As traduções são geradas por tradução automática. Em caso de conflito entre o conteúdo da tradução e da versão original em inglês, a versão em inglês prevalecerá.
# AWSQuickSetupPatchPolicyPermissionsBoundary
**Descrição**: QuickSetup cria funções do IAM que permitem configurar o recurso Systems Manager Patch Manager em seu nome e usa essa política ao criar essas funções para definir o limite de suas permissões.
`AWSQuickSetupPatchPolicyPermissionsBoundary` é uma [política gerenciada pelo AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Utilização desta política
Você pode vincular a `AWSQuickSetupPatchPolicyPermissionsBoundary` aos seus usuários, grupos e perfis.
## Detalhes desta política
+ **Tipo**: política AWS gerenciada
+ **Hora da criação**: 26 de junho de 2024, 9:46 UTC
+ **Horário editado:** 05 de março de 2026, 16:57 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyPermissionsBoundary`
## Versão da política
**Versão da política:** v5 (padrão)
A versão padrão da política é aquela que define as permissões desta política. Quando um usuário ou função da política faz uma solicitação para acessar um AWS recurso, AWS verifica a versão padrão da política para determinar se a solicitação deve ser permitida.
## Documento da política JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "PatchingAutomationRoleGetPermissions",
"Effect" : "Allow",
"Action" : [
"iam:GetRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
]
},
{
"Sid" : "PatchingAutomationRolePassPermissions",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"ssm.amazonaws.com"
]
}
}
},
{
"Sid" : "DefaultInstanceRolePermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole",
"iam:DeleteRole",
"iam:UpdateRole",
"iam:GetRole"
],
"Condition" : {
"StringLike" : {
"aws:PrincipalTag/QuickSetupManagerID" : "*"
},
"ArnLike" : {
"aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource" : [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid" : "DefaultInstanceRolePassPermissions",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/AmazonSSMRoleForInstancesQuickSetup"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"ec2.amazonaws.com",
"ssm.amazonaws.com"
]
}
}
},
{
"Sid" : "PoliciesAttachPermissions",
"Effect" : "Allow",
"Action" : [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Condition" : {
"ArnEquals" : {
"iam:PolicyARN" : [
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore",
"arn:aws:iam::aws:policy/AWSQuickSetupPatchPolicyBaselineAccess"
]
},
"StringLike" : {
"aws:PrincipalTag/QuickSetupManagerID" : "*"
},
"ArnLike" : {
"aws:PrincipalArn" : "arn:aws:iam::*:role/AWS-QuickSetup-AutomationRole-*"
}
},
"Resource" : "arn:aws:iam::*:role/*"
},
{
"Sid" : "CreateSLRPermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateServiceLinkedRole"
],
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM"
],
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "ssm.amazonaws.com"
}
}
},
{
"Sid" : "InstanceRoleAddPermissions",
"Effect" : "Allow",
"Action" : [
"iam:AddRoleToInstanceProfile"
],
"Resource" : [
"*"
]
},
{
"Sid" : "ManagedInstanceRoleUpdatePermissions",
"Effect" : "Allow",
"Action" : [
"ssm:UpdateManagedInstanceRole"
],
"Resource" : "*"
},
{
"Sid" : "IAMReadOnlyPermissions",
"Effect" : "Allow",
"Action" : [
"iam:GetInstanceProfile",
"iam:GetRolePolicy",
"iam:ListInstanceProfilesForRole",
"iam:ListRoles"
],
"Resource" : [
"*"
]
},
{
"Sid" : "InstanceProfileCreatePermissions",
"Effect" : "Allow",
"Action" : [
"iam:CreateInstanceProfile"
],
"Resource" : [
"arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
]
},
{
"Sid" : "InstanceProfileAssociationPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:AssociateIamInstanceProfile"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"ec2:InstanceProfile" : "true"
},
"ArnLike" : {
"ec2:NewInstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid" : "InstanceProfileDisassociationPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:DisassociateIamInstanceProfile"
],
"Resource" : "*",
"Condition" : {
"ArnLike" : {
"ec2:InstanceProfile" : "arn:aws:iam::*:instance-profile/AmazonSSMRoleForInstancesQuickSetup"
}
}
},
{
"Sid" : "SSMAssociationsPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeAssociationExecutions",
"ssm:UpdateAssociation",
"ssm:DescribeAssociation"
],
"Resource" : [
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ec2:*:*:instance/*",
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:ssm:*:*:association/*"
]
},
{
"Sid" : "BaselineS3Permissions",
"Effect" : "Allow",
"Action" : [
"s3:CreateBucket",
"s3:Put*",
"s3:Get*",
"s3:List*",
"s3:DeleteObject",
"s3:DeleteObjectVersion",
"s3:DeleteBucket"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : [
"${aws:PrincipalAccount}"
]
}
},
"Resource" : "arn:aws:s3:::aws-quicksetup-patchpolicy-*"
},
{
"Sid" : "PatchingFunctionsPermissions",
"Effect" : "Allow",
"Action" : [
"lambda:InvokeFunction"
],
"Resource" : [
"arn:aws:lambda:*:*:function:baseline-overrides-*",
"arn:aws:lambda:*:*:function:delete-name-tags-*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : [
"${aws:PrincipalAccount}"
]
}
}
},
{
"Sid" : "LoggingPermissions",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogStream",
"logs:CreateLogGroup",
"logs:PutLogEvents"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:/aws/lambda/baseline-overrides-*",
"arn:aws:logs:*:*:log-group:/aws/lambda/delete-name-tags-*"
]
},
{
"Sid" : "SSMTaggingPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:AddTagsToResource",
"ssm:RemoveTagsFromResource"
],
"Resource" : "arn:aws:ssm:*:*:managed-instance/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigName-*"
}
}
},
{
"Sid" : "EC2TaggingPermissions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigName-*"
}
}
},
{
"Sid" : "RoleTaggingPermissions",
"Effect" : "Allow",
"Action" : [
"iam:TagRole",
"iam:UntagRole"
],
"Resource" : "*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : "QSConfigId-*"
}
}
},
{
"Sid" : "PatchingReadOnlyPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:GetPatchBaseline",
"ssm:GetInventory",
"ssm:DescribeInstanceInformation",
"ssm:DescribeAssociation",
"ssm:GetAutomationExecution",
"ssm:ListTagsForResource",
"ec2:DescribeIamInstanceProfileAssociations",
"ec2:DescribeInstances"
],
"Resource" : "*"
},
{
"Sid" : "PatchingAutomationsStartPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:StartAutomationExecution"
],
"Resource" : [
"arn:aws:ssm:*:*:automation-definition/AWS-EnableExplorer*",
"arn:aws:ssm:*:*:automation-definition/AWS-RunPatchBaseline*",
"arn:aws:ssm:*:*:automation-definition/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:automation-definition/QuickSetup-*",
"arn:aws:ssm:*:*:automation-definition/AWSQuickSetup-*",
"arn:aws:ssm:*:*:document/AWS-EnableExplorer*",
"arn:aws:ssm:*:*:document/AWS-RunPatchBaseline*",
"arn:aws:ssm:*:*:document/AWS-AttachIAMToInstance*",
"arn:aws:ssm:*:*:document/QuickSetup-*",
"arn:aws:ssm:*:*:document/AWSQuickSetup-*",
"arn:aws:ssm:*:*:automation-execution/*"
]
},
{
"Sid" : "ReadOnlyPermissionsForEnablingExplorer",
"Effect" : "Allow",
"Action" : [
"iam:ListRoles",
"config:DescribeConfigurationRecorders",
"compute-optimizer:GetEnrollmentStatus",
"support:DescribeTrustedAdvisorChecks"
],
"Resource" : "*"
},
{
"Sid" : "ExplorerServiceSettingsPermissions",
"Effect" : "Allow",
"Action" : [
"ssm:UpdateServiceSetting",
"ssm:GetServiceSetting"
],
"Resource" : [
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/ssm-patchmanager",
"arn:aws:ssm:*:*:servicesetting/ssm/opsitem/EC2",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ExplorerOnboarded",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/Association",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ComputeOptimizer",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/ConfigCompliance",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/OpsData-TrustedAdvisor",
"arn:aws:ssm:*:*:servicesetting/ssm/opsdata/SupportCenterCase"
]
}
]
}
```
## Saiba mais
+ [Crie um conjunto de permissões usando políticas AWS gerenciadas no IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [Adicionar e remover permissões de identidade IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [Compreenda o controle de versionamento das políticas do IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Comece com políticas AWS gerenciadas e adote permissões com privilégios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)