Die vorliegende Übersetzung wurde maschinell erstellt. Im Falle eines Konflikts oder eines Widerspruchs zwischen dieser übersetzten Fassung und der englischen Fassung (einschließlich infolge von Verzögerungen bei der Übersetzung) ist die englische Fassung maßgeblich.
BedrockAgentCoreFullAccess
Beschreibung: Bietet vollen Zugriff auf Bedrock AgentCore sowie eingeschränkten Zugriff auf verwandte Dienste
BedrockAgentCoreFullAccessist eine AWS verwaltete Richtlinie.
Verwendung dieser Richtlinie
Sie können BedrockAgentCoreFullAccess an Ihre Benutzer, Gruppen und Rollen anfügen.
Details zur Richtlinie
-
Typ: AWS verwaltete Richtlinie
-
Aufnahmezeit: 16. Juli 2025, 13:37 UTC
-
Zeit geändert: 28. Juli 2026, 16:57 UTC
-
ARN:
arn:aws:iam::aws:policy/BedrockAgentCoreFullAccess
Version der Richtlinie
Version der Richtlinie: v18 (Standard)
Die Standardversion der Richtlinie ist die Version, die die Berechtigungen für die Richtlinie definiert. Wenn ein Benutzer oder eine Rolle mit der Richtlinie eine Anfrage für den Zugriff auf eine AWS Ressource stellt, AWS überprüft die Standardversion der Richtlinie, ob die Anforderung zulässig ist.
JSON-Richtliniendokument
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "BedrockAgentCoreFullAccess", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:*" ], "Resource" : "arn:aws:bedrock-agentcore:*:*:*" }, { "Sid" : "IAMListAccess", "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:GetRolePolicy", "iam:ListAttachedRolePolicies", "iam:ListRolePolicies", "iam:ListRoles" ], "Resource" : "arn:aws:iam::*:role/*" }, { "Sid" : "BedrockAgentCorePassRoleAccess", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/*BedrockAgentCore*", "Condition" : { "StringEquals" : { "iam:PassedToService" : "bedrock-agentcore.amazonaws.com" } } }, { "Sid" : "SecretsManagerAccess", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret", "secretsmanager:PutSecretValue", "secretsmanager:GetSecretValue", "secretsmanager:DeleteSecret" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:bedrock-agentcore*" }, { "Sid" : "BedrockAgentCoreKMSReadAccess", "Effect" : "Allow", "Action" : [ "kms:ListKeys", "kms:DescribeKey" ], "Resource" : [ "arn:aws:kms:*:*:key/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockAgentCoreKMSAccess", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey", "kms:ListGrants" ], "Resource" : [ "arn:aws:kms:*:*:key/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "bedrock-agentcore.amazonaws.com" ] } } }, { "Sid" : "BedrockAgentCoreKMSGrantsAccess", "Effect" : "Allow", "Action" : [ "kms:CreateGrant" ], "Resource" : [ "arn:aws:kms:*:*:key/*" ], "Condition" : { "StringEquals" : { "kms:GrantConstraintType" : "EncryptionContextSubset" }, "StringLike" : { "kms:ViaService" : [ "bedrock-agentcore.*.amazonaws.com" ], "kms:EncryptionContext:aws:bedrock-agentcore-gateway:arn" : "arn:aws:bedrock-agentcore:*:*:gateway/*" }, "ForAllValues:StringEquals" : { "kms:GrantOperations" : [ "Decrypt", "GenerateDataKey" ] } } }, { "Sid" : "BedrockAgentCoreS3Access", "Effect" : "Allow", "Action" : [ "s3:GetObject" ], "Resource" : [ "arn:aws:s3:::bedrock-agentcore-gateway-*" ], "Condition" : { "StringEquals" : { "aws:CalledViaLast" : "bedrock-agentcore.amazonaws.com", "s3:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockAgentCoreGatewayLambdaAccess", "Effect" : "Allow", "Action" : [ "lambda:ListFunctions" ], "Resource" : [ "arn:aws:lambda:*:*:*" ] }, { "Sid" : "BedrockAgentCoreGatewayApiGateway", "Effect" : "Allow", "Action" : [ "apigateway:GET" ], "Resource" : [ "arn:aws:apigateway:*::/restapis/*/stages/*/exports/*" ] }, { "Sid" : "LoggingAccess", "Effect" : "Allow", "Action" : [ "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:Describe*", "logs:TestMetricFilter", "logs:FilterLogEvents" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*", "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*", "arn:aws:logs:*:*:log-group:aws/spans:*" ] }, { "Sid" : "ObservabilityReadOnlyPermissions", "Effect" : "Allow", "Action" : [ "application-autoscaling:DescribeScalingPolicies", "application-signals:BatchGet*", "application-signals:Get*", "application-signals:List*", "autoscaling:Describe*", "cloudwatch:BatchGet*", "cloudwatch:Describe*", "cloudwatch:GenerateQuery", "cloudwatch:Get*", "cloudwatch:List*", "oam:ListSinks", "rum:BatchGet*", "rum:Get*", "rum:List*", "synthetics:Describe*", "synthetics:Get*", "synthetics:List*", "xray:BatchGet*", "xray:Get*", "xray:List*", "xray:StartTraceRetrieval", "xray:CancelTraceRetrieval", "logs:DescribeLogGroups", "logs:StartLiveTail", "logs:StopLiveTail" ], "Resource" : "*" }, { "Sid" : "TransactionSearchXRayPermissions", "Effect" : "Allow", "Action" : [ "xray:GetTraceSegmentDestination", "xray:UpdateTraceSegmentDestination", "xray:GetIndexingRules", "xray:UpdateIndexingRule" ], "Resource" : "*" }, { "Sid" : "TransactionSearchLogGroupPermissions", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutRetentionPolicy" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/application-signals/data:*", "arn:aws:logs:*:*:log-group:aws/spans:*" ] }, { "Sid" : "TransactionSearchLogsPermissions", "Effect" : "Allow", "Action" : [ "logs:DescribeResourcePolicies", "logs:PutResourcePolicy" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TransactionSearchApplicationSignalsPermissions", "Effect" : "Allow", "Action" : [ "application-signals:StartDiscovery" ], "Resource" : "*" }, { "Sid" : "CloudWatchApplicationSignalsCreateServiceLinkedRolePermissions", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals", "Condition" : { "StringLike" : { "iam:AWSServiceName" : "application-signals.cloudwatch.amazonaws.com" } } }, { "Sid" : "CloudWatchApplicationSignalsGetRolePermissions", "Effect" : "Allow", "Action" : "iam:GetRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals" }, { "Sid" : "CreateBedrockAgentCoreNetworkServiceLinkedRolePermissions", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/network.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreNetwork", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "network.bedrock-agentcore.amazonaws.com" } } }, { "Sid" : "CreateBedrockAgentCoreGatewayNetworkServiceLinkedRolePermissions", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreGatewayNetwork", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "bedrock-agentcore.amazonaws.com" } } }, { "Sid" : "CreateBedrockAgentCoreRuntimeIdentityServiceLinkedRolePermissions", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "arn:aws:iam::*:role/aws-service-role/runtime-identity.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreRuntimeIdentity", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : "runtime-identity.bedrock-agentcore.amazonaws.com" } } }, { "Sid" : "CloudWatchApplicationSignalsCloudTrailPermissions", "Effect" : "Allow", "Action" : [ "cloudtrail:CreateServiceLinkedChannel" ], "Resource" : "arn:aws:cloudtrail:*:*:channel/aws-service-channel/application-signals/*" }, { "Sid" : "BedrockAgentCoreRuntimeS3WriteAccess", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutObject" ], "Resource" : [ "arn:aws:s3:::bedrock-agentcore-runtime-*" ], "Condition" : { "StringEquals" : { "s3:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockAgentCoreRuntimeS3ReadAccess", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:GetObjectVersion", "s3:ListBucket", "s3:ListBucketVersions" ], "Resource" : "arn:aws:s3:::*", "Condition" : { "StringEquals" : { "s3:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockAgentCoreRuntimeS3ListAccess", "Effect" : "Allow", "Action" : [ "s3:ListAllMyBuckets" ], "Resource" : "*", "Condition" : { "StringEquals" : { "s3:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockAgentCoreRuntimeECRAccess", "Effect" : "Allow", "Action" : [ "ecr:DescribeRepositories", "ecr:DescribeImages", "ecr:ListImages" ], "Resource" : [ "arn:aws:ecr:*:*:repository/*" ] }, { "Sid" : "AgentCoreEvaluationCloudWatchLogCreate", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/evaluations/*" ] }, { "Sid" : "AgentCoreEvaluationCloudWatchLogIndexAccess", "Effect" : "Allow", "Action" : [ "logs:PutIndexPolicy", "logs:DescribeIndexPolicies" ], "Resource" : [ "arn:aws:logs:*:*:log-group:aws/spans", "arn:aws:logs:*:*:log-group:aws/spans:*" ] }, { "Sid" : "AgentCoreEvaluationBedrockInvokeAccess", "Effect" : "Allow", "Action" : [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource" : [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:inference-profile/*" ] }, { "Sid" : "AgentCoreEvaluationLambdaAccess", "Effect" : "Allow", "Action" : [ "lambda:InvokeFunction", "lambda:GetFunction" ], "Resource" : "arn:aws:lambda:*:*:function:*" }, { "Sid" : "AgentCoreEvaluationBedrockMantleInference", "Effect" : "Allow", "Action" : "bedrock-mantle:CreateInference", "Resource" : "arn:aws:bedrock-mantle:*:*:project/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "AgentCoreEvaluationBedrockMantleCallWithBearerToken", "Effect" : "Allow", "Action" : "bedrock-mantle:CallWithBearerToken", "Resource" : "*" } ] }
Weitere Informationen
