Le traduzioni sono generate tramite traduzione automatica. In caso di conflitto tra il contenuto di una traduzione e la versione originale in Inglese, quest'ultima prevarrà.
# AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
**Descrizione**: fornisce l'accesso per gestire le risorse del registratore AWS Config e le impostazioni di telemetria sulle AWS risorse, inclusi log e metriche.
`AWSObservabilityAdminTelemetryEnablementServiceRolePolicy`è [AWS una](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) politica gestita.
## Utilizzo di questa politica
Questa policy è associata a un ruolo collegato al servizio che consente al servizio di eseguire azioni per conto dell'utente. Non puoi collegare questa policy ai tuoi utenti, gruppi o ruoli.
## Dettagli della policy
+ **Tipo: politica relativa** ai ruoli collegati al servizio
+ **Ora di creazione**: 1 agosto 2025, 18:04 UTC
+ **Ora modificata:** 16 aprile 2026, 17:42 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSObservabilityAdminTelemetryEnablementServiceRolePolicy`
## Versione della politica
**Versione della politica:** v9 (predefinita)
La versione predefinita della politica è la versione che definisce le autorizzazioni per la politica. Quando un utente o un ruolo con la politica effettua una richiesta di accesso a una AWS risorsa, AWS controlla la versione predefinita della politica per determinare se consentire la richiesta.
## Documento di policy JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "TelemetryOperations",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeFlowLogs",
"ec2:DescribeVpcs",
"logs:DescribeLogGroups",
"logs:DescribeResourcePolicies",
"logs:ListLogGroups",
"ec2:MonitorInstances",
"logs:DescribeDeliverySources"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TagOperationForEC2",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"ec2:CreateAction" : "CreateFlowLogs"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TagOperationForLogs",
"Effect" : "Allow",
"Action" : [
"logs:TagResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TelemetryOperationsForVPCLogs",
"Effect" : "Allow",
"Action" : [
"ec2:CreateFlowLogs"
],
"Resource" : "arn:aws:ec2:*:*:vpc/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForVPCFlowLogs",
"Effect" : "Allow",
"Action" : [
"ec2:CreateFlowLogs"
],
"Resource" : "arn:aws:ec2:*:*:vpc-flow-log/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TelemetryOperationsForLogs",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteFlowLogs",
"logs:CreateDelivery",
"logs:CreateLogGroup",
"logs:PutResourcePolicy",
"logs:PutRetentionPolicy",
"logs:PutDeliveryDestination",
"logs:PutDeliverySource",
"logs:CreateLogStream",
"logs:DescribeLogGroups"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSApiLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/api" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSAuditLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/audit" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSAuthenticatorLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/authenticator" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSControllerManagerLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/controllerManager" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSSchedulerLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/scheduler" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForWafLoggingConfigurations",
"Effect" : "Allow",
"Action" : [
"wafv2:PutLoggingConfiguration"
],
"Resource" : "arn:aws:wafv2:*:*:regional/webacl/*",
"Condition" : {
"ArnLike" : {
"wafv2:LogDestinationResource" : "arn:aws:logs:*:*:log-group:*"
},
"StringEquals" : {
"wafv2:LogScope" : "CloudwatchTelemetryRuleManaged",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForWafLogDelivery",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogDelivery"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"wafv2.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForELB",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForBedrock",
"Effect" : "Allow",
"Action" : [
"bedrock-agentcore:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForSecurityHub",
"Effect" : "Allow",
"Action" : [
"securityhub:AllowVendedLogDeliveryForResource",
"securityhub:DescribeHub",
"securityhub:DescribeSecurityHubV2"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForCloudfront",
"Effect" : "Allow",
"Action" : [
"cloudfront:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForCloudTrailLogs",
"Effect" : "Allow",
"Action" : [
"cloudtrail:CreateServiceLinkedChannel",
"cloudtrail:UpdateServiceLinkedChannel",
"cloudtrail:DeleteServiceLinkedChannel"
],
"Resource" : "arn:aws:cloudtrail:*:*:channel/aws-service-channel/cloudwatch/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForManagedLogs",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:PutResourcePolicy",
"logs:PutRetentionPolicy"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:aws/cloudtrail",
"arn:aws:logs:*:*:log-group:aws/cloudtrail/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingListOperations",
"Effect" : "Allow",
"Action" : [
"route53resolver:ListResolverQueryLogConfigs",
"route53resolver:ListResolverQueryLogConfigAssociations"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingGetOperations",
"Effect" : "Allow",
"Action" : [
"route53resolver:GetResolverQueryLogConfig",
"route53resolver:ListTagsForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingConfigCreation",
"Effect" : "Allow",
"Action" : [
"route53resolver:CreateResolverQueryLogConfig",
"route53resolver:TagResource"
],
"Resource" : "arn:aws:route53resolver:*:*:resolver-query-log-config/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingConfigAssociation",
"Effect" : "Allow",
"Action" : [
"route53resolver:AssociateResolverQueryLogConfig"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForRoute53LogDeliverySLR",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : "arn:*:iam::*:role/aws-service-role/route53resolver.amazonaws.com/AWSServiceRoleForRoute53Resolver",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : [
"route53resolver.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"BoolIfExists" : {
"aws:ViaAWSService" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForRoute53LogDelivery",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogDelivery"
],
"Resource" : "*"
},
{
"Sid" : "IAMOperationsForConfigServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
],
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : [
"config.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"BoolIfExists" : {
"aws:ViaAWSService" : "true"
}
}
},
{
"Sid" : "ManagementOperationsForServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"config:PutServiceLinkedConfigurationRecorder",
"config:DeleteServiceLinkedConfigurationRecorder",
"config:AssociateResourceTypes",
"config:DisassociateResourceTypes"
],
"Resource" : [
"arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForObservabilityAdmin_TelemetryEnablement/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ReadOperationsForServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"config:DescribeConfigurationRecorders"
],
"Resource" : [
"*"
],
"Condition" : {
"StringEquals" : {
"config:ConfigurationRecorderServicePrincipal" : [
"telemetry-enablement.observabilityadmin.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
}
]
}
```
## Ulteriori informazioni
+ [Comprendi il controllo delle versioni per le politiche IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Inizia con le policy AWS gestite e passa alle autorizzazioni con privilegi minimi](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)