翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。 # AmazonSecurityLakeAdministrator **説明**: Amazon Security Lake と、Security Lake の管理に必要な関連サービスへのフルアクセスを提供します。 `AmazonSecurityLakeAdministrator` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。 ## このポリシーを使用すると ユーザー、グループおよびロールに `AmazonSecurityLakeAdministrator` をアタッチできます。 ## ポリシーの詳細 + **タイプ**: AWS 管理ポリシー + **作成日時**: 2023 年 5 月 30 日 22:04 UTC + **編集日時:** 2024 年 2 月 23 日 16:01 UTC + **ARN**: `arn:aws:iam::aws:policy/AmazonSecurityLakeAdministrator` ## ポリシーのバージョン **ポリシーのバージョン:** v2 (デフォルト) ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを判断します。 ## JSON ポリシードキュメント ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AllowActionsWithAnyResource", "Effect" : "Allow", "Action" : [ "securitylake:*", "organizations:DescribeOrganization", "organizations:ListDelegatedServicesForAccount", "organizations:ListAccounts", "iam:ListRoles", "ram:GetResourceShareAssociations" ], "Resource" : "*" }, { "Sid" : "AllowActionsWithAnyResourceViaSecurityLake", "Effect" : "Allow", "Action" : [ "glue:CreateCrawler", "glue:StopCrawlerSchedule", "lambda:CreateEventSourceMapping", "lakeformation:GrantPermissions", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:GetDatalakeSettings", "events:ListConnections", "events:ListApiDestinations", "iam:GetRole", "iam:ListAttachedRolePolicies", "kms:DescribeKey" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowManagingSecurityLakeS3Buckets", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketNotification", "s3:PutBucketTagging", "s3:PutEncryptionConfiguration", "s3:PutBucketVersioning", "s3:PutReplicationConfiguration", "s3:PutLifecycleConfiguration", "s3:ListBucket", "s3:PutObject", "s3:GetBucketNotification" ], "Resource" : "arn:aws:s3:::aws-security-data-lake*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowLambdaCreateFunction", "Effect" : "Allow", "Action" : [ "lambda:CreateFunction" ], "Resource" : [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLake*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowLambdaAddPermission", "Effect" : "Allow", "Action" : [ "lambda:AddPermission" ], "Resource" : [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLake*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" }, "StringEquals" : { "lambda:Principal" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowGlueActions", "Effect" : "Allow", "Action" : [ "glue:CreateDatabase", "glue:GetDatabase", "glue:CreateTable", "glue:GetTable" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowEventBridgeActions", "Effect" : "Allow", "Action" : [ "events:PutTargets", "events:PutRule", "events:DescribeRule", "events:CreateApiDestination", "events:CreateConnection", "events:UpdateConnection", "events:UpdateApiDestination", "events:DeleteConnection", "events:DeleteApiDestination", "events:ListTargetsByRule", "events:RemoveTargets", "events:DeleteRule" ], "Resource" : [ "arn:aws:events:*:*:rule/AmazonSecurityLake*", "arn:aws:events:*:*:rule/SecurityLake*", "arn:aws:events:*:*:api-destination/AmazonSecurityLake*", "arn:aws:events:*:*:connection/AmazonSecurityLake*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowSQSActions", "Effect" : "Allow", "Action" : [ "sqs:CreateQueue", "sqs:SetQueueAttributes", "sqs:GetQueueURL", "sqs:AddPermission", "sqs:GetQueueAttributes", "sqs:DeleteQueue" ], "Resource" : [ "arn:aws:sqs:*:*:SecurityLake*", "arn:aws:sqs:*:*:AmazonSecurityLake*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowKmsCmkGrantForSecurityLake", "Effect" : "Allow", "Action" : "kms:CreateGrant", "Resource" : "arn:aws:kms:*:*:key/*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" }, "StringLike" : { "kms:EncryptionContext:aws:s3:arn" : "arn:aws:s3:::aws-security-data-lake*" }, "ForAllValues:StringEquals" : { "kms:GrantOperations" : [ "GenerateDataKey", "RetireGrant", "Decrypt" ] } } }, { "Sid" : "AllowEnablingQueryBasedSubscribers", "Effect" : "Allow", "Action" : [ "ram:CreateResourceShare", "ram:AssociateResourceShare" ], "Resource" : "*", "Condition" : { "StringLikeIfExists" : { "ram:ResourceArn" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/amazon_security_lake_glue_db*", "arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowConfiguringQueryBasedSubscribers", "Effect" : "Allow", "Action" : [ "ram:UpdateResourceShare", "ram:GetResourceShares", "ram:DisassociateResourceShare", "ram:DeleteResourceShare" ], "Resource" : "*", "Condition" : { "StringLike" : { "ram:ResourceShareName" : "LakeFormation*" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowConfiguringCredentialsForSubscriberNotification", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret", "secretsmanager:GetSecretValue", "secretsmanager:PutSecretValue" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:events!connection/AmazonSecurityLake-*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowPassRoleForUpdatingGluePartitionsSecLakeArn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager", "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : "lambda.amazonaws.com" }, "StringLike" : { "iam:AssociatedResourceARN" : "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid" : "AllowPassRoleForUpdatingGluePartitionsLambdaArn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManager", "arn:aws:iam::*:role/service-role/AmazonSecurityLakeMetaStoreManagerV2" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : "lambda.amazonaws.com" }, "StringLike" : { "iam:AssociatedResourceARN" : [ "arn:aws:lambda:*:*:function:SecurityLake_Glue_Partition_Updater_Lambda*", "arn:aws:lambda:*:*:function:AmazonSecurityLake*" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowPassRoleForCrossRegionReplicationSecLakeArn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole", "Condition" : { "StringEquals" : { "iam:PassedToService" : "s3.amazonaws.com" }, "StringLike" : { "iam:AssociatedResourceARN" : "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid" : "AllowPassRoleForCrossRegionReplicationS3Arn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/service-role/AmazonSecurityLakeS3ReplicationRole", "Condition" : { "StringEquals" : { "iam:PassedToService" : "s3.amazonaws.com" }, "StringLike" : { "iam:AssociatedResourceARN" : "arn:aws:s3:::aws-security-data-lake*" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowPassRoleForCustomSourceCrawlerSecLakeArn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*", "Condition" : { "StringEquals" : { "iam:PassedToService" : "glue.amazonaws.com" }, "StringLike" : { "iam:AssociatedResourceARN" : "arn:aws:securitylake:*:*:data-lake/default" } } }, { "Sid" : "AllowPassRoleForCustomSourceCrawlerGlueArn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/service-role/AmazonSecurityLakeCustomDataGlueCrawler*", "Condition" : { "StringEquals" : { "iam:PassedToService" : "glue.amazonaws.com" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowPassRoleForSubscriberNotificationSecLakeArn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge", "Condition" : { "StringEquals" : { "iam:PassedToService" : "events.amazonaws.com" }, "StringLike" : { "iam:AssociatedResourceARN" : "arn:aws:securitylake:*:*:subscriber/*" } } }, { "Sid" : "AllowPassRoleForSubscriberNotificationEventsArn", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/service-role/AmazonSecurityLakeSubscriberEventBridge", "Condition" : { "StringEquals" : { "iam:PassedToService" : "events.amazonaws.com" }, "StringLike" : { "iam:AssociatedResourceARN" : "arn:aws:events:*:*:rule/AmazonSecurityLake*" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowOnboardingToSecurityLakeDependencies", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : [ "arn:aws:iam::*:role/aws-service-role/securitylake.amazonaws.com/AWSServiceRoleForSecurityLake", "arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess", "arn:aws:iam::*:role/aws-service-role/apidestinations.events.amazonaws.com/AWSServiceRoleForAmazonEventBridgeApiDestinations" ], "Condition" : { "StringLike" : { "iam:AWSServiceName" : [ "securitylake.amazonaws.com", "lakeformation.amazonaws.com", "apidestinations.events.amazonaws.com" ] } } }, { "Sid" : "AllowRolePolicyActionsforSubscibersandSources", "Effect" : "Allow", "Action" : [ "iam:CreateRole", "iam:PutRolePolicy", "iam:DeleteRolePolicy" ], "Resource" : "arn:aws:iam::*:role/AmazonSecurityLake*", "Condition" : { "StringEquals" : { "iam:PermissionsBoundary" : "arn:aws:iam::aws:policy/AmazonSecurityLakePermissionsBoundary" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowRegisterS3LocationInLakeFormation", "Effect" : "Allow", "Action" : [ "iam:PutRolePolicy", "iam:GetRolePolicy" ], "Resource" : "arn:aws:iam::*:role/aws-service-role/lakeformation.amazonaws.com/AWSServiceRoleForLakeFormationDataAccess", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "AllowIAMActionsByResource", "Effect" : "Allow", "Action" : [ "iam:ListRolePolicies", "iam:DeleteRole" ], "Resource" : "arn:aws:iam::*:role/AmazonSecurityLake*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : "securitylake.amazonaws.com" } } }, { "Sid" : "S3ReadAccessToSecurityLakes", "Effect" : "Allow", "Action" : [ "s3:Get*", "s3:List*" ], "Resource" : "arn:aws:s3:::aws-security-data-lake-*" }, { "Sid" : "S3ReadAccessToSecurityLakeMetastoreObject", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource" : "arn:aws:s3:::security-lake-meta-store-manager-*" }, { "Sid" : "S3ResourcelessReadOnly", "Effect" : "Allow", "Action" : [ "s3:GetAccountPublicAccessBlock", "s3:ListAccessPoints", "s3:ListAllMyBuckets" ], "Resource" : "*" } ] } ``` ## 詳細情報 + [IAM Identity Center で AWS マネージドポリシーを使用してアクセス許可セットを作成する](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [IAM ID のアクセス許可の追加および削除](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [AWS 管理ポリシーを開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)