本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

AWSAWS Identity and Access Management 和 Access Analyzer 的 受管政策

AWS 受管政策是由 AWS AWS 受管政策建立和管理的獨立政策旨在為許多常見使用案例提供許可，以便您可以開始將許可指派給使用者、群組和角色。

請記住， AWS 受管政策可能不會授予特定使用案例的最低權限許可，因為這些許可可供所有 AWS 客戶使用。我們建議您定義使用案例專屬的客戶管理政策，以便進一步減少許可。

您無法變更 AWS 受管政策中定義的許可。如果 AWS 更新受管政策中 AWS 定義的許可，則更新會影響政策連接的所有主體身分 （使用者、群組和角色）。 AWS 當新的 AWS 服務 啟動或新的 API 操作可用於現有 服務時， 最有可能更新受 AWS 管政策。

如需詳細資訊，請參閱 IAM 使用者指南中的 AWS 受管政策。

IAMReadOnlyAccess

使用 IAMReadOnlyAccess 受管政策允許唯讀存取 IAM 資源。此政策授予許可，以取得和列出所有 IAM 資源。它允許檢視使用者、群組、角色、政策、身分提供者和 MFA 裝置的詳細資訊和活動報告。它不包括建立或刪除資源或存取 IAM Access Analyzer 資源的能力。查看政策以了解此政策支援之服務和動作的完整清單。

IAMUserChangePassword

使用 IAMUserChangePassword 受管政策允許 IAM 使用者變更其密碼。

您可以設定 IAM 帳戶設定和密碼政策，以允許 IAM 使用者變更其 IAM 帳戶密碼。當您允許此動作時，IAM 會將下列政策連接至每個使用者：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:ChangePassword"
            ],
            "Resource": [
                "arn:aws:iam::*:user/${aws:username}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetAccountPasswordPolicy"
            ],
            "Resource": "*"
        }
    ]
}

IAMAccessAnalyzerFullAccess

使用 IAMAccessAnalyzerFullAccess AWS 受管政策，讓您的管理員存取 IAM Access Analyzer。

許可群組

此政策會根據提供的許可集分組到陳述式中。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "access-analyzer:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "access-analyzer.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:ListAccounts",
        "organizations:ListAccountsForParent",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:ListChildren",
        "organizations:ListDelegatedAdministrators",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListParents",
        "organizations:ListRoots"
      ],
      "Resource": "*"
    }
  ]
}

IAMAccessAnalyzerReadOnlyAccess

使用 IAMAccessAnalyzerReadOnlyAccess AWS 受管政策允許唯讀存取 IAM Access Analyzer。

若要允許 的 IAM Access Analyzer 唯讀存取 AWS Organizations，請建立客戶受管政策，以允許從IAMAccessAnalyzerFullAccess AWS 受管政策描述和列出動作。

服務層級許可

此政策提供 IAM Access Analyzer 的唯讀存取權。此政策中不包含任何其他服務許可。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IAMAccessAnalyzerReadOnlyAccess",
      "Effect": "Allow",
      "Action": [
        "access-analyzer:CheckAccessNotGranted",
        "access-analyzer:CheckNoNewAccess",
        "access-analyzer:Get*",
        "access-analyzer:List*",
        "access-analyzer:ValidatePolicy"
      ],
      "Resource": "*"
    }
  ]
}

AccessAnalyzerServiceRolePolicy

您無法將 AccessAnalyzerServiceRolePolicy 連接至 IAM 實體。此政策會連接至服務連結角色，允許 IAM Access Analyzer 代表您執行動作。如需詳細資訊，請參閱使用 AWS Identity and Access Management 和 Access Analyzer 的服務連結角色。

許可群組

此政策允許存取 IAM Access Analyzer，以分析來自多個 的資源中繼資料 AWS 服務。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AccessAnalyzerServiceRolePolicy",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetResourcePolicy",
        "dynamodb:ListStreams",
        "dynamodb:ListTables",
        "ec2:DescribeAddresses",
        "ec2:DescribeByoipCidrs",
        "ec2:DescribeSnapshotAttribute",
        "ec2:DescribeSnapshots",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcs",
        "ec2:GetSnapshotBlockPublicAccessState",
        "ecr:DescribeRepositories",
        "ecr:GetRepositoryPolicy",
        "elasticfilesystem:DescribeFileSystemPolicy",
        "elasticfilesystem:DescribeFileSystems",
        "iam:GetRole",
        "iam:ListEntitiesForPolicy",
        "iam:ListRoles",
        "iam:ListUsers",
        "iam:ListRoleTags",
        "iam:ListUserTags",
        "iam:GetUser",
        "iam:GetGroup",
        "iam:GenerateServiceLastAccessedDetails",
        "iam:GetServiceLastAccessedDetails",
        "iam:ListAccessKeys",
        "iam:GetLoginProfile",
        "iam:GetAccessKeyLastUsed",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies",
        "iam:ListUserPolicies",
        "iam:GetUserPolicy",
        "iam:ListAttachedUserPolicies",
        "iam:GetPolicy",
        "iam:GetPolicyVersion",
        "iam:ListGroupsForUser",
        "kms:DescribeKey",
        "kms:GetKeyPolicy",
        "kms:ListGrants",
        "kms:ListKeyPolicies",
        "kms:ListKeys",
        "lambda:GetFunctionUrlConfig",
        "lambda:GetLayerVersionPolicy",
        "lambda:GetPolicy",
        "lambda:ListAliases",
        "lambda:ListFunctions",
        "lambda:ListLayers",
        "lambda:ListLayerVersions",
        "lambda:ListVersionsByFunction",
        "organizations:DescribeAccount",
        "organizations:DescribeOrganization",
        "organizations:DescribeOrganizationalUnit",
        "organizations:ListAccounts",
        "organizations:ListAccountsForParent",
        "organizations:ListAWSServiceAccessForOrganization",
        "organizations:ListChildren",
        "organizations:ListDelegatedAdministrators",
        "organizations:ListOrganizationalUnitsForParent",
        "organizations:ListParents",
        "organizations:ListRoots",
        "rds:DescribeDBClusterSnapshotAttributes",
        "rds:DescribeDBClusterSnapshots",
        "rds:DescribeDBSnapshotAttributes",
        "rds:DescribeDBSnapshots",
        "s3:DescribeMultiRegionAccessPointOperation",
        "s3:GetAccessPoint",
        "s3:GetAccessPointPolicy",
        "s3:GetAccessPointPolicyStatus",
        "s3:GetAccountPublicAccessBlock",
        "s3:GetBucketAcl",
        "s3:GetBucketLocation",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketPolicy",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetMultiRegionAccessPoint",
        "s3:GetMultiRegionAccessPointPolicy",
        "s3:GetMultiRegionAccessPointPolicyStatus",
        "s3:ListAccessPoints",
        "s3:ListAllMyBuckets",
        "s3:ListMultiRegionAccessPoints",
        "s3express:GetBucketPolicy",
        "s3express:ListAllMyDirectoryBuckets",
        "sns:GetTopicAttributes",
        "sns:ListTopics",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:ListSecrets",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues"
      ],
      "Resource": "*"
    }
  ]
}

IAMAuditRootUserCredentials

當您在 AWS Organizations 成員帳戶上執行特殊權限任務時，請使用 IAMAuditRootUserCredentials AWS 受管政策來縮小許可範圍，以稽核成員帳戶的根使用者憑證狀態。您可以列出或取得個別根使用者憑證資訊 （根使用者密碼、存取金鑰、簽署憑證和 MFA)，也可以從 getAccountSummary 取得合併根使用者憑證狀態API。

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyAllOtherActionsOnAnyResource",
         "NotAction": [
            "iam:ListAccessKeys",
            "iam:ListSigningCertificates",
            "iam:GetLoginProfile",
            "iam:ListMFADevices",
            "iam:GetAccountSummary",
            "iam:GetUser",
            "iam:GetAccessKeyLastUsed"  
         ],
         "Effect": "Deny",
         "Resource": "*"
      },
      {
         "Sid": "DenyAuditingCredentialsOnNonRootUserResource",
         "Action": [
            "iam:ListAccessKeys",
            "iam:ListSigningCertificates",
            "iam:GetLoginProfile",
            "iam:ListMFADevices" ,
            "iam:GetUser",
            "iam:GetAccessKeyLastUsed"     
         ],
         "Effect": "Deny",
         "NotResource": "arn:aws:iam::*:root"
      } 
   ]
}

許可群組

此政策會根據提供的許可集分組到陳述式中。

IAMCreateRootUserPassword

當您對 AWS Organizations 成員帳戶執行特殊權限任務時，請使用 IAMCreateRootUserPassword AWS 受管政策來縮小許可範圍，以允許在沒有根使用者憑證的成員帳戶的密碼復原。

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyAllOtherActionsOnAnyResource",
         "NotAction": [
            "iam:CreateLoginProfile",
            "iam:GetLoginProfile"
         ],
         "Effect": "Deny",
         "Resource": "*"
      },
      {
         "Sid": "DenyCreatingPasswordOnNonRootUserResource",
         "Action": [
            "iam:CreateLoginProfile",
            "iam:GetLoginProfile"   
         ],
         "Effect": "Deny",
         "NotResource": "arn:aws:iam::*:root"
      }
   ]
}

許可群組

此政策會根據提供的許可集分組到陳述式中。

IAMDeleteRootUserCredentials

當您在 AWS Organizations 成員帳戶上執行特殊權限任務時，請使用 IAMDeleteRootUserCredentials AWS 受管政策來縮小許可範圍，以移除根使用者憑證，包括密碼、存取金鑰、簽署憑證和停用 MFA。此權限動作需要額外許可，因此您可以檢視上次使用的憑證資訊、驗證成員帳戶根使用者的上次使用資訊，以及列出要刪除所有根使用者憑證的許可。

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyAllOtherActionsOnAnyResource",
         "NotAction": [
            "iam:DeleteAccessKey",
            "iam:DeleteSigningCertificate",
            "iam:DeleteLoginProfile",
            "iam:DeactivateMFADevice",
            "iam:DeleteVirtualMFADevice",
            "iam:ListAccessKeys",
            "iam:ListSigningCertificates",
            "iam:GetLoginProfile",
            "iam:ListMFADevices",
            "iam:GetUser",
            "iam:GetAccessKeyLastUsed"  
         ],
         "Effect": "Deny",
         "Resource": "*"
      },
      {
         "Sid": "DenyDeletingRootUserCredentialsOnNonRootUserResource",
         "Action": [
            "iam:DeleteAccessKey",
            "iam:DeleteSigningCertificate",
            "iam:DeleteLoginProfile",
            "iam:DeactivateMFADevice",
            "iam:DeleteVirtualMFADevice",
            "iam:ListAccessKeys",
            "iam:ListSigningCertificates",
            "iam:GetLoginProfile",
            "iam:ListMFADevices",
            "iam:GetUser",
            "iam:GetAccessKeyLastUsed"  
         ],
         "Effect": "Deny",
         "NotResource": "arn:aws:iam::*:root"
      }
   ]
}

許可群組

此政策會根據提供的許可集分組到陳述式中。

S3UnlockBucketPolicy

當您在 AWS Organizations 成員帳戶上執行特殊權限任務時，請使用 S3UnlockBucketPolicy AWS 受管政策來縮小許可範圍，以移除設定錯誤的儲存貯體政策，該政策會拒絕所有主體存取 Amazon S3 儲存貯體。

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyAllOtherActionsOnAnyResource",
         "NotAction": [
            "s3:DeleteBucketPolicy",
            "s3:PutBucketPolicy",
            "s3:GetBucketPolicy",
            "s3:ListAllMyBuckets"
         ],
         "Effect": "Deny",
         "Resource": "*"
      },
      {
         "Sid": "DenyManagingBucketPolicyForNonRootCallers",
         "Action": [
            "s3:DeleteBucketPolicy",
            "s3:PutBucketPolicy",
            "s3:GetBucketPolicy",
            "s3:ListAllMyBuckets"
         ],
         "Effect": "Deny",
         "Resource": "*",
         "Condition" : {
            "StringNotLike" : {
               "aws:PrincipalArn" : "arn:aws:iam::*:root"
            }
         }
      }
   ]
}

許可群組

此政策會根據提供的許可集分組到陳述式中。

SQSUnlockQueuePolicy

當您在 AWS Organizations 成員帳戶上執行特殊權限任務時，請使用 SQSUnlockQueuePolicy AWS 受管政策來縮小許可範圍，以刪除以 Amazon Simple Queue Service 資源為基礎的政策，該政策會拒絕所有主體存取 Amazon SQS 佇列。

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyAllOtherActionsOnAnyResource",
         "Effect": "Deny",
         "NotAction": [
            "sqs:SetQueueAttributes",
            "sqs:GetQueueAttributes",
            "sqs:ListQueues",
            "sqs:GetQueueUrl"
         ],
         "Resource": "*"
      },
      {
         "Sid": "DenyGettingQueueAttributesOnNonOwnQueue",
         "Effect": "Deny",
         "Action": [
            "sqs:GetQueueAttributes"
         ],
         "Resource": "arn:aws:sqs:*:*:*",
         "Condition": {
            "StringNotEqualsIfExists": {
               "aws:ResourceAccount": [
               "${aws:PrincipalAccount}"
            ]
         }
      }
   },
   {
      "Sid": "DenyActionsForNonRootUser",
      "Effect": "Deny",
      "Action": [
        "sqs:SetQueueAttributes",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues",
        "sqs:GetQueueUrl"
      ],
      "Resource": "*",
      "Condition" : {
         "StringNotLike" : {
            "aws:PrincipalArn" : "arn:aws:iam::*:root"
            }
         }
      }
   ]
}

許可群組

此政策會根據提供的許可集分組到陳述式中。

IAM 和 IAM Access Analyzer 更新受 AWS 管政策

檢視自服務開始追蹤這些變更以來，IAM 和 AWS 受管政策更新的詳細資訊。如需此頁面變更的自動提醒，請訂閱 RSS 和 IAM Access Analyzer 文件歷史記錄頁面上的 IAM 摘要。