翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。 # AWSObservabilityAdminTelemetryEnablementServiceRolePolicy **説明**: ログ、メトリクスなどのリソースの AWS Config レコーダー AWS リソースとテレメトリ設定を管理するためのアクセスを提供します。 `AWSObservabilityAdminTelemetryEnablementServiceRolePolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。 ## このポリシーを使用すると このポリシーは、ユーザーに代わってサービスがアクションを実行することを許可する、サービスリンクロールにアタッチされます。ユーザー、グループおよびロールにこのポリシーはアタッチできません。 ## ポリシーの詳細 + **タイプ**: サービスリンクロールポリシー + **作成日時**: 2025 年 8 月 1 日 18:04 UTC + **編集日時:** 2026 年 4 月 16 日 17:42 UTC + **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSObservabilityAdminTelemetryEnablementServiceRolePolicy` ## ポリシーのバージョン **ポリシーのバージョン:** v9 (デフォルト) ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。 ## JSON ポリシードキュメント ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "TelemetryOperations", "Effect" : "Allow", "Action" : [ "ec2:DescribeFlowLogs", "ec2:DescribeVpcs", "logs:DescribeLogGroups", "logs:DescribeResourcePolicies", "logs:ListLogGroups", "ec2:MonitorInstances", "logs:DescribeDeliverySources" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TagOperationForEC2", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}", "ec2:CreateAction" : "CreateFlowLogs" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TagOperationForLogs", "Effect" : "Allow", "Action" : [ "logs:TagResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TelemetryOperationsForVPCLogs", "Effect" : "Allow", "Action" : [ "ec2:CreateFlowLogs" ], "Resource" : "arn:aws:ec2:*:*:vpc/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForVPCFlowLogs", "Effect" : "Allow", "Action" : [ "ec2:CreateFlowLogs" ], "Resource" : "arn:aws:ec2:*:*:vpc-flow-log/*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAllValues:StringEquals" : { "aws:TagKeys" : "CloudWatchTelemetryRuleManaged" } } }, { "Sid" : "TelemetryOperationsForLogs", "Effect" : "Allow", "Action" : [ "ec2:DeleteFlowLogs", "logs:CreateDelivery", "logs:CreateLogGroup", "logs:PutResourcePolicy", "logs:PutRetentionPolicy", "logs:PutDeliveryDestination", "logs:PutDeliverySource", "logs:CreateLogStream", "logs:DescribeLogGroups" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForEKSApiLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/api" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSAuditLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/audit" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSAuthenticatorLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/authenticator" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSControllerManagerLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/controllerManager" : "true" } } }, { "Sid" : "TelemetryOperationsForEKSSchedulerLogs", "Effect" : "Allow", "Action" : [ "eks:UpdateClusterConfig" ], "Resource" : "arn:aws:eks:*:*:cluster/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Bool" : { "eks:loggingType/scheduler" : "true" } } }, { "Sid" : "TelemetryOperationsForWafLoggingConfigurations", "Effect" : "Allow", "Action" : [ "wafv2:PutLoggingConfiguration" ], "Resource" : "arn:aws:wafv2:*:*:regional/webacl/*", "Condition" : { "ArnLike" : { "wafv2:LogDestinationResource" : "arn:aws:logs:*:*:log-group:*" }, "StringEquals" : { "wafv2:LogScope" : "CloudwatchTelemetryRuleManaged", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForWafLogDelivery", "Effect" : "Allow", "Action" : [ "logs:CreateLogDelivery" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "wafv2.amazonaws.com" ] }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForELB", "Effect" : "Allow", "Action" : [ "elasticloadbalancing:AllowVendedLogDeliveryForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForBedrock", "Effect" : "Allow", "Action" : [ "bedrock-agentcore:AllowVendedLogDeliveryForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForSecurityHub", "Effect" : "Allow", "Action" : [ "securityhub:AllowVendedLogDeliveryForResource", "securityhub:DescribeHub", "securityhub:DescribeSecurityHubV2" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForCloudfront", "Effect" : "Allow", "Action" : [ "cloudfront:AllowVendedLogDeliveryForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForCloudTrailLogs", "Effect" : "Allow", "Action" : [ "cloudtrail:CreateServiceLinkedChannel", "cloudtrail:UpdateServiceLinkedChannel", "cloudtrail:DeleteServiceLinkedChannel" ], "Resource" : "arn:aws:cloudtrail:*:*:channel/aws-service-channel/cloudwatch/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForManagedLogs", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:PutResourcePolicy", "logs:PutRetentionPolicy" ], "Resource" : [ "arn:aws:logs:*:*:log-group:aws/cloudtrail", "arn:aws:logs:*:*:log-group:aws/cloudtrail/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingListOperations", "Effect" : "Allow", "Action" : [ "route53resolver:ListResolverQueryLogConfigs", "route53resolver:ListResolverQueryLogConfigAssociations" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingGetOperations", "Effect" : "Allow", "Action" : [ "route53resolver:GetResolverQueryLogConfig", "route53resolver:ListTagsForResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingConfigCreation", "Effect" : "Allow", "Action" : [ "route53resolver:CreateResolverQueryLogConfig", "route53resolver:TagResource" ], "Resource" : "arn:aws:route53resolver:*:*:resolver-query-log-config/*", "Condition" : { "StringEquals" : { "aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Route53QueryLoggingConfigAssociation", "Effect" : "Allow", "Action" : [ "route53resolver:AssociateResolverQueryLogConfig" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "TelemetryOperationsForRoute53LogDeliverySLR", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : "arn:*:iam::*:role/aws-service-role/route53resolver.amazonaws.com/AWSServiceRoleForRoute53Resolver", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "route53resolver.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "BoolIfExists" : { "aws:ViaAWSService" : "true" } } }, { "Sid" : "TelemetryOperationsForRoute53LogDelivery", "Effect" : "Allow", "Action" : [ "logs:CreateLogDelivery" ], "Resource" : "*" }, { "Sid" : "IAMOperationsForConfigServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "iam:CreateServiceLinkedRole" ], "Resource" : [ "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig" ], "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "config.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "BoolIfExists" : { "aws:ViaAWSService" : "true" } } }, { "Sid" : "ManagementOperationsForServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "config:PutServiceLinkedConfigurationRecorder", "config:DeleteServiceLinkedConfigurationRecorder", "config:AssociateResourceTypes", "config:DisassociateResourceTypes" ], "Resource" : [ "arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForObservabilityAdmin_TelemetryEnablement/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "ReadOperationsForServiceLinkedRecorder", "Effect" : "Allow", "Action" : [ "config:DescribeConfigurationRecorders" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "config:ConfigurationRecorderServicePrincipal" : [ "telemetry-enablement.observabilityadmin.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] } ``` ## 詳細情報 + [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [AWS 管理ポリシーの使用を開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)