기계 번역으로 제공되는 번역입니다. 제공된 번역과 원본 영어의 내용이 상충하는 경우에는 영어 버전이 우선합니다. # BatchServiceRolePolicy **설명**: AWS 배치 서비스가 Amazon EC2 및 Amazon ECS 리소스를 포함하여 필요한 리소스를 관리할 수 있는 액세스 권한을 제공합니다. `BatchServiceRolePolicy`은(는) [AWS 관리형 정책](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)입니다. ## 이 정책 사용 이 정책은 서비스에서 사용자를 대신하여 작업을 수행할 수 있도록 서비스 연결 역할에 연결됩니다. 사용자, 그룹 또는 역할에 정책을 연결할 수 없습니다. ## 정책 세부 정보 + **유형**: 서비스 연결 역할 정책 + **생성 시간**: 2021년 3월 10일, 06:55 UTC + **편집된 시간:** 2023년 12월 5일, 22:52 UTC + **ARN**: `arn:aws:iam::aws:policy/aws-service-role/BatchServiceRolePolicy` ## 정책 버전 **정책 버전:** v7(기본값) 정책의 기본 버전은 정책에 대한 권한을 정의하는 버전입니다. 정책이 있는 사용자 또는 역할이 AWS 리소스에 대한 액세스를 요청하면는 정책의 기본 버전을 AWS 확인하여 요청을 허용할지 여부를 결정합니다. ## JSON 정책 문서 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AWSBatchPolicyStatement1", "Effect" : "Allow", "Action" : [ "ec2:DescribeAccountAttributes", "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceAttribute", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeKeyPairs", "ec2:DescribeImages", "ec2:DescribeImageAttribute", "ec2:DescribeSpotInstanceRequests", "ec2:DescribeSpotFleetInstances", "ec2:DescribeSpotFleetRequests", "ec2:DescribeSpotPriceHistory", "ec2:DescribeSpotFleetRequestHistory", "ec2:DescribeVpcClassicLink", "ec2:DescribeLaunchTemplateVersions", "ec2:RequestSpotFleet", "autoscaling:DescribeAccountLimits", "autoscaling:DescribeAutoScalingGroups", "autoscaling:DescribeLaunchConfigurations", "autoscaling:DescribeAutoScalingInstances", "autoscaling:DescribeScalingActivities", "eks:DescribeCluster", "ecs:DescribeClusters", "ecs:DescribeContainerInstances", "ecs:DescribeTaskDefinition", "ecs:DescribeTasks", "ecs:ListClusters", "ecs:ListContainerInstances", "ecs:ListTaskDefinitionFamilies", "ecs:ListTaskDefinitions", "ecs:ListTasks", "ecs:DeregisterTaskDefinition", "ecs:TagResource", "ecs:ListAccountSettings", "logs:DescribeLogGroups", "iam:GetInstanceProfile", "iam:GetRole" ], "Resource" : "*" }, { "Sid" : "AWSBatchPolicyStatement2", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:CreateLogStream" ], "Resource" : "arn:aws:logs:*:*:log-group:/aws/batch/job*" }, { "Sid" : "AWSBatchPolicyStatement3", "Effect" : "Allow", "Action" : [ "logs:PutLogEvents" ], "Resource" : "arn:aws:logs:*:*:log-group:/aws/batch/job*:log-stream:*" }, { "Sid" : "AWSBatchPolicyStatement4", "Effect" : "Allow", "Action" : [ "autoscaling:CreateOrUpdateTags" ], "Resource" : "*", "Condition" : { "Null" : { "aws:RequestTag/AWSBatchServiceTag" : "false" } } }, { "Sid" : "AWSBatchPolicyStatement5", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "ec2.amazonaws.com", "ec2.amazonaws.com.rproxy.goskope.com.cn", "ecs-tasks.amazonaws.com" ] } } }, { "Sid" : "AWSBatchPolicyStatement6", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : "*", "Condition" : { "StringEquals" : { "iam:AWSServiceName" : [ "spot.amazonaws.com", "spotfleet.amazonaws.com", "autoscaling.amazonaws.com", "ecs.amazonaws.com" ] } } }, { "Sid" : "AWSBatchPolicyStatement7", "Effect" : "Allow", "Action" : [ "ec2:CreateLaunchTemplate" ], "Resource" : "*", "Condition" : { "Null" : { "aws:RequestTag/AWSBatchServiceTag" : "false" } } }, { "Sid" : "AWSBatchPolicyStatement8", "Effect" : "Allow", "Action" : [ "ec2:TerminateInstances", "ec2:CancelSpotFleetRequests", "ec2:ModifySpotFleetRequest", "ec2:DeleteLaunchTemplate" ], "Resource" : "*", "Condition" : { "Null" : { "aws:ResourceTag/AWSBatchServiceTag" : "false" } } }, { "Sid" : "AWSBatchPolicyStatement9", "Effect" : "Allow", "Action" : [ "autoscaling:CreateLaunchConfiguration", "autoscaling:DeleteLaunchConfiguration" ], "Resource" : "arn:aws:autoscaling:*:*:launchConfiguration:*:launchConfigurationName/AWSBatch*" }, { "Sid" : "AWSBatchPolicyStatement10", "Effect" : "Allow", "Action" : [ "autoscaling:CreateAutoScalingGroup", "autoscaling:UpdateAutoScalingGroup", "autoscaling:SetDesiredCapacity", "autoscaling:DeleteAutoScalingGroup", "autoscaling:SuspendProcesses", "autoscaling:PutNotificationConfiguration", "autoscaling:TerminateInstanceInAutoScalingGroup" ], "Resource" : "arn:aws:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/AWSBatch*" }, { "Sid" : "AWSBatchPolicyStatement11", "Effect" : "Allow", "Action" : [ "ecs:DeleteCluster", "ecs:DeregisterContainerInstance", "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource" : "arn:aws:ecs:*:*:cluster/AWSBatch*" }, { "Sid" : "AWSBatchPolicyStatement12", "Effect" : "Allow", "Action" : [ "ecs:RunTask", "ecs:StartTask", "ecs:StopTask" ], "Resource" : "arn:aws:ecs:*:*:task-definition/*" }, { "Sid" : "AWSBatchPolicyStatement13", "Effect" : "Allow", "Action" : [ "ecs:StopTask" ], "Resource" : "arn:aws:ecs:*:*:task/*/*" }, { "Sid" : "AWSBatchPolicyStatement14", "Effect" : "Allow", "Action" : [ "ecs:CreateCluster", "ecs:RegisterTaskDefinition" ], "Resource" : "*", "Condition" : { "Null" : { "aws:RequestTag/AWSBatchServiceTag" : "false" } } }, { "Sid" : "AWSBatchPolicyStatement15", "Effect" : "Allow", "Action" : "ec2:RunInstances", "Resource" : [ "arn:aws:ec2:*::image/*", "arn:aws:ec2:*::snapshot/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:volume/*", "arn:aws:ec2:*:*:key-pair/*", "arn:aws:ec2:*:*:launch-template/*", "arn:aws:ec2:*:*:placement-group/*", "arn:aws:ec2:*:*:capacity-reservation/*", "arn:aws:ec2:*:*:elastic-gpu/*", "arn:aws:elastic-inference:*:*:elastic-inference-accelerator/*", "arn:aws:resource-groups:*:*:group/*" ] }, { "Sid" : "AWSBatchPolicyStatement16", "Effect" : "Allow", "Action" : "ec2:RunInstances", "Resource" : "arn:aws:ec2:*:*:instance/*", "Condition" : { "Null" : { "aws:RequestTag/AWSBatchServiceTag" : "false" } } }, { "Sid" : "AWSBatchPolicyStatement17", "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "ec2:CreateAction" : [ "RunInstances", "CreateLaunchTemplate", "RequestSpotFleet" ] } } } ] } ``` ## 자세히 알아보기 + [IAM 정책의 버전 관리 이해](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [AWS 관리형 정책을 시작하고 최소 권한으로 전환](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)