Skip to content

Commit e9a7f72

Browse files
udondanudondan
authored
Merge pull request #2144 from udondan/update-aws-managed-policies
2 parents f69663a + eca995d commit e9a7f72

11 files changed

Lines changed: 342 additions & 25 deletions

‎docs/source/_static/managed-policies/AIDevOpsAgentAccessPolicy.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@
2323
"acm-pca:List*",
2424
"acm:DescribeCertificate",
2525
"acm:GetAccountConfiguration",
26+
"acm:GetCertificate",
27+
"acm:ListCertificates",
2628
"aidevops:GetAsset",
2729
"aidevops:GetAssetContent",
2830
"aidevops:GetAssetFile",
@@ -100,13 +102,20 @@
100102
"batch:DescribeJobQueues",
101103
"batch:DescribeSchedulingPolicies",
102104
"batch:List*",
105+
"bcm-data-exports:Get*",
106+
"bcm-data-exports:List*",
103107
"bedrock:GetAgent",
104108
"bedrock:GetAgentActionGroup",
105109
"bedrock:GetAgentAlias",
106110
"bedrock:GetAgentKnowledgeBase",
111+
"bedrock:GetCustomModel",
107112
"bedrock:GetDataSource",
113+
"bedrock:GetFoundationModel",
108114
"bedrock:GetGuardrail",
115+
"bedrock:GetInferenceProfile",
109116
"bedrock:GetKnowledgeBase",
117+
"bedrock:GetModelInvocationLoggingConfiguration",
118+
"bedrock:GetProvisionedModelThroughput",
110119
"bedrock:List*",
111120
"budgets:Describe*",
112121
"budgets:List*",
@@ -227,6 +236,8 @@
227236
"connect:Describe*",
228237
"connect:GetTaskTemplate",
229238
"connect:List*",
239+
"cur:Describe*",
240+
"cur:Get*",
230241
"databrew:Describe*",
231242
"databrew:List*",
232243
"datapipeline:Describe*",
@@ -263,6 +274,9 @@
263274
"dynamodb:List*",
264275
"ec2:Describe*",
265276
"ec2:GetAssociatedEnclaveCertificateIamRoles",
277+
"ec2:GetCapacityManagerAttributes",
278+
"ec2:GetCapacityManagerMetricData",
279+
"ec2:GetCapacityManagerMonitoredTagKeys",
266280
"ec2:GetIpamPoolAllocations",
267281
"ec2:GetIpamPoolCidrs",
268282
"ec2:GetManagedPrefixListEntries",
@@ -341,16 +355,30 @@
341355
"gamelift:List*",
342356
"globalaccelerator:Describe*",
343357
"globalaccelerator:List*",
358+
"glue:BatchGetJobs",
359+
"glue:GetClassifier",
360+
"glue:GetClassifiers",
344361
"glue:GetCrawler",
362+
"glue:GetCrawlerMetrics",
363+
"glue:GetCrawlers",
345364
"glue:GetDatabase",
346365
"glue:GetDatabases",
366+
"glue:GetDataCatalogEncryptionSettings",
347367
"glue:GetJob",
368+
"glue:GetJobBookmark",
369+
"glue:GetJobRun",
370+
"glue:GetJobRuns",
348371
"glue:GetRegistry",
372+
"glue:GetResourcePolicy",
349373
"glue:GetSchema",
350374
"glue:GetSchemaVersion",
351375
"glue:GetTable",
352376
"glue:GetTags",
353377
"glue:GetTrigger",
378+
"glue:GetSecurityConfiguration",
379+
"glue:GetSecurityConfigurations",
380+
"glue:GetWorkflow",
381+
"glue:GetWorkflowRun",
354382
"glue:List*",
355383
"glue:querySchemaVersionMetadata",
356384
"grafana:Describe*",

‎docs/source/_static/managed-policies/AIDevOpsAgentFullAccess.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@
7575
"aidevops:TagResource",
7676
"aidevops:UntagResource",
7777
"aidevops:UpdateAgentSpace",
78+
"aidevops:UpdateApprovalAction",
7879
"aidevops:UpdateAsset",
7980
"aidevops:UpdateAssetFile",
8081
"aidevops:UpdateAssociation",

‎docs/source/_static/managed-policies/AIDevOpsOperatorAppAccessPolicy.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,7 @@
5050
"aidevops:RevokeAccessToken",
5151
"aidevops:RotateAccessToken",
5252
"aidevops:SendMessage",
53+
"aidevops:UpdateApprovalAction",
5354
"aidevops:UpdateAsset",
5455
"aidevops:UpdateAssetFile",
5556
"aidevops:UpdateBacklogTask",

‎docs/source/_static/managed-policies/AWSSecurityHubServiceRolePolicy.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@
8383
"Effect": "Allow",
8484
"Action": [
8585
"config:PutServiceLinkedConfigurationRecorder",
86+
"config:PutThirdPartyServiceLinkedConfigurationRecorder",
8687
"config:DeleteServiceLinkedConfigurationRecorder",
8788
"config:DescribeConfigurationRecorders",
8889
"config:DescribeConfigurationRecorderStatus"
@@ -91,6 +92,15 @@
9192
"arn:aws:config:*:*:configuration-recorder/*ConfigurationRecorderForSecurityHubCSPM*"
9293
]
9394
},
95+
{
96+
"Sid": "SecurityHubCSPMServiceRoleConfigListAndGet",
97+
"Effect": "Allow",
98+
"Action": [
99+
"config:ListConfigurationRecorders",
100+
"config:GetConnector"
101+
],
102+
"Resource": "*"
103+
},
94104
{
95105
"Sid": "SecurityHubCSPMServiceRoleIamPermissions",
96106
"Effect": "Allow",
@@ -103,6 +113,12 @@
103113
"iam:AWSServiceName": "config.amazonaws.com"
104114
}
105115
}
116+
},
117+
{
118+
"Sid": "SecurityHubCSPMServiceRoleConfigMetricsPermissions",
119+
"Effect": "Allow",
120+
"Action": "cloudwatch:GetMetricData",
121+
"Resource": "*"
106122
}
107123
]
108124
}

‎docs/source/_static/managed-policies/AWSSecurityHubV2ServiceRolePolicy.json‎

Lines changed: 75 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,19 @@
88
"config:DeleteServiceLinkedConfigurationRecorder",
99
"config:DescribeConfigurationRecorders",
1010
"config:DescribeConfigurationRecorderStatus",
11-
"config:PutServiceLinkedConfigurationRecorder"
11+
"config:PutServiceLinkedConfigurationRecorder",
12+
"config:PutThirdPartyServiceLinkedConfigurationRecorder"
1213
],
13-
"Resource": [
14-
"arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForSecurityHubAssets/*",
15-
"arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForSecurityHubAssetsGlobal/*"
16-
]
14+
"Resource": "arn:aws:config:*:*:configuration-recorder/*ConfigurationRecorderForSecurityHubAssets*"
15+
},
16+
{
17+
"Sid": "SecurityHubV2ServiceRoleAssetsConfigListAndGet",
18+
"Effect": "Allow",
19+
"Action": [
20+
"config:ListConfigurationRecorders",
21+
"config:GetConnector"
22+
],
23+
"Resource": "*"
1724
},
1825
{
1926
"Sid": "SecurityHubV2ServiceRoleAssetsIamPermissions",
@@ -34,7 +41,9 @@
3441
"Action": [
3542
"securityhub:DisableSecurityHubV2",
3643
"securityhub:EnableSecurityHubV2",
37-
"securityhub:DescribeSecurityHubV2"
44+
"securityhub:DescribeSecurityHubV2",
45+
"securityhub:EnableSecurityHubFeatureV2",
46+
"securityhub:DisableSecurityHubFeatureV2"
3847
],
3948
"Resource": "arn:aws:securityhub:*:*:hubv2/*",
4049
"Condition": {
@@ -96,7 +105,7 @@
96105
"Resource": "*"
97106
},
98107
{
99-
"Sid": "SecurityHubV2ServiceRoleLambdaMetricPermissions",
108+
"Sid": "SecurityHubV2ServiceRoleLambdaAndConfigMetricPermissions",
100109
"Effect": "Allow",
101110
"Action": [
102111
"cloudwatch:GetMetricData"
@@ -177,6 +186,65 @@
177186
"arn:aws:iam::*:role/*",
178187
"arn:aws:iam::*:user/*"
179188
]
189+
},
190+
{
191+
"Sid": "SecurityHubConnectorPermissions",
192+
"Effect": "Allow",
193+
"Action": [
194+
"securityhub:CreateConnector",
195+
"securityhub:UpdateConnector",
196+
"securityhub:DeleteConnector"
197+
],
198+
"Resource": "arn:aws:securityhub:*:*:connector/*",
199+
"Condition": {
200+
"StringLikeIfExists": {
201+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
202+
}
203+
}
204+
},
205+
{
206+
"Sid": "SecurityHubV2ServiceRoleInspectorConnectorPermissions",
207+
"Effect": "Allow",
208+
"Action": [
209+
"inspector2:CreateConnector",
210+
"inspector2:DeleteConnector",
211+
"inspector2:ListConnectors",
212+
"inspector2:ListConnectorScanConfigurations",
213+
"inspector2:UpdateConnector",
214+
"inspector2:UpdateConnectorScanConfiguration"
215+
],
216+
"Resource": "*",
217+
"Condition": {
218+
"StringLikeIfExists": {
219+
"aws:ResourceAccount": "${aws:PrincipalAccount}"
220+
}
221+
}
222+
},
223+
{
224+
"Sid": "SecurityHubV2ServiceRoleInspectorIamPermissions",
225+
"Effect": "Allow",
226+
"Action": [
227+
"iam:CreateServiceLinkedRole"
228+
],
229+
"Resource": "arn:aws:iam::*:role/aws-service-role/thirdparty.inspector2.amazonaws.com/*",
230+
"Condition": {
231+
"StringEquals": {
232+
"iam:AWSServiceName": "thirdparty.inspector2.amazonaws.com"
233+
}
234+
}
235+
},
236+
{
237+
"Sid": "SecurityHubV2ServiceRoleOutboundIdentityFederationPermission",
238+
"Effect": "Allow",
239+
"Action": "sts:GetWebIdentityToken",
240+
"Resource": "*",
241+
"Condition": {
242+
"ForAnyValue:StringLike": {
243+
"sts:IdentityTokenAudience": [
244+
"api://AzureADTokenExchange"
245+
]
246+
}
247+
}
180248
}
181249
]
182250
}

‎docs/source/_static/managed-policies/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary.json‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -312,18 +312,19 @@
312312
},
313313
{
314314
"Sid": "AllowCodeBuildActions",
315+
"Effect": "Allow",
315316
"Action": [
316317
"codebuild:BatchGetBuilds",
317318
"codebuild:StartBuild"
318319
],
319320
"Resource": [
320321
"arn:aws:codebuild:*:*:project/sagemaker*",
321322
"arn:aws:codebuild:*:*:build/*"
322-
],
323-
"Effect": "Allow"
323+
]
324324
},
325325
{
326326
"Sid": "AllowStepFunctionsActions",
327+
"Effect": "Allow",
327328
"Action": [
328329
"states:DescribeExecution",
329330
"states:GetExecutionHistory",
@@ -334,8 +335,7 @@
334335
"Resource": [
335336
"arn:aws:states:*:*:statemachine:*sagemaker*",
336337
"arn:aws:states:*:*:execution:*sagemaker*:*"
337-
],
338-
"Effect": "Allow"
338+
]
339339
},
340340
{
341341
"Sid": "AllowSecretManagerActions",
@@ -479,8 +479,8 @@
479479
},
480480
{
481481
"Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling",
482-
"Action": "iam:CreateServiceLinkedRole",
483482
"Effect": "Allow",
483+
"Action": "iam:CreateServiceLinkedRole",
484484
"Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint",
485485
"Condition": {
486486
"StringLike": {
@@ -795,22 +795,22 @@
795795
],
796796
"Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
797797
"Condition": {
798-
"StringLike": {
799-
"aws:ResourceTag/AmazonDataZoneDomain": "dzd*",
800-
"aws:RequestTag/AmazonDataZoneDomain": "dzd*"
801-
},
802-
"Null": {
803-
"aws:TagKeys": "false",
804-
"aws:ResourceTag/AmazonDataZoneProject": "false",
805-
"aws:ResourceTag/AmazonDataZoneDomain": "false",
806-
"aws:RequestTag/AmazonDataZoneDomain": "false",
807-
"aws:RequestTag/AmazonDataZoneProject": "false"
808-
},
809798
"ForAllValues:StringEquals": {
810799
"aws:TagKeys": [
811800
"AmazonDataZoneDomain",
812801
"AmazonDataZoneProject"
813802
]
803+
},
804+
"Null": {
805+
"aws:RequestTag/AmazonDataZoneDomain": "false",
806+
"aws:RequestTag/AmazonDataZoneProject": "false",
807+
"aws:ResourceTag/AmazonDataZoneDomain": "false",
808+
"aws:ResourceTag/AmazonDataZoneProject": "false",
809+
"aws:TagKeys": "false"
810+
},
811+
"StringLike": {
812+
"aws:RequestTag/AmazonDataZoneDomain": "dzd*",
813+
"aws:ResourceTag/AmazonDataZoneDomain": "dzd*"
814814
}
815815
}
816816
},
@@ -1188,6 +1188,7 @@
11881188
"Sid": "DenyUpdateNotebookInstanceLifecycleConfig",
11891189
"Effect": "Deny",
11901190
"Action": [
1191+
"sagemaker:CreateNotebookInstanceLifecycleConfig",
11911192
"sagemaker:UpdateNotebookInstanceLifecycleConfig"
11921193
],
11931194
"Resource": "*"

0 commit comments

Comments
 (0)