Le traduzioni sono generate tramite traduzione automatica. In caso di conflitto tra il contenuto di una traduzione e la versione originale in Inglese, quest'ultima prevarrà.
# AWSQuickSetupPatchPolicyDeploymentRolePolicy
**Descrizione**: fornisce le autorizzazioni che consentono a Quick Setup di creare risorse associate a una configurazione di policy di patch.
`AWSQuickSetupPatchPolicyDeploymentRolePolicy`è una [politica AWS gestita](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Utilizzo di questa politica
È possibile associare la policy `AWSQuickSetupPatchPolicyDeploymentRolePolicy` a utenti, gruppi e ruoli.
## Dettagli della policy
+ **Tipo**: politica AWS gestita
+ **Ora di creazione**: 26 giugno 2024, 09:57 UTC
+ **Ora modificata: 26 giugno 2024**, 09:57 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyDeploymentRolePolicy`
## Versione della politica
**Versione della politica:** v1 (predefinita)
La versione predefinita della politica è la versione che definisce le autorizzazioni per la politica. Quando un utente o un ruolo con la politica effettua una richiesta di accesso a una AWS risorsa, AWS controlla la versione predefinita della politica per determinare se consentire la richiesta.
## Documento di policy JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "CfnRead",
"Effect" : "Allow",
"Action" : [
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackDriftDetectionStatus",
"cloudformation:ListStacks"
],
"Resource" : [
"*"
]
},
{
"Sid" : "CfnManage",
"Effect" : "Allow",
"Action" : [
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:CreateChangeSet",
"cloudformation:DeleteChangeSet",
"cloudformation:ExecuteChangeSet",
"cloudformation:DescribeChangeSet",
"cloudformation:DescribeStackResourceDrifts",
"cloudformation:DetectStackDrift",
"cloudformation:DetectStackResourceDrift"
],
"Resource" : [
"arn:aws:cloudformation:*:*:stack/StackSet-AWS-QuickSetup-*"
]
},
{
"Sid" : "RGroupsGet",
"Effect" : "Allow",
"Action" : [
"resource-groups:GetGroupQuery"
],
"Resource" : [
"*"
]
},
{
"Sid" : "S3BucketsList",
"Effect" : "Allow",
"Action" : [
"s3:ListAllMyBuckets"
],
"Resource" : [
"*"
]
},
{
"Sid" : "AccessLogsBucketManage",
"Effect" : "Allow",
"Action" : [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:DeleteBucketPolicy",
"s3:Put*",
"s3:Get*",
"s3:List*"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
},
"Resource" : [
"arn:aws:s3:::aws-quicksetup-patchpolicy-access-log-*"
]
},
{
"Sid" : "LambdaManage",
"Effect" : "Allow",
"Action" : [
"lambda:CreateFunction",
"lambda:UpdateFunction*",
"lambda:GetFunction",
"lambda:ListTags",
"lambda:TagResource",
"lambda:DeleteFunction",
"lambda:InvokeFunction",
"lambda:UntagResource"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : [
"${aws:PrincipalAccount}"
]
}
},
"Resource" : [
"arn:aws:lambda:*:*:function:baseline-overrides-*",
"arn:aws:lambda:*:*:function:delete-name-tags-*"
]
},
{
"Sid" : "LogGroupsDescribe",
"Effect" : "Allow",
"Action" : [
"logs:DescribeLogGroups"
],
"Resource" : "*"
},
{
"Sid" : "LogGroupsManage",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:TagResource",
"logs:PutRetentionPolicy",
"logs:DeleteLogGroup",
"logs:ListTagsForResource",
"logs:UntagResource"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
},
"Resource" : [
"arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*",
"arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*"
]
},
{
"Sid" : "QSDocsManage",
"Effect" : "Allow",
"Action" : [
"ssm:CreateDocument",
"ssm:UpdateDocument",
"ssm:DescribeDocument",
"ssm:UpdateDocumentDefaultVersion",
"ssm:DeleteDocument",
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource",
"ssm:ListTagsForResource"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
},
"Resource" : [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/QuickSetup-*"
]
},
{
"Sid" : "QSDocsGet",
"Effect" : "Allow",
"Action" : [
"ssm:GetDocument"
],
"Resource" : [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/QuickSetup-*",
"arn:aws:ssm:*::document/AWS-EnableExplorer",
"arn:aws:ssm:*::document/AWS-RunPatchBaseline"
]
},
{
"Sid" : "QSAssociationsManage",
"Effect" : "Allow",
"Action" : [
"ssm:CreateAssociation",
"ssm:UpdateAssociation",
"ssm:DeleteAssociation",
"ssm:DescribeAssociation"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
},
"Resource" : [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/QuickSetup-*",
"arn:aws:ssm:*::document/AWS-EnableExplorer",
"arn:aws:ssm:*::document/AWS-RunPatchBaseline",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:ssm:*:*:association/*"
]
},
{
"Sid" : "SSMSLRCreate",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "ssm.amazonaws.com"
}
}
},
{
"Sid" : "ConfigRoleManage",
"Effect" : "Allow",
"Action" : [
"iam:TagRole",
"iam:UntagRole",
"iam:GetRole",
"iam:UpdateRole",
"iam:DeleteRole",
"iam:GetRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:ListRoleTags"
],
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
},
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
]
},
{
"Sid" : "ConfigRolePassToSSM",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid" : "ConfigRolePassToLambda",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"lambda.amazonaws.com"
]
}
}
},
{
"Sid" : "DocDescribe",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeDocument"
],
"Resource" : "*"
},
{
"Sid" : "LegacyDocClean",
"Effect" : "Allow",
"Action" : [
"ssm:DeleteDocument"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"aws:ResourceTag/QuickSetupID" : "*"
}
}
},
{
"Sid" : "LegacyIAMClean",
"Effect" : "Allow",
"Action" : [
"iam:DeleteRole",
"iam:DeleteRolePolicy"
],
"Resource" : "arn:aws:iam::*:role/*QuickSetup-*",
"Condition" : {
"StringLike" : {
"aws:ResourceTag/QuickSetupID" : "*"
}
}
},
{
"Sid" : "ConfigRoleBoundedManage",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole",
"iam:AttachRolePolicy",
"iam:DeleteRolePolicy",
"iam:DetachRolePolicy",
"iam:PutRolePolicy",
"iam:PutRolePermissionsBoundary"
],
"Condition" : {
"StringEquals" : {
"iam:PermissionsBoundary" : "arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary"
},
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudformation.amazonaws.com"
]
}
},
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-*"
]
}
]
}
```
## Ulteriori informazioni
+ [Crea un set di autorizzazioni utilizzando le policy AWS gestite in IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [Aggiungere e rimuovere i permessi di identità IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [Comprendi il controllo delle versioni per le politiche IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Inizia con le policy AWS gestite e passa alle autorizzazioni con privilegi minimi](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)