As traduções são geradas por tradução automática. Em caso de conflito entre o conteúdo da tradução e da versão original em inglês, a versão em inglês prevalecerá.
# AWSSSMForSAPServiceLinkedRolePolicy
**Descrição**: Fornece ao AWS Systems Manager for SAP as permissões necessárias para gerenciar e integrar o software SAP com AWS o.
`AWSSSMForSAPServiceLinkedRolePolicy` é uma [política gerenciada pelo AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Utilização desta política
Essa política é vinculada a uma função associada a um serviço, o que possibilita que este serviço execute ações em seu próprio nome. Não é possível vincular esta política a usuários, grupos ou funções.
## Detalhes desta política
+ **Tipo**: Política de função vinculada ao serviço
+ **Hora da criação**: 16 de novembro de 2022, 1:18 UTC
+ **Horário editado:** 12 de fevereiro de 2026, 18:03 UTC
+ **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AWSSSMForSAPServiceLinkedRolePolicy`
## Versão da política
**Versão da política:** v21 (padrão)
A versão padrão da política é aquela que define as permissões desta política. Quando um usuário ou função da política faz uma solicitação para acessar um AWS recurso, AWS verifica a versão padrão da política para determinar se a solicitação deve ser permitida.
## Documento da política JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "DescribeInstanceActions",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeInstances",
"ec2:DescribeRouteTables",
"ec2:DescribeInstanceTypes",
"ec2:DescribeVolumes",
"ec2:DescribeInstanceAttribute",
"ec2:DescribeSnapshots",
"ec2:DescribeVpcs",
"ssm:GetCommandInvocation",
"ssm:DescribeInstanceInformation"
],
"Resource" : "*"
},
{
"Sid" : "DescribeInstanceStatus",
"Effect" : "Allow",
"Action" : "ec2:DescribeInstanceStatus",
"Resource" : "*"
},
{
"Sid" : "TargetRuleActions",
"Effect" : "Allow",
"Action" : [
"events:DeleteRule",
"events:PutTargets",
"events:DescribeRule",
"events:PutRule",
"events:RemoveTargets"
],
"Resource" : [
"arn:*:events:*:*:rule/SSMSAPManagedRule*",
"arn:*:events:*:*:event-bus/default"
]
},
{
"Sid" : "DocumentActions",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeDocument",
"ssm:SendCommand"
],
"Resource" : [
"arn:*:ssm:*:*:document/AWSSystemsManagerSAP-*",
"arn:*:ssm:*:*:document/AWSSSMSAP*",
"arn:*:ssm:*:*:document/AWSSAP*"
]
},
{
"Sid" : "CustomerSendCommand",
"Effect" : "Allow",
"Action" : "ssm:SendCommand",
"Resource" : "arn:*:ec2:*:*:instance/*",
"Condition" : {
"StringEqualsIgnoreCase" : {
"ssm:resourceTag/SSMForSAPManaged" : "True"
}
}
},
{
"Sid" : "InstanceTagActions",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:*:ec2:*:*:instance/*",
"Condition" : {
"Null" : {
"aws:RequestTag/awsApplication" : "false"
},
"StringEqualsIgnoreCase" : {
"ec2:ResourceTag/SSMForSAPManaged" : "True"
}
}
},
{
"Sid" : "DescribeTag",
"Effect" : "Allow",
"Action" : "ec2:DescribeTags",
"Resource" : "*"
},
{
"Sid" : "GetApplication",
"Effect" : "Allow",
"Action" : "servicecatalog:GetApplication",
"Resource" : "arn:*:servicecatalog:*:*:*"
},
{
"Sid" : "UpdateOrDeleteApplication",
"Effect" : "Allow",
"Action" : [
"servicecatalog:DeleteApplication",
"servicecatalog:UpdateApplication"
],
"Resource" : "arn:*:servicecatalog:*:*:*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/SSMForSAPCreated" : "True"
}
}
},
{
"Sid" : "CreateApplication",
"Effect" : "Allow",
"Action" : [
"servicecatalog:TagResource",
"servicecatalog:CreateApplication"
],
"Resource" : "arn:*:servicecatalog:*:*:*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/SSMForSAPCreated" : "True"
}
}
},
{
"Sid" : "CreateServiceLinkedRole",
"Effect" : "Allow",
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : "arn:aws:iam::*:role/aws-service-role/servicecatalog-appregistry.amazonaws.com/AWSServiceRoleForAWSServiceCatalogAppRegistry",
"Condition" : {
"StringEquals" : {
"iam:AWSServiceName" : "servicecatalog-appregistry.amazonaws.com"
}
}
},
{
"Sid" : "PutMetricData",
"Effect" : "Allow",
"Action" : "cloudwatch:PutMetricData",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"cloudwatch:namespace" : [
"AWS/Usage",
"AWS/SSMForSAP"
]
}
}
},
{
"Sid" : "CreateAttributeGroup",
"Effect" : "Allow",
"Action" : "servicecatalog:CreateAttributeGroup",
"Resource" : "arn:*:servicecatalog:*:*:/attribute-groups/*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/SSMForSAPCreated" : "True"
}
}
},
{
"Sid" : "GetAttributeGroup",
"Effect" : "Allow",
"Action" : "servicecatalog:GetAttributeGroup",
"Resource" : "arn:*:servicecatalog:*:*:/attribute-groups/*"
},
{
"Sid" : "DeleteAttributeGroup",
"Effect" : "Allow",
"Action" : "servicecatalog:DeleteAttributeGroup",
"Resource" : "arn:*:servicecatalog:*:*:/attribute-groups/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/SSMForSAPCreated" : "True"
}
}
},
{
"Sid" : "AttributeGroupActions",
"Effect" : "Allow",
"Action" : [
"servicecatalog:AssociateAttributeGroup",
"servicecatalog:DisassociateAttributeGroup"
],
"Resource" : "arn:*:servicecatalog:*:*:*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/SSMForSAPCreated" : "True"
}
}
},
{
"Sid" : "ListAssociatedAttributeGroups",
"Effect" : "Allow",
"Action" : "servicecatalog:ListAssociatedAttributeGroups",
"Resource" : "arn:*:servicecatalog:*:*:*"
},
{
"Sid" : "CreateGroup",
"Effect" : "Allow",
"Action" : [
"resource-groups:CreateGroup",
"resource-groups:Tag"
],
"Resource" : "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/SSMForSAPCreated" : "True"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : [
"SSMForSAPCreated"
]
}
}
},
{
"Sid" : "GetGroup",
"Effect" : "Allow",
"Action" : "resource-groups:GetGroup",
"Resource" : "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*"
},
{
"Sid" : "DeleteGroup",
"Effect" : "Allow",
"Action" : "resource-groups:DeleteGroup",
"Resource" : "arn:*:resource-groups:*:*:group/SystemsManagerForSAP-*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/SSMForSAPCreated" : "True"
}
}
},
{
"Sid" : "CreateAppTagResourceGroup",
"Effect" : "Allow",
"Action" : [
"resource-groups:CreateGroup"
],
"Resource" : "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/EnableAWSServiceCatalogAppRegistry" : "true"
}
}
},
{
"Sid" : "TagAppTagResourceGroup",
"Effect" : "Allow",
"Action" : [
"resource-groups:Tag"
],
"Resource" : "arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/EnableAWSServiceCatalogAppRegistry" : "true"
}
}
},
{
"Sid" : "GetAppTagResourceGroupConfig",
"Effect" : "Allow",
"Action" : [
"resource-groups:GetGroupConfiguration"
],
"Resource" : [
"arn:*:resource-groups:*:*:group/AWS_AppRegistry_AppTag_*"
]
},
{
"Sid" : "StartStopInstances",
"Effect" : "Allow",
"Action" : [
"ec2:StartInstances",
"ec2:StopInstances"
],
"Resource" : "arn:*:ec2:*:*:instance/*",
"Condition" : {
"StringEqualsIgnoreCase" : {
"ec2:resourceTag/SSMForSAPManaged" : "True"
}
}
},
{
"Sid" : "SsmSapResourceGroup",
"Effect" : "Allow",
"Action" : [
"resource-groups:Tag",
"resource-groups:CreateGroup"
],
"Resource" : "arn:aws:resource-groups:*:*:group/SystemsManagerForSAP-*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/SSMForSAPCreated" : "True"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : [
"SSMForSAPCreated"
]
}
}
},
{
"Sid" : "ManageSsmSapTagsOnEc2Instances",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:aws:ec2:*:*:instance/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceTag/SSMForSAPManaged" : "True"
},
"ForAllValues:StringLike" : {
"aws:TagKeys" : [
"SystemsManagerForSAP-*"
]
}
}
},
{
"Sid" : "ManageSsmSapTagsOnEbsVolumes",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:aws:ec2:*:*:volume/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : [
"SystemsManagerForSAP-*"
]
}
}
},
{
"Sid" : "ManageAppTagsOnEbsVolumes",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:aws:ec2:*:*:volume/*",
"Condition" : {
"ArnLike" : {
"aws:RequestTag/awsApplication" : "arn:aws:resource-groups:*:*:group/*/*"
},
"ForAllValues:StringEquals" : {
"aws:TagKeys" : [
"awsApplication"
]
}
}
},
{
"Sid" : "ManageCostAllocationTags",
"Effect" : "Allow",
"Action" : [
"ce:ListCostAllocationTags",
"ce:UpdateCostAllocationTagsStatus",
"ce:ListCostAllocationTagBackfillHistory",
"ce:StartCostAllocationTagBackfill"
],
"Resource" : "*"
}
]
}
```
## Saiba mais
+ [Compreenda o controle de versionamento das políticas do IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Comece com políticas AWS gerenciadas e adote permissões com privilégios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)