Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.
# AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
**Descripción**: Proporciona acceso para administrar los recursos de la grabadora AWS Config y la configuración de telemetría en AWS los recursos, incluidos los registros y las métricas.
`AWSObservabilityAdminTelemetryEnablementServiceRolePolicy` es una [política administrada de AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Uso de la política
Esta política está asociada a un rol vinculado a un servicio. Esto permite a dicho servicio realizar acciones por usted. No puede asociar esta política a los usuarios, grupos o roles.
## Información de la política
+ **Tipo**: política de rol vinculado a un servicio
+ **Hora de creación**: 1 de agosto de 2025 a las 18:04 UTC
+ **Hora editada:** 16 de abril de 2026, 17:42 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSObservabilityAdminTelemetryEnablementServiceRolePolicy`
## Versión de la política
**Versión de la política:** v9 (predeterminada)
La versión predeterminada de la política define qué permisos tendrá. Cuando un usuario o un rol con la política solicita el acceso a un AWS recurso, AWS comprueba la versión predeterminada de la política para determinar si permite la solicitud.
## Documento de política JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "TelemetryOperations",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeFlowLogs",
"ec2:DescribeVpcs",
"logs:DescribeLogGroups",
"logs:DescribeResourcePolicies",
"logs:ListLogGroups",
"ec2:MonitorInstances",
"logs:DescribeDeliverySources"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TagOperationForEC2",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"ec2:CreateAction" : "CreateFlowLogs"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TagOperationForLogs",
"Effect" : "Allow",
"Action" : [
"logs:TagResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TelemetryOperationsForVPCLogs",
"Effect" : "Allow",
"Action" : [
"ec2:CreateFlowLogs"
],
"Resource" : "arn:aws:ec2:*:*:vpc/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForVPCFlowLogs",
"Effect" : "Allow",
"Action" : [
"ec2:CreateFlowLogs"
],
"Resource" : "arn:aws:ec2:*:*:vpc-flow-log/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TelemetryOperationsForLogs",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteFlowLogs",
"logs:CreateDelivery",
"logs:CreateLogGroup",
"logs:PutResourcePolicy",
"logs:PutRetentionPolicy",
"logs:PutDeliveryDestination",
"logs:PutDeliverySource",
"logs:CreateLogStream",
"logs:DescribeLogGroups"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSApiLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/api" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSAuditLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/audit" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSAuthenticatorLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/authenticator" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSControllerManagerLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/controllerManager" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSSchedulerLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/scheduler" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForWafLoggingConfigurations",
"Effect" : "Allow",
"Action" : [
"wafv2:PutLoggingConfiguration"
],
"Resource" : "arn:aws:wafv2:*:*:regional/webacl/*",
"Condition" : {
"ArnLike" : {
"wafv2:LogDestinationResource" : "arn:aws:logs:*:*:log-group:*"
},
"StringEquals" : {
"wafv2:LogScope" : "CloudwatchTelemetryRuleManaged",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForWafLogDelivery",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogDelivery"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"wafv2.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForELB",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForBedrock",
"Effect" : "Allow",
"Action" : [
"bedrock-agentcore:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForSecurityHub",
"Effect" : "Allow",
"Action" : [
"securityhub:AllowVendedLogDeliveryForResource",
"securityhub:DescribeHub",
"securityhub:DescribeSecurityHubV2"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForCloudfront",
"Effect" : "Allow",
"Action" : [
"cloudfront:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForCloudTrailLogs",
"Effect" : "Allow",
"Action" : [
"cloudtrail:CreateServiceLinkedChannel",
"cloudtrail:UpdateServiceLinkedChannel",
"cloudtrail:DeleteServiceLinkedChannel"
],
"Resource" : "arn:aws:cloudtrail:*:*:channel/aws-service-channel/cloudwatch/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForManagedLogs",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:PutResourcePolicy",
"logs:PutRetentionPolicy"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:aws/cloudtrail",
"arn:aws:logs:*:*:log-group:aws/cloudtrail/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingListOperations",
"Effect" : "Allow",
"Action" : [
"route53resolver:ListResolverQueryLogConfigs",
"route53resolver:ListResolverQueryLogConfigAssociations"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingGetOperations",
"Effect" : "Allow",
"Action" : [
"route53resolver:GetResolverQueryLogConfig",
"route53resolver:ListTagsForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingConfigCreation",
"Effect" : "Allow",
"Action" : [
"route53resolver:CreateResolverQueryLogConfig",
"route53resolver:TagResource"
],
"Resource" : "arn:aws:route53resolver:*:*:resolver-query-log-config/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingConfigAssociation",
"Effect" : "Allow",
"Action" : [
"route53resolver:AssociateResolverQueryLogConfig"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForRoute53LogDeliverySLR",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : "arn:*:iam::*:role/aws-service-role/route53resolver.amazonaws.com/AWSServiceRoleForRoute53Resolver",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : [
"route53resolver.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"BoolIfExists" : {
"aws:ViaAWSService" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForRoute53LogDelivery",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogDelivery"
],
"Resource" : "*"
},
{
"Sid" : "IAMOperationsForConfigServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
],
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : [
"config.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"BoolIfExists" : {
"aws:ViaAWSService" : "true"
}
}
},
{
"Sid" : "ManagementOperationsForServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"config:PutServiceLinkedConfigurationRecorder",
"config:DeleteServiceLinkedConfigurationRecorder",
"config:AssociateResourceTypes",
"config:DisassociateResourceTypes"
],
"Resource" : [
"arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForObservabilityAdmin_TelemetryEnablement/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ReadOperationsForServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"config:DescribeConfigurationRecorders"
],
"Resource" : [
"*"
],
"Condition" : {
"StringEquals" : {
"config:ConfigurationRecorderServicePrincipal" : [
"telemetry-enablement.observabilityadmin.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
}
]
}
```
## Más información
+ [Conozca el control de versiones de las políticas de IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Comience con las políticas AWS administradas y avance hacia los permisos con privilegios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)