Amazon适用于 Amazon Trusted Advisor 的托管策略 - Amazon Web Services Support
AWSTrustedAdvisorServiceRolePolicyAWSTrustedAdvisorReportingServiceRolePolicy策略更新
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅中国的 Amazon Web Services 服务入门。

Amazon适用于 Amazon Trusted Advisor 的托管策略

Trusted Advisor 具有以下托管式策略。

Amazon 托管策略：AWSTrustedAdvisorServiceRolePolicy

此策略附加到 AWSServiceRoleForTrustedAdvisor 服务相关角色。它使服务相关角色能够代表您执行操作。您不能将 AWSTrustedAdvisorServiceRolePolicy 附加到您的 IAM 实体。有关更多信息，请参阅将服务相关角色用于 Trusted Advisor。

此策略授予管理权限，允许服务相关角色访问 Amazon 服务。这些权限允许 Trusted Advisor 的检查来评估您的账户。

权限详细信息

此策略包含以下权限。

  • Auto Scaling – 描述 Amazon EC2 Auto Scaling 账户配额和资源

  • cloudformation – 描述 Amazon CloudFormation (CloudFormation) 账户配额和堆栈

  • cloudfront – 描述 Amazon CloudFront 分配

  • cloudtrail – 描述 Amazon CloudTrail (CloudTrail) 跟踪

  • dynamodb – 描述 Amazon DynamoDB 账户配额和资源

  • ec2 – 描述 Amazon Elastic Compute Cloud (Amazon EC2) 账户配额和资源

  • elasticloadbalancing – 描述 Elastic Load Balancing 账户配额和资源

  • iam – 获取 IAM 资源，如证书、密码策略和证书

  • kinesis – 描述 Amazon Kinesis (Kinesis) 账户配额

  • rds – 描述 Amazon Relational Database Service (Amazon RDS) 资源

  • redshift – 描述 Amazon Redshift 资源

  • route53 – 描述 Amazon Route 53 账户配额和资源

  • s3 – 描述 Amazon Simple Storage Service (Amazon S3) 资源

  • ses – 获取 Amazon Simple Email Service (Amazon SES) 发送配额

  • sqs – 列出 Amazon Simple Queue Service (Amazon SQS) 队列

  • cloudwatch – 获取 Amazon CloudWatch Events (CloudWatch Events) 指标统计数据

  • ce – 获取 Cost Explorer 服务 (Cost Explorer) 建议

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "autoscaling:DescribeAccountLimits",
                "autoscaling:DescribeAutoScalingGroups",
                "autoscaling:DescribeLaunchConfigurations",
                "cloudformation:DescribeAccountLimits",
                "cloudformation:DescribeStacks",
                "cloudformation:ListStacks",
                "cloudfront:ListDistributions",
                "cloudtrail:DescribeTrails",
                "cloudtrail:GetTrailStatus",
                "dynamodb:DescribeLimits",
                "dynamodb:DescribeTable",
                "dynamodb:ListTables",
                "ec2:DescribeAddresses",
                "ec2:DescribeReservedInstances",
                "ec2:DescribeInstances",
                "ec2:DescribeVpcs",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeImages",
                "ec2:DescribeVolumes",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeReservedInstancesOfferings",
                "ec2:DescribeSnapshots",
                "ec2:DescribeVpnConnections",
                "ec2:DescribeVpnGateways",
                "ec2:DescribeLaunchTemplateVersions",
                "elasticloadbalancing:DescribeAccountLimits",
                "elasticloadbalancing:DescribeInstanceHealth",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DescribeLoadBalancerPolicies",
                "elasticloadbalancing:DescribeLoadBalancerPolicyTypes",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTargetGroups",
                "iam:GenerateCredentialReport",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:GetCredentialReport",
                "iam:GetServerCertificate",
                "iam:ListServerCertificates",
                "kinesis:DescribeLimits",
                "rds:DescribeAccountAttributes",
                "rds:DescribeDBClusters",
                "rds:DescribeDBEngineVersions",
                "rds:DescribeDBInstances",
                "rds:DescribeDBParameterGroups",
                "rds:DescribeDBParameters",
                "rds:DescribeDBSecurityGroups",
                "rds:DescribeDBSnapshots",
                "rds:DescribeDBSubnetGroups",
                "rds:DescribeEngineDefaultParameters",
                "rds:DescribeEvents",
                "rds:DescribeOptionGroupOptions",
                "rds:DescribeOptionGroups",
                "rds:DescribeOrderableDBInstanceOptions",
                "rds:DescribeReservedDBInstances",
                "rds:DescribeReservedDBInstancesOfferings",
                "rds:ListTagsForResource",
                "redshift:DescribeClusters",
                "redshift:DescribeReservedNodeOfferings",
                "redshift:DescribeReservedNodes",
                "route53:GetAccountLimit",
                "route53:GetHealthCheck",
                "route53:GetHostedZone",
                "route53:ListHealthChecks",
                "route53:ListHostedZones",
                "route53:ListHostedZonesByName",
                "route53:ListResourceRecordSets",
                "s3:GetAccountPublicAccessBlock",
                "s3:GetBucketAcl",
                "s3:GetBucketPolicy",
                "s3:GetBucketPolicyStatus",
                "s3:GetBucketLocation",
                "s3:GetBucketLogging",
                "s3:GetBucketVersioning",
                "s3:GetBucketPublicAccessBlock",
                "s3:ListBucket",
                "s3:ListAllMyBuckets",
                "ses:GetSendQuota",
                "sqs:ListQueues",
                "cloudwatch:GetMetricStatistics",
                "ce:GetReservationPurchaseRecommendation",
                "ce:GetSavingsPlansPurchaseRecommendation"
            ],
            "Resource": "*"
        }
    ]
}

Amazon 托管策略：AWSTrustedAdvisorReportingServiceRolePolicy

此策略附加到 AWSServiceRoleForTrustedAdvisorReporting 服务相关角色，使 Trusted Advisor 能够执行组织视图功能的操作。您不能将 AWSTrustedAdvisorReportingServiceRolePolicy 附加到您的 IAM 实体。有关更多信息，请参阅将服务相关角色用于 Trusted Advisor。

此策略授予管理权限，允许服务相关角色执行 Amazon Organizations 操作。

权限详细信息

此策略包含以下权限。

  • organizations – 描述您的组织并列出服务访问权限、账户、父级、子级和组织单位

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "organizations:DescribeOrganization",
                "organizations:ListAWSServiceAccessForOrganization",
                "organizations:ListAccounts",
                "organizations:ListAccountsForParent",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListChildren",
                "organizations:ListParents",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeAccount"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

对 Amazon 托管式策略的 Trusted Advisor 更新

查看有关 Amazon Web Services Support 和 Trusted Advisor 的 Amazon 托管策略更新的详细信息（从这些服务开始跟踪这些更改开始）。要获得有关此页面更改的自动提示，请订阅 文档历史记录 页面上的 RSS 源。

下表介绍了自 2021 年 8 月 10 日以来对 Trusted Advisor 托管式策略的重要更新。

Trusted Advisor
更改 说明 日期

AWSTrustedAdvisorServiceRolePolicy – 对现有策略的更新

Trusted Advisor 添加了新的操作来授予 DescribeTargetGroups 和 GetAccountPublicAccessBlock 权限。

Auto Scaling 组运行状况检查需要 DescribeTargetGroup 权限，以检索附加到 Auto Scaling 组的非 Classic Load Balancer。

Amazon S3 存储桶权限检查需要 GetAccountPublicAccessBlock 权限以检索 Amazon Web Services 账户 的阻止公有访问设置。

 2021 年 8 月 10 日

已发布的更改日志

Trusted Advisor 托管策略的更改日志。

 2021 年 8 月 10 日