Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.
# AWSQuickSetupPatchPolicyPermissionsBoundary
**Descripción**: QuickSetup crea funciones de IAM que le permiten configurar la función Systems Manager Patch Manager en su nombre y utiliza esta política al crear dichas funciones para definir el límite de sus permisos.
`AWSQuickSetupPatchPolicyPermissionsBoundary` es una [política administrada de AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Uso de la política
Puede asociar `AWSQuickSetupPatchPolicyPermissionsBoundary` a los usuarios, grupos y roles.
## Información de la política
+ **Tipo**: política AWS gestionada
+ **Hora de creación**: 26 de junio de 2024 a las 09:46 h UTC
+ **Hora editada:** 5 de marzo de 2026 a las 16:57 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary`
## Versión de la política
**Versión de la política:** v5 (predeterminada)
La versión predeterminada de la política define qué permisos tendrá. Cuando un usuario o un rol con la política solicita el acceso a un AWS recurso, AWS comprueba la versión predeterminada de la política para determinar si permite la solicitud.
## Documento de política JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "PatchingAutomationRoleGetPermissions",
"Effect" : "Allow",
"Action" : [
"iam:GetRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
]
},
{
"Sid" : "PatchingAutomationRolePassPermissions",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid" : "DefaultInstanceRolePermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole",
"iam:DeleteRole",
"iam:UpdateRole",
"iam:GetRole"
],
"Condition" : {
"StringLike" : {
"aws:PrincipalTag/QuickSetupManagerID" : "*"
},
"ArnLike" : {
"aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource" : [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid" : "DefaultInstanceRolePassPermissions",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"ec2.amazonaws.com",
"ssm.amazonaws.com"
]
}
}
},
{
"Sid" : "PoliciesAttachPermissions",
"Effect" : "Allow",
"Action" : [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Condition" : {
"ArnEquals" : {
"iam:PolicyARN" : [
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
"arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess"
]
},
"StringLike" : {
"aws:PrincipalTag/QuickSetupManagerID" : "*"
},
"ArnLike" : {
"aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource" : "arn:aws:iam::*:role/*"
},
{
"Sid" : "CreateSLRPermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "ssm.amazonaws.com"
}
}
},
{
"Sid" : "InstanceRoleAddPermissions",
"Effect" : "Allow",
"Action" : [
"iam:AddRoleToInstanceProfile"
],
"Resource" : [
"*"
]
},
{
"Sid" : "ManagedInstanceRoleUpdatePermissions",
"Effect" : "Allow",
"Action" : [
"ssm:UpdateManagedInstanceRole"
],
"Resource" : "*"
},
{
"Sid" : "IAMReadOnlyPermissions",
"Effect" : "Allow",
"Action" : [
"iam:GetInstanceProfile",
"iam:GetRolePolicy",
"iam:ListInstanceProfilesForRole",
"iam:ListRoles"
],
"Resource" : [
"*"
]
},
{
"Sid" : "InstanceProfileCreatePermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateInstanceProfile"
],
"Resource" : [
"arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid" : "InstanceProfileAssociationPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:AssociateIamInstanceProfile"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"ec2:InstanceProfile" : "true"
},
"ArnLike" : {
"ec2:NewInstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid" : "InstanceProfileDisassociationPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DisassociateIamInstanceProfile"
],
"Resource" : "*",
"Condition" : {
"ArnLike" : {
"ec2:InstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid" : "SSMAssociationsPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeAssociationExecutions",
"ssm:UpdateAssociation",
"ssm:DescribeAssociation"
],
"Resource" : [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:ssm:*:*:association/*"
]
},
{
"Sid" : "BaselineS3Permissions",
"Effect" : "Allow",
"Action" : [
"s3:CreateBucket",
"s3:Put*",
"s3:Get*",
"s3:List*",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:DeleteBucket"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : [
"${aws:PrincipalAccount}"
]
}
},
"Resource" : "arn:aws:s3:::aws-quicksetup-patchpolicy-*"
},
{
"Sid" : "PatchingFunctionsPermissions",
"Effect" : "Allow",
"Action" : [
"lambda:InvokeFunction"
],
"Resource" : [
"arn:aws:lambda:*:*:function:baseline-overrides-*",
"arn:aws:lambda:*:*:function:delete-name-tags-*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : [
"${aws:PrincipalAccount}"
]
}
}
},
{
"Sid" : "LoggingPermissions",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogStream",
"logs:CreateLogGroup",
"logs:PutLogEvents"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*",
"arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*"
]
},
{
"Sid" : "SSMTaggingPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource"
],
"Resource" : "arn:aws:ssm:*:*:managed-instance/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigName-*"
}
}
},
{
"Sid" : "EC2TaggingPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigName-*"
}
}
},
{
"Sid" : "RoleTaggingPermissions",
"Effect" : "Allow",
"Action" : [
"iam:TagRole",
"iam:UntagRole"
],
"Resource" : "*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigId-*"
}
}
},
{
"Sid" : "PatchingReadOnlyPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:GetPatchBaseline",
"ssm:GetInventory",
"ssm:DescribeInstanceInformation",
"ssm:DescribeAssociation",
"ssm:GetAutomationExecution",
"ssm:ListTagsForResource",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeInstances"
],
"Resource" : "*"
},
{
"Sid" : "PatchingAutomationsStartPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:StartAutomationExecution"
],
"Resource" : [
"arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer*",
"arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaseline*",
"arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:automation-definition/QuickSetup-*",
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/AWS-EnableExplorer*",
"arn:aws:ssm:*:*:document/AWS-RunPatchBaseline*",
"arn:aws:ssm:*:*:document/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:document/QuickSetup-*",
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:automation-execution/*"
]
},
{
"Sid" : "ReadOnlyPermissionsForEnablingExplorer",
"Effect" : "Allow",
"Action" : [
"iam:ListRoles",
"config:DescribeConfigurationRecorders",
"compute-optimizer:GetEnrollmentStatus",
"support:DescribeTrustedAdvisorChecks"
],
"Resource" : "*"
},
{
"Sid" : "ExplorerServiceSettingsPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:UpdateServiceSetting",
"ssm:GetServiceSetting"
],
"Resource" : [
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager",
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase"
]
}
]
}
```
## Más información
+ [Cree un conjunto de permisos mediante políticas AWS administradas en el Centro de identidades de IAM](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [Adición y eliminación de permisos de identidad de IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [Conozca el control de versiones de las políticas de IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Comience con las políticas AWS administradas y avance hacia los permisos con privilegios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)