As traduções são geradas por tradução automática. Em caso de conflito entre o conteúdo da tradução e da versão original em inglês, a versão em inglês prevalecerá.
# AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
**Descrição**: fornece acesso para gerenciar os recursos do gravador AWS Config e as configurações de telemetria em AWS recursos, incluindo registros e métricas.
`AWSObservabilityAdminTelemetryEnablementServiceRolePolicy` é uma [política gerenciada pelo AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Utilização desta política
Essa política é vinculada a uma função associada a um serviço, o que possibilita que este serviço execute ações em seu próprio nome. Não é possível vincular esta política a usuários, grupos ou funções.
## Detalhes desta política
+ **Tipo**: Política de função vinculada ao serviço
+ **Horário de criação**: 01 de agosto de 2025, 18:04 UTC
+ **Horário editado:** 16 de abril de 2026, 17:42 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSObservabilityAdminTelemetryEnablementServiceRolePolicy`
## Versão da política
**Versão da política:** v9 (padrão)
A versão padrão da política é aquela que define as permissões desta política. Quando um usuário ou função da política faz uma solicitação para acessar um AWS recurso, AWS verifica a versão padrão da política para determinar se a solicitação deve ser permitida.
## Documento da política JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "TelemetryOperations",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeFlowLogs",
"ec2:DescribeVpcs",
"logs:DescribeLogGroups",
"logs:DescribeResourcePolicies",
"logs:ListLogGroups",
"ec2:MonitorInstances",
"logs:DescribeDeliverySources"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TagOperationForEC2",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"ec2:CreateAction" : "CreateFlowLogs"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TagOperationForLogs",
"Effect" : "Allow",
"Action" : [
"logs:TagResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TelemetryOperationsForVPCLogs",
"Effect" : "Allow",
"Action" : [
"ec2:CreateFlowLogs"
],
"Resource" : "arn:aws:ec2:*:*:vpc/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForVPCFlowLogs",
"Effect" : "Allow",
"Action" : [
"ec2:CreateFlowLogs"
],
"Resource" : "arn:aws:ec2:*:*:vpc-flow-log/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : "CloudWatchTelemetryRuleManaged"
}
}
},
{
"Sid" : "TelemetryOperationsForLogs",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteFlowLogs",
"logs:CreateDelivery",
"logs:CreateLogGroup",
"logs:PutResourcePolicy",
"logs:PutRetentionPolicy",
"logs:PutDeliveryDestination",
"logs:PutDeliverySource",
"logs:CreateLogStream",
"logs:DescribeLogGroups"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSApiLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/api" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSAuditLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/audit" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSAuthenticatorLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/authenticator" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSControllerManagerLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/controllerManager" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForEKSSchedulerLogs",
"Effect" : "Allow",
"Action" : [
"eks:UpdateClusterConfig"
],
"Resource" : "arn:aws:eks:*:*:cluster/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"Bool" : {
"eks:loggingType/scheduler" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForWafLoggingConfigurations",
"Effect" : "Allow",
"Action" : [
"wafv2:PutLoggingConfiguration"
],
"Resource" : "arn:aws:wafv2:*:*:regional/webacl/*",
"Condition" : {
"ArnLike" : {
"wafv2:LogDestinationResource" : "arn:aws:logs:*:*:log-group:*"
},
"StringEquals" : {
"wafv2:LogScope" : "CloudwatchTelemetryRuleManaged",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForWafLogDelivery",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogDelivery"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"wafv2.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForELB",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForBedrock",
"Effect" : "Allow",
"Action" : [
"bedrock-agentcore:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForSecurityHub",
"Effect" : "Allow",
"Action" : [
"securityhub:AllowVendedLogDeliveryForResource",
"securityhub:DescribeHub",
"securityhub:DescribeSecurityHubV2"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForCloudfront",
"Effect" : "Allow",
"Action" : [
"cloudfront:AllowVendedLogDeliveryForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForCloudTrailLogs",
"Effect" : "Allow",
"Action" : [
"cloudtrail:CreateServiceLinkedChannel",
"cloudtrail:UpdateServiceLinkedChannel",
"cloudtrail:DeleteServiceLinkedChannel"
],
"Resource" : "arn:aws:cloudtrail:*:*:channel/aws-service-channel/cloudwatch/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForManagedLogs",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:PutResourcePolicy",
"logs:PutRetentionPolicy"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:aws/cloudtrail",
"arn:aws:logs:*:*:log-group:aws/cloudtrail/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingListOperations",
"Effect" : "Allow",
"Action" : [
"route53resolver:ListResolverQueryLogConfigs",
"route53resolver:ListResolverQueryLogConfigAssociations"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingGetOperations",
"Effect" : "Allow",
"Action" : [
"route53resolver:GetResolverQueryLogConfig",
"route53resolver:ListTagsForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingConfigCreation",
"Effect" : "Allow",
"Action" : [
"route53resolver:CreateResolverQueryLogConfig",
"route53resolver:TagResource"
],
"Resource" : "arn:aws:route53resolver:*:*:resolver-query-log-config/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "Route53QueryLoggingConfigAssociation",
"Effect" : "Allow",
"Action" : [
"route53resolver:AssociateResolverQueryLogConfig"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/CloudWatchTelemetryRuleManaged" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "TelemetryOperationsForRoute53LogDeliverySLR",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : "arn:*:iam::*:role/aws-service-role/route53resolver.amazonaws.com/AWSServiceRoleForRoute53Resolver",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : [
"route53resolver.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"BoolIfExists" : {
"aws:ViaAWSService" : "true"
}
}
},
{
"Sid" : "TelemetryOperationsForRoute53LogDelivery",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogDelivery"
],
"Resource" : "*"
},
{
"Sid" : "IAMOperationsForConfigServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
],
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : [
"config.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"BoolIfExists" : {
"aws:ViaAWSService" : "true"
}
}
},
{
"Sid" : "ManagementOperationsForServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"config:PutServiceLinkedConfigurationRecorder",
"config:DeleteServiceLinkedConfigurationRecorder",
"config:AssociateResourceTypes",
"config:DisassociateResourceTypes"
],
"Resource" : [
"arn:aws:config:*:*:configuration-recorder/AWSConfigurationRecorderForObservabilityAdmin_TelemetryEnablement/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ReadOperationsForServiceLinkedRecorder",
"Effect" : "Allow",
"Action" : [
"config:DescribeConfigurationRecorders"
],
"Resource" : [
"*"
],
"Condition" : {
"StringEquals" : {
"config:ConfigurationRecorderServicePrincipal" : [
"telemetry-enablement.observabilityadmin.amazonaws.com"
],
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
}
]
}
```
## Saiba mais
+ [Compreenda o controle de versionamento das políticas do IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Comece com políticas AWS gerenciadas e adote permissões com privilégios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)