翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
# AWSLicenseManagerMasterAccountRolePolicy
**説明**: AWS License Manager サービスマスターアカウントロールポリシー
`AWSLicenseManagerMasterAccountRolePolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。
## このポリシーを使用すると
このポリシーは、ユーザーに代わってサービスがアクションを実行することを許可する、サービスリンクロールにアタッチされます。ユーザー、グループおよびロールにこのポリシーはアタッチできません。
## ポリシーの詳細
+ **タイプ**: サービスリンクロールポリシー
+ **作成日時**: 2018 年 11 月 26 日 19:03 UTC
+ **編集日時:** 2022 年 5 月 31 日 20:50 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSLicenseManagerMasterAccountRolePolicy`
## ポリシーのバージョン
**ポリシーのバージョン:** v5 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを判断します。
## JSON ポリシードキュメント
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "S3BucketPermissions",
"Effect" : "Allow",
"Action" : [
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:GetLifecycleConfiguration",
"s3:PutLifecycleConfiguration",
"s3:GetBucketPolicy",
"s3:PutBucketPolicy"
],
"Resource" : [
"arn:aws:s3:::aws-license-manager-service-*"
]
},
{
"Sid" : "S3ObjectPermissions1",
"Effect" : "Allow",
"Action" : [
"s3:AbortMultipartUpload",
"s3:PutObject",
"s3:GetObject",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts"
],
"Resource" : [
"arn:aws:s3:::aws-license-manager-service-*"
]
},
{
"Sid" : "S3ObjectPermissions2",
"Effect" : "Allow",
"Action" : [
"s3:DeleteObject"
],
"Resource" : [
"arn:aws:s3:::aws-license-manager-service-*/resource_sync/*"
]
},
{
"Sid" : "AthenaPermissions",
"Effect" : "Allow",
"Action" : [
"athena:GetQueryExecution",
"athena:GetQueryResults",
"athena:StartQueryExecution"
],
"Resource" : [
"*"
]
},
{
"Sid" : "GluePermissions",
"Effect" : "Allow",
"Action" : [
"glue:GetTable",
"glue:GetPartition",
"glue:GetPartitions"
],
"Resource" : [
"*"
]
},
{
"Sid" : "OrganizationPermissions",
"Effect" : "Allow",
"Action" : [
"organizations:DescribeOrganization",
"organizations:ListAccounts",
"organizations:DescribeAccount",
"organizations:ListChildren",
"organizations:ListParents",
"organizations:ListAccountsForParent",
"organizations:ListRoots",
"organizations:ListAWSServiceAccessForOrganization"
],
"Resource" : [
"*"
]
},
{
"Sid" : "RAMPermissions1",
"Effect" : "Allow",
"Action" : [
"ram:GetResourceShares",
"ram:GetResourceShareAssociations",
"ram:TagResource"
],
"Resource" : [
"*"
]
},
{
"Sid" : "RAMPermissions2",
"Effect" : "Allow",
"Action" : [
"ram:CreateResourceShare"
],
"Resource" : [
"*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/Service" : "LicenseManager"
}
}
},
{
"Sid" : "RAMPermissions3",
"Effect" : "Allow",
"Action" : [
"ram:AssociateResourceShare",
"ram:DisassociateResourceShare",
"ram:UpdateResourceShare",
"ram:DeleteResourceShare"
],
"Resource" : [
"*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/Service" : "LicenseManager"
}
}
},
{
"Sid" : "IAMGetRoles",
"Effect" : "Allow",
"Action" : [
"iam:GetRole"
],
"Resource" : [
"*"
]
},
{
"Sid" : "IAMPassRoles",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/LicenseManagerServiceResourceDataSyncRole*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"cloudformation.amazonaws.com",
"glue.amazonaws.com"
]
}
}
},
{
"Sid" : "CloudformationPermission",
"Effect" : "Allow",
"Action" : [
"cloudformation:UpdateStack",
"cloudformation:CreateStack",
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks"
],
"Resource" : [
"arn:aws:cloudformation:*:*:stack/LicenseManagerCrossAccountCloudDiscoveryStack/*"
]
},
{
"Sid" : "GlueUpdatePermissions",
"Effect" : "Allow",
"Action" : [
"glue:CreateTable",
"glue:UpdateTable",
"glue:DeleteTable",
"glue:UpdateJob",
"glue:UpdateCrawler"
],
"Resource" : [
"arn:aws:glue:*:*:catalog",
"arn:aws:glue:*:*:crawler/LicenseManagerResourceSynDataCrawler",
"arn:aws:glue:*:*:job/LicenseManagerResourceSynDataProcessJob",
"arn:aws:glue:*:*:table/license_manager_resource_inventory_db/*",
"arn:aws:glue:*:*:table/license_manager_resource_sync/*",
"arn:aws:glue:*:*:database/license_manager_resource_inventory_db",
"arn:aws:glue:*:*:database/license_manager_resource_sync"
]
},
{
"Sid" : "RGPermissions",
"Effect" : "Allow",
"Action" : [
"resource-groups:PutGroupPolicy"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"ram.amazonaws.com"
]
}
}
}
]
}
```
## 詳細情報
+ [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [AWS 管理ポリシーの使用を開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)