AWSAuditManagerServiceRolePolicy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "acm:GetAccountConfiguration",
            "acm:ListCertificates",
            "autoscaling:DescribeAutoScalingGroups",
            "backup:ListBackupPlans",
            "backup:ListRecoveryPointsByResource",
            "bedrock:GetCustomModel",
            "bedrock:GetFoundationModel",
            "bedrock:GetModelCustomizationJob",
            "bedrock:GetModelInvocationLoggingConfiguration",
            "bedrock:ListCustomModels",
            "bedrock:ListFoundationModels",
            "bedrock:ListGuardrails",
            "bedrock:ListModelCustomizationJobs",
            "cloudfront:GetDistribution",
            "cloudfront:GetDistributionConfig",
            "cloudfront:ListDistributions",
            "cloudtrail:GetTrail",
            "cloudtrail:ListTrails",
            "cloudtrail:DescribeTrails",
            "cloudtrail:LookupEvents",
            "cloudwatch:DescribeAlarms",
            "cloudwatch:DescribeAlarmsForMetric",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:ListMetrics",
            "cognito-idp:DescribeUserPool",
            "config:DescribeConfigRules",
            "config:DescribeDeliveryChannels",
            "config:ListDiscoveredResources",
            "directconnect:DescribeDirectConnectGateways",
            "directconnect:DescribeVirtualGateways",
            "dynamodb:DescribeContinuousBackups",
            "dynamodb:DescribeBackup",
            "dynamodb:DescribeTableReplicaAutoScaling",
            "dynamodb:DescribeTable",
            "dynamodb:ListBackups",
            "dynamodb:ListGlobalTables",
            "dynamodb:ListTables",
            "ec2:DescribeInstanceCreditSpecifications",
            "ec2:DescribeInstanceAttribute",
            "ec2:DescribeSecurityGroupRules",
            "ec2:DescribeVpcEndpointConnections",
            "ec2:DescribeVpcEndpointServiceConfigurations",
            "ec2:GetLaunchTemplateData",
            "ec2:DescribeAddresses",
            "ec2:DescribeCustomerGateways",
            "ec2:DescribeEgressOnlyInternetGateways",
            "ec2:DescribeFlowLogs",
            "ec2:DescribeInstances",
            "ec2:DescribeInternetGateways",
            "ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
            "ec2:DescribeLocalGateways",
            "ec2:DescribeLocalGatewayVirtualInterfaces",
            "ec2:DescribeNatGateways",
            "ec2:DescribeNetworkAcls",
            "ec2:DescribeRouteTables",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeSnapshots",
            "ec2:DescribeTransitGateways",
            "ec2:DescribeVolumes",
            "ec2:DescribeVpcEndpoints",
            "ec2:DescribeVpcPeeringConnections",
            "ec2:DescribeVpcs",
            "ec2:DescribeVpnConnections",
            "ec2:DescribeVpnGateways",
            "ec2:GetEbsDefaultKmsKeyId",
            "ec2:GetEbsEncryptionByDefault",
            "ecs:DescribeClusters",
            "eks:DescribeAddonVersions",
            "elasticache:DescribeCacheClusters",
            "elasticache:DescribeServiceUpdates",
            "elasticfilesystem:DescribeAccessPoints",
            "elasticfilesystem:DescribeFileSystems",
            "elasticloadbalancing:DescribeLoadBalancers",
            "elasticloadbalancing:DescribeSslPolicies",
            "elasticloadbalancing:DescribeTargetGroups",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:ListSecurityConfigurations",
            "events:DescribeRule",
            "events:ListConnections",
            "events:ListEventBuses",
            "events:ListEventSources",
            "events:ListRules",
            "firehose:ListDeliveryStreams",
            "fsx:DescribeFileSystems",
            "guardduty:ListDetectors",
            "iam:GenerateCredentialReport",
            "iam:GetAccountAuthorizationDetails",
            "iam:GetAccessKeyLastUsed",
            "iam:GetCredentialReport",
            "iam:GetGroupPolicy",
            "iam:GetPolicy",
            "iam:GetPolicyVersion",
            "iam:GetRolePolicy",
            "iam:GetUser",
            "iam:GetUserPolicy",
            "iam:GetAccountPasswordPolicy",
            "iam:GetAccountSummary",
            "iam:ListAttachedGroupPolicies",
            "iam:ListAttachedUserPolicies",
            "iam:ListEntitiesForPolicy",
            "iam:ListGroupsForUser",
            "iam:ListGroupPolicies",
            "iam:ListGroups",
            "iam:ListOpenIdConnectProviders",
            "iam:ListPolicies",
            "iam:ListRolePolicies",
            "iam:ListRoles",
            "iam:ListSamlProviders",
            "iam:ListUserPolicies",
            "iam:ListUsers",
            "iam:ListVirtualMFADevices",
            "iam:ListPolicyVersions",
            "iam:ListAccessKeys",
            "iam:ListAttachedRolePolicies",
            "iam:ListMfaDeviceTags",
            "iam:ListMfaDevices",
            "kafka:ListClusters",
            "kafka:ListKafkaVersions",
            "kinesis:ListStreams",
            "kms:DescribeKey",
            "kms:GetKeyPolicy",
            "kms:GetKeyRotationStatus",
            "kms:ListGrants",
            "kms:ListKeyPolicies",
            "kms:ListKeys",
            "lambda:ListFunctions",
            "license-manager:ListAssociationsForLicenseConfiguration",
            "license-manager:ListLicenseConfigurations",
            "license-manager:ListUsageForLicenseConfiguration",
            "logs:DescribeDestinations",
            "logs:DescribeExportTasks",
            "logs:DescribeLogGroups",
            "logs:DescribeMetricFilters",
            "logs:DescribeResourcePolicies",
            "logs:FilterLogEvents",
            "logs:GetDataProtectionPolicy",
            "es:DescribeDomains",
            "es:DescribeDomain",
            "es:DescribeDomainConfig",
            "es:ListDomainNames",
            "organizations:DescribeOrganization",
            "organizations:DescribePolicy",
            "organizations:DescribeAccount",
            "rds:DescribeCertificates",
            "rds:DescribeDBClusterEndpoints",
            "rds:DescribeDBClusterParameterGroups",
            "rds:DescribeDBInstances",
            "rds:DescribeDBSecurityGroups",
            "rds:DescribeDBClusters",
            "rds:DescribeDBInstanceAutomatedBackups",
            "redshift:DescribeClusters",
            "redshift:DescribeClusterSnapshots",
            "redshift:DescribeLoggingStatus",
            "route53:GetQueryLoggingConfig",
            "sagemaker:DescribeAlgorithm",
            "sagemaker:DescribeFlowDefinition",
            "sagemaker:DescribeHumanTaskUi",
            "sagemaker:DescribeModelBiasJobDefinition",
            "sagemaker:DescribeModelCard",
            "sagemaker:DescribeModelQualityJobDefinition",
            "sagemaker:DescribeDomain",
            "sagemaker:DescribeEndpoint",
            "sagemaker:DescribeEndpointConfig",
            "sagemaker:DescribeLabelingJob",
            "sagemaker:DescribeModel",
            "sagemaker:DescribeTrainingJob",
            "sagemaker:DescribeUserProfile",
            "sagemaker:ListAlgorithms",
            "sagemaker:ListDomains",
            "sagemaker:ListEndpoints",
            "sagemaker:ListEndpointConfigs",
            "sagemaker:ListFlowDefinitions",
            "sagemaker:ListHumanTaskUis",
            "sagemaker:ListLabelingJobs",
            "sagemaker:ListModels",
            "sagemaker:ListModelBiasJobDefinitions",
            "sagemaker:ListModelCards",
            "sagemaker:ListModelQualityJobDefinitions",
            "sagemaker:ListMonitoringAlerts",
            "sagemaker:ListMonitoringSchedules",
            "sagemaker:ListTrainingJobs",
            "sagemaker:ListUserProfiles",
            "s3:GetBucketPublicAccessBlock",
            "s3:GetBucketVersioning",
            "s3:GetEncryptionConfiguration",
            "s3:GetLifecycleConfiguration",
            "s3:ListAllMyBuckets",
            "secretsmanager:DescribeSecret",
            "secretsmanager:ListSecrets",
            "securityhub:DescribeStandards",
            "sns:ListTagsForResource",
            "sns:ListTopics",
            "sqs:ListQueues",
            "waf-regional:GetRule",
            "waf-regional:GetWebAcl",
            "waf:GetRule",
            "waf:GetRuleGroup",
            "waf:ListActivatedRulesInRuleGroup",
            "waf:ListWebAcls",
            "wafv2:ListWebAcls",
            "waf-regional:GetLoggingConfiguration",
            "waf-regional:ListRuleGroups",
            "waf-regional:ListSubscribedRuleGroups",
            "waf-regional:ListWebACLs",
            "waf-regional:ListRules",
            "waf:ListRuleGroups",
            "waf:ListRules"
          ],
          "Resource": "*",
          "Sid": "APIsAccess"
        },
        {
          "Sid": "S3Access",
          "Effect": "Allow",
          "Action": [
            "s3:GetBucketAcl",
            "s3:GetBucketLogging",
            "s3:GetBucketOwnershipControls",
            "s3:GetBucketPolicy",
            "s3:GetBucketTagging"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": [
                "${aws:PrincipalAccount}"
              ]
            }
          }
        },
        {
          "Sid": "APIGatewayAccess",
          "Effect": "Allow",
          "Action": [
            "apigateway:GET"
          ],
          "Resource": [
            "arn:aws:apigateway:*::/restapis",
            "arn:aws:apigateway:*::/restapis/*/stages/*",
            "arn:aws:apigateway:*::/restapis/*/stages"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": [
                "${aws:PrincipalAccount}"
              ]
            }
          }
        },
        {
          "Sid": "CreateEventsAccess",
          "Effect": "Allow",
          "Action": [
            "events:PutRule"
          ],
          "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver",
          "Condition": {
            "ForAllValues:StringEquals": {
              "events:detail-type": "Security Hub Findings - Imported",
              "events:source": [
                "aws.securityhub"
              ]
            },
            "Null": {
              "events:source": "false",
              "events:detail-type": "false"
            }
          }
        },
        {
          "Sid": "EventsAccess",
          "Effect": "Allow",
          "Action": [
            "events:DeleteRule",
            "events:DescribeRule",
            "events:EnableRule",
            "events:DisableRule",
            "events:ListTargetsByRule",
            "events:PutTargets",
            "events:RemoveTargets"
          ],
          "Resource": "arn:aws:events:*:*:rule/AuditManagerSecurityHubFindingsReceiver"
        }
      ]
    },
    "VersionId": "v11",
    "IsDefaultVersion": true,
    "CreateDate": "2026-06-02T20:12:13+00:00"
  }
}