servicecatalog:GetApplication",
                "servicecatalog:ListAssociatedResources",
                "shield:DescribeProtection",
                "shield:ListProtections",
                "sns:GetTopicAttributes",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTopics",
                "sqs:GetQueueAttributes",
                "sqs:ListQueues",
                "ssm:DescribeAutomationExecutions",
                "ssm:GetDocument",
                "ssm:GetParametersByPath",
                "ssm-incidents:GetResponsePlan",
                "ssm-incidents:ListReplicationSets",
                "ssm-incidents:ListResponsePlans",
                "states:DescribeStateMachine",
                "states:ListStateMachines",
                "tag:GetResources",
                "vpc-lattice:GetService",
                "vpc-lattice:GetServiceNetwork",
                "vpc-lattice:GetTargetGroup",
                "vpc-lattice:ListServices",
                "vpc-lattice:ListServiceNetworks",
                "vpc-lattice:ListTargetGroups",
                "wafv2:GetWebACL",
                "wafv2:ListWebACLs"
            ],
            "Resource": "*"
        },
        {
            "Sid": "AWSResilienceHubApiGatewayStatement",
            "Effect": "Allow",
            "Action": [
                "apigateway:GET"
            ],
            "Resource": [
                "arn:aws:apigateway:*::/apis/*",
                "arn:aws:apigateway:*::/restapis/*",
                "arn:aws:apigateway:*::/usageplans",
                "arn:aws:apigateway:*::/domainnames/*"
            ]
        },
        {
            "Sid": "AWSResilienceHubS3AccessStatement",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:GetBucketLogging",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketTagging",
                "s3:GetBucketVersioning",
                "s3:GetMultiRegionAccessPointRoutes",
                "s3:GetReplicationConfiguration",
                "s3:ListAllMyBuckets",
                "s3:ListMultiRegionAccessPoints"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        }
    ]
}

AWSResilienceHubServiceRolePolicy

AWSResilienceHubServiceRolePolicy 是服務連結角色 (SLR) 政策。您無法將此政策連接至 IAM 實體。當您啟用 AWS Organizations 支援多帳戶彈性管理時，新一代 Resilience Hub 會自動建立此服務連結角色。此角色信任 resiliencehub.amazonaws.com服務委託人。

如需 AWS Resilience Hub 服務連結角色的詳細資訊，請參閱使用 AWS Resilience Hub 的服務連結角色。

許可詳細資訊

透過此政策，新一代彈性中樞可以存取唯讀 AWS Organizations 資訊，以進行多帳戶彈性管理。

此政策包含以下許可：

下列 IAM 政策為新一代彈性中樞提供必要許可，以存取 AWS Organizations 資源進行多帳戶彈性管理。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSResilienceHubOrganizationsReadStatement",
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "organizations:DescribeOrganizationalUnit",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListChildren",
                "organizations:ListDelegatedAdministrators",
                "organizations:ListDelegatedServicesForAccount",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListParents",
                "organizations:ListRoots",
                "organizations:ListTagsForResource"
            ],
            "Resource": "*"
        }
    ]
}

AWS 受管政策的新一代彈性中樞更新

檢視自此服務開始追蹤這些變更以來，新一代 Resilience Hub AWS 受管政策更新的詳細資訊。如需此頁面變更的自動提醒，請訂閱新一代 Resilience Hub 文件歷史記錄頁面上的 RSS 摘要。