この記事は公開されてから1年以上経過しています。情報が古い可能性がありますので、ご注意ください。
コンバンハ、千葉（幸）です。
IAM Acces Analyzer による、CloudTrail の履歴をベースにしたポリシー生成で「アクションレベルの情報」に対応した AWS サービスが増えました。
機能のリリースから段階的に対応数が増えてきました。今回のアップデートにより、全部で 142 のサービスが対応しています。
| # | 時期 | 対応数 | 増加 |
|---|---|---|---|
| ① | 2021年4月 | 16 | ー |
| ② | 2021年8月 | 58 | ＋42（262.5%） |
| ③ | 2022年10月 | 142 | ＋84（144.8%） |
IAM Access Analyzer によるポリシー生成
IAM Access Analyzer は 2019年12月に登場して以来、段階的に機能を増やしてきました。大きく分けてリソースベースポリシーの分析と それ以外 に分かれており、前者には「アナライザー」というリソースを必要とします。
| # | 機能 | アナライザー | リリース |
|---|---|---|---|
| 1 | リソースベースポリシーの分析 | 必要 | 2019年12月 |
| 2 | リソースベースポリシーの事前分析（外部アクセスプレビュー） | 必要 | 2021年3月 |
| 3 | IAM ポリシーなどのポリシー検証 | 不要 | 2021年3月 |
| 4 | CloudTrail イベントを基にした IAM ポリシーの生成 | 不要 | 2021年4月 |
今回のアップデートが関連するのは #4 の機能であり、大まかなイメージは以下です。
IAM ユーザーもしくはロールを対象に、それらの CloudTrail 上のイベント履歴を基にポリシードキュメントを生成してくれる機能です。「必要最小限の権限を持たせたいけどどれを割り当てたらいいかわからない……」というときに、過去のアクティビティを参考にしてポリシーを作成できます。
アクションレベルの情報とサービスレベルの情報
ポリシーの生成機能は便利ですが、全てをいい感じにやってくれる訳ではありません。アクティビティを基にポリシーを生成する際に、アクションレベルで情報を出してくれるサービスとサービスレベルまでしか情報を出してくれないサービスに分かれています。
前者のアクションレベルのイメージは以下。
後者のサービスレベルのイメージは以下です。
サービスレベルの場合「どのサービスにアクセスした実績があるか」までしか情報がないため、その中でどのアクションを許可するか、というのは自分で考えないといけません。
そうなるとより多くのサービスがアクションレベルの情報に対応していると嬉しい訳ですね。
今回のアップデートにより 58 → 142 のサービスがアクションレベルに対応しました。
どの AWS サービスが対応したのか
現時点でアクションレベルに対応しているサービスは以下ページから確認できます。「Policy generation action-level information」列が Yes になっているものが該当します。
実は「アクションレベルの情報」に対応したサービスが増えるのは今回が初めてではなく、2021年8月にも一度増加しています。その際にも当時AWSドキュメントの情報から「何が増えたのか」を調べていました。
ふたつの情報を組み合わせて整理したのが以下表です。
| # | 時期 | 対応数 | 増加 |
|---|---|---|---|
| ① | 2021年4月 | 16 | ー |
| ② | 2021年8月 | 58 | ＋42（262.5%） |
| ③ | 2022年10月 | 142 | ＋84（144.8%） |
そしてサービスごとに①②③どのタイミングで対応したのかをまとめたのが後段の表です。③の列にしか●がついていないのが今回のアップデートで対応したサービスです。
長い表が続きます。
| # | Service | Service prefix | ① | ② | ③ |
|---|---|---|---|---|---|
| 1 | AWS IAM Access Analyzer | access-analyzer | ● | ● | ● |
| 2 | AWS Account Management | account | ● | ||
| 3 | Amazon Managed Workflows for Apache Airflow | airflow | ● | ||
| 4 | Amazon MQ | mq | ● | ● | |
| 5 | AWS Amplify | amplify | ● | ● | |
| 6 | AWS Amplify UI Builder | amplifyuibuilder | ● | ||
| 7 | Amazon AppIntegrations | app-integrations | ● | ● | |
| 8 | Amazon AppFlow | appflow | ● | ● | |
| 9 | AWS Application Cost Profiler Service | application-cost-profiler | ● | ● | |
| 10 | AWS AppSync | appsync | ● | ||
| 11 | Amazon Managed Service for Prometheus | aps | ● | ||
| 12 | Amazon Athena | athena | ● | ● | |
| 13 | AWS Marketplace | aws-marketplace | ● | ||
| 14 | AWS Batch | batch | ● | ● | |
| 15 | Amazon Braket | braket | ● | ● | |
| 16 | AWS Cloud9 | cloud9 | ● | ||
| 17 | AWS CloudFormation | cloudformation | ● | ||
| 18 | Amazon CloudSearch | cloudsearch | ● | ||
| 19 | AWS CloudTrail | cloudtrail | ● | ||
| 20 | AWS CodeArtifact | codeartifact | ● | ||
| 21 | Amazon CodeGuru Profiler | codeguru-profiler | ● | ● | |
| 22 | Amazon CodeGuru Reviewer | codeguru-reviewer | ● | ||
| 23 | AWS CodeStar | codestar | ● | ||
| 24 | AWS CodeStar Notifications | codestar-notifications | ● | ||
| 25 | Amazon Cognito Identity | cognito-identity | ● | ● | ● |
| 26 | Amazon Cognito User Pools | cognito-idp | ● | ● | ● |
| 27 | Amazon Cognito Sync | cognito-sync | ● | ● | |
| 28 | AWS Compute Optimizer | compute-optimizer | ● | ||
| 29 | Amazon Connect | connect | ● | ||
| 30 | AWS Cost and Usage Report | cur | ● | ● | |
| 31 | AWS Glue DataBrew | databrew | ● | ||
| 32 | AWS Data Exchange | dataexchange | ● | ||
| 33 | AWS Data Pipeline | datapipeline | ● | ||
| 34 | DynamoDB Accelerator | dax | ● | ||
| 35 | AWS Device Farm | devicefarm | ● | ||
| 36 | Amazon DevOps Guru | devops-guru | ● | ● | |
| 37 | AWS Direct Connect | directconnect | ● | ||
| 38 | Amazon Data Lifecycle Manager | dlm | ● | ||
| 39 | AWS Database Migration Service | dms | ● | ||
| 40 | AWS Directory Service | ds | ● | ● | |
| 41 | Amazon DynamoDB | dynamodb | ● | ||
| 42 | Amazon Elastic Block Store | ebs | ● | ● | |
| 43 | Amazon Elastic Compute Cloud | ec2 | ● | ● | ● |
| 44 | Amazon Elastic Container Registry | ecr | ● | ● | |
| 45 | Amazon Elastic Container Registry Public | ecr-public | ● | ||
| 46 | Amazon Elastic Container Service | ecs | ● | ● | ● |
| 47 | Amazon Elastic Kubernetes Service | eks | ● | ||
| 48 | Amazon Elastic Inference | elastic-inference | ● | ||
| 49 | AWS Elastic Beanstalk | elasticbeanstalk | ● | ||
| 50 | Amazon Elastic File System | elasticfilesystem | ● | ||
| 51 | Elastic Load Balancing | elasticloadbalancing | ● | ● | ● |
| 52 | Amazon Elastic Transcoder | elastictranscoder | ● | ||
| 53 | Amazon EMR on EKS (EMR Containers) | emr-containers | ● | ||
| 54 | Amazon OpenSearch Service | es | ● | ||
| 55 | Amazon CloudWatch Evidently | evidently | ● | ||
| 56 | Amazon FinSpace | finspace | ● | ||
| 57 | Amazon Kinesis Firehose | firehose | ● | ● | |
| 58 | AWS Fault Injection Simulator | fis | ● | ||
| 59 | AWS Firewall Manager | fms | ● | ||
| 60 | Amazon Location | geo | ● | ||
| 61 | Amazon Managed Grafana | grafana | ● | ||
| 62 | AWS IoT Greengrass | greengrass | ● | ||
| 63 | AWS Ground Station | groundstation | ● | ● | |
| 64 | Amazon GuardDuty | guardduty | ● | ● | |
| 65 | Amazon HealthLake | healthlake | ● | ||
| 66 | AWS Identity and Access Management | iam | ● | ● | ● |
| 67 | AWS Identity Store | identitystore | ● | ||
| 68 | EC2 Image Builder | imagebuilder | ● | ||
| 69 | Amazon Inspector Classic | inspector | ● | ||
| 70 | Amazon Inspector | inspector2 | ● | ||
| 71 | AWS IoT Core Device Advisor | iotdeviceadvisor | ● | ● | |
| 72 | AWS IoT Fleet Hub | iotfleethub | ● | ● | |
| 73 | AWS IoT TwinMaker | iottwinmaker | ● | ||
| 74 | Amazon Interactive Video Service | ivs | ● | ● | |
| 75 | Amazon Managed Streaming for Apache Kafka | kafka | ● | ● | |
| 76 | Amazon Managed Streaming for Kafka Connect | kafkaconnect | ● | ||
| 77 | Amazon Kinesis | kinesis | ● | ||
| 78 | AWS Key Management Service | kms | ● | ● | ● |
| 79 | AWS Lambda | lambda | ● | ● | ● |
| 80 | Amazon Lightsail | lightsail | ● | ||
| 81 | Amazon CloudWatch Logs | logs | ● | ● | |
| 82 | Amazon Lookout for Equipment | lookoutequipment | ● | ||
| 83 | Amazon Lookout for Metrics | lookoutmetrics | ● | ||
| 84 | Amazon Lookout for Vision | lookoutvision | ● | ||
| 85 | Amazon Managed Blockchain | managedblockchain | ● | ● | |
| 86 | AWS Elemental MediaConnect | mediaconnect | ● | ||
| 87 | AWS Elemental MediaConvert | mediaconvert | ● | ||
| 88 | AWS Elemental MediaLive | medialive | ● | ||
| 89 | AWS Elemental MediaTailor | mediatailor | ● | ||
| 90 | Amazon MemoryDB for Redis | memorydb | ● | ||
| 91 | AWS Application Migration Service | mgn | ● | ||
| 92 | AWS Migration Hub | mgh | ● | ||
| 93 | AWS Migration Hub Strategy Recommendations | migrationhub-strategy | ● | ||
| 94 | Amazon CloudWatch | cloudwatch | ● | ● | ● |
| 95 | AWS Network Manager | networkmanager | ● | ||
| 96 | Amazon Nimble Studio | nimble | ● | ● | |
| 97 | AWS OpsWorks | opsworks | ● | ● | |
| 98 | AWS Outposts | outposts | ● | ● | |
| 99 | AWS Panorama | panorama | ● | ||
| 100 | AWS Performance Insights | pi | ● | ● | |
| 101 | Amazon Pinpoint | mobiletargeting | ● | ||
| 102 | Amazon Polly | polly | ● | ||
| 103 | Amazon Connect Customer Profiles | profile | ● | ||
| 104 | Amazon QLDB | qldb | ● | ||
| 105 | AWS Resource Access Manager | ram | ● | ● | ● |
| 106 | AWS Recycle Bin | rbin | ● | ||
| 107 | Amazon Relational Database Service | rds | ● | ● | ● |
| 108 | Amazon Redshift Data API | redshift-data | ● | ||
| 109 | AWS Resource Groups | resource-groups | ● | ● | ● |
| 110 | Amazon Route 53 Recovery Controls | route53-recovery-control-config | ● | ||
| 111 | Amazon Route 53 Recovery Readiness | route53-recovery-readiness | ● | ||
| 112 | Amazon Route 53 Resolver | route53resolver | ● | ||
| 113 | AWS CloudWatch RUM | rum | ● | ||
| 114 | Amazon S3 | s3 | ● | ● | ● |
| 115 | Amazon S3 on Outposts | s3-outposts | ● | ||
| 116 | Savings Plans | savingsplans | ● | ● | |
| 117 | Amazon EventBridge Schemas | schemas | ● | ● | |
| 118 | Amazon SimpleDB | sdb | ● | ||
| 119 | AWS Secrets Manager | secretsmanager | ● | ● | |
| 120 | AWS Security Hub | securityhub | ● | ● | |
| 121 | AWS Cloud Map | servicediscovery | ● | ||
| 122 | Service Quotas | servicequotas | ● | ● | |
| 123 | Amazon Simple Email Service | ses | ● | ● | |
| 124 | AWS Shield | shield | ● | ||
| 125 | AWS Signer | signer | ● | ● | |
| 126 | AWS Server Migration Service | sms | ● | ● | |
| 127 | Amazon Pinpoint SMS and Voice Service | sms-voice | ● | ||
| 128 | AWS Snowball | snowball | ● | ||
| 129 | Amazon Simple Queue Service | sqs | ● | ||
| 130 | AWS Systems Manager | ssm | ● | ● | ● |
| 131 | AWS Systems Manager Incident Manager | ssm-incidents | ● | ||
| 132 | AWS Security Token Service | sts | ● | ● | ● |
| 133 | Amazon Simple Workflow Service | swf | ● | ||
| 134 | Amazon CloudWatch Synthetics | synthetics | ● | ● | |
| 135 | Amazon Resource Group Tagging API | tag | ● | ● | |
| 136 | Amazon Textract | textract | ● | ● | |
| 137 | Amazon Timestream | timestream | ● | ||
| 138 | Amazon Transcribe | transcribe | ● | ||
| 139 | Amazon Translate | translate | ● | ● | |
| 140 | AWS Well-Architected Tool | wellarchitected | ● | ● | |
| 141 | Amazon Connect Wisdom | wisdom | ● | ||
| 142 | Amazon WorkLink | worklink | ● | ● |
Action last accessed information ってなんだ
上記の表の作成のために参照した以下ドキュメントでは、「Policy generation action-level information」の他にも「Action last accessed information」という列があります。
これは IAM Access Analyzer とは関係なく、アクセスアドバイザーの機能に関連するものです。アクセスアドバイザーでは、指定した IAM リソースの過去の AWS サービスへのアクセス状況を確認できます。ほとんどの AWS サービスは「サービスレベルの情報」ですが、ごく一部は「アクションレベルの情報」に対応しています。その対応状況を上記の列で確認できます。
2022年10月現在でアクションレベルに対応しているのは以下サービスです。
- Amazon Elastic Compute Cloud
- AWS Identity and Access Management
- AWS Lambda
- Amazon S3
機能の詳細は以下をご参照ください。
「AWSサービス」って全部でいくつあるんだっけ
今回のアップデートにより IAM Access Analyzer によるポリシー生成におけるアクションレベルの情報に対応したサービス数が 142 になりましたが、そもそも全てのサービス数は何個あるのでしょうか？
何をもって「AWS サービス」かは議論の余地があるかと思いますが、今回は「サービス名前空間」あるいは「サービスプレフィックス」を基準にしたいと思います。
以下のエントリの考え方を参考に確認したところ、2022/10/23時点で 322 個ありました。
% i=`aws iam generate-service-last-accessed-details --arn arn:aws:iam::aws:policy/AdministratorAccess --output text` && sleep 1 && aws iam get-service-last-accessed-details --job-id $i --max-items 1000 | jq -r '.ServicesLastAccessed[] | [.ServiceName,.ServiceNamespace] | @csv' | wc -l
322これからも対応サービス数が増える予感がしますね。
ついでに「サービス一覧」も取ってみたので、興味がある方はご参照ください。
折り畳み
% i=`aws iam generate-service-last-accessed-details --arn arn:aws:iam::aws:policy/AdministratorAccess --output text` && sleep 1 && aws iam get-service-last-accessed-details --job-id $i --max-items 1000 | jq -r '.ServicesLastAccessed[] | [.ServiceName,.ServiceNamespace] | @csv' | nl
1 "Alexa for Business","a4b"
2 "AWS IAM Access Analyzer","access-analyzer"
3 "AWS Account Management","account"
4 "AWS Certificate Manager","acm"
5 "AWS Certificate Manager Private Certificate Authority","acm-pca"
6 "AWS Activate","activate"
7 "Amazon Managed Workflows for Apache Airflow","airflow"
8 "AWS Amplify","amplify"
9 "AWS Amplify Admin","amplifybackend"
10 "AWS Amplify UI Builder","amplifyuibuilder"
11 "Manage - Amazon API Gateway","apigateway"
12 "Amazon AppIntegrations","app-integrations"
13 "AWS AppConfig","appconfig"
14 "Amazon AppFlow","appflow"
15 "AWS Application Auto Scaling","application-autoscaling"
16 "AWS Application Cost Profiler Service","application-cost-profiler"
17 "Amazon CloudWatch Application Insights","applicationinsights"
18 "AWS App Mesh","appmesh"
19 "AWS App Mesh Preview","appmesh-preview"
20 "AWS App Runner","apprunner"
21 "Amazon AppStream 2.0","appstream"
22 "AWS AppSync","appsync"
23 "Amazon Managed Service for Prometheus","aps"
24 "Application Discovery Arsenal","arsenal"
25 "AWS Artifact","artifact"
26 "Amazon Athena","athena"
27 "AWS Audit Manager","auditmanager"
28 "Amazon EC2 Auto Scaling","autoscaling"
29 "AWS Auto Scaling","autoscaling-plans"
30 "AWS Marketplace","aws-marketplace"
31 "AWS Marketplace Management Portal","aws-marketplace-management"
32 "AWS Billing Console","aws-portal"
33 "AWS Connector Service","awsconnector"
34 "AWS Backup","backup"
35 "AWS Backup Gateway","backup-gateway"
36 "AWS Backup storage","backup-storage"
37 "AWS Batch","batch"
38 "AWS Billing ","billing"
39 "AWS Billing Conductor","billingconductor"
40 "Amazon Braket","braket"
41 "AWS Budget Service","budgets"
42 "AWS BugBust","bugbust"
43 "Amazon Connect Cases","cases"
44 "Amazon Keyspaces (for Apache Cassandra)","cassandra"
45 "AWS Cost Explorer Service","ce"
46 "AWS Chatbot","chatbot"
47 "Amazon Chime","chime"
48 "AWS Cloud9","cloud9"
49 "Amazon Cloud Directory","clouddirectory"
50 "AWS CloudFormation","cloudformation"
51 "Amazon CloudFront","cloudfront"
52 "AWS CloudHSM","cloudhsm"
53 "Amazon CloudSearch","cloudsearch"
54 "AWS CloudShell","cloudshell"
55 "AWS CloudTrail","cloudtrail"
56 "Amazon CloudWatch","cloudwatch"
57 "AWS CodeArtifact","codeartifact"
58 "AWS CodeBuild","codebuild"
59 "AWS CodeCommit","codecommit"
60 "AWS CodeDeploy","codedeploy"
61 "AWS CodeDeploy secure host commands service","codedeploy-commands-secure"
62 "Amazon CodeGuru","codeguru"
63 "Amazon CodeGuru Profiler","codeguru-profiler"
64 "Amazon CodeGuru Reviewer","codeguru-reviewer"
65 "AWS CodePipeline","codepipeline"
66 "AWS CodeStar","codestar"
67 "AWS CodeStar Connections","codestar-connections"
68 "AWS CodeStar Notifications","codestar-notifications"
69 "Amazon Cognito Identity","cognito-identity"
70 "Amazon Cognito User Pools","cognito-idp"
71 "Amazon Cognito Sync","cognito-sync"
72 "Amazon Comprehend","comprehend"
73 "Amazon Comprehend Medical","comprehendmedical"
74 "AWS Compute Optimizer","compute-optimizer"
75 "AWS Config","config"
76 "Amazon Connect","connect"
77 "High-volume outbound communications","connect-campaigns"
78 "AWS Control Tower","controltower"
79 "AWS Cost and Usage Report","cur"
80 "AWS Glue DataBrew","databrew"
81 "AWS Data Exchange","dataexchange"
82 "AWS Data Pipeline","datapipeline"
83 "AWS DataSync","datasync"
84 "Amazon DynamoDB Accelerator (DAX)","dax"
85 "Database Query Metadata Service","dbqms"
86 "AWS DeepComposer","deepcomposer"
87 "AWS DeepLens","deeplens"
88 "AWS DeepRacer","deepracer"
89 "Amazon Detective","detective"
90 "AWS Device Farm","devicefarm"
91 "Amazon DevOps Guru","devops-guru"
92 "AWS Direct Connect","directconnect"
93 "AWS Application Discovery Service","discovery"
94 "Amazon Data Lifecycle Manager","dlm"
95 "AWS Database Migration Service","dms"
96 "AWS Elastic Disaster Recovery","drs"
97 "AWS Directory Service","ds"
98 "Amazon DynamoDB","dynamodb"
99 "Amazon Elastic Block Store","ebs"
100 "Amazon EC2","ec2"
101 "Amazon EC2 Instance Connect","ec2-instance-connect"
102 "Amazon Message Delivery Service","ec2messages"
103 "Amazon Elastic Container Registry","ecr"
104 "Amazon Elastic Container Registry Public","ecr-public"
105 "Amazon Elastic Container Service","ecs"
106 "Amazon Elastic Kubernetes Service","eks"
107 "Amazon Elastic Inference","elastic-inference"
108 "Amazon ElastiCache","elasticache"
109 "AWS Elastic Beanstalk","elasticbeanstalk"
110 "Amazon Elastic File System","elasticfilesystem"
111 "Elastic Load Balancing","elasticloadbalancing"
112 "Amazon Elastic MapReduce","elasticmapreduce"
113 "Amazon Elastic Transcoder","elastictranscoder"
114 "AWS Elemental Appliances and Software Activation Service","elemental-activations"
115 "AWS Elemental Appliances and Software","elemental-appliances-software"
116 "Elemental Support Cases","elemental-support-cases"
117 "Elemental Support Content","elemental-support-content"
118 "Amazon EMR on EKS (EMR Containers)","emr-containers"
119 "Amazon EMR Serverless","emr-serverless"
120 "Amazon OpenSearch Service","es"
121 "Amazon EventBridge","events"
122 "Amazon CloudWatch Evidently","evidently"
123 "Amazon API Gateway","execute-api"
124 "Amazon FinSpace","finspace"
125 "Amazon Kinesis Firehose","firehose"
126 "AWS Fault Injection Simulator","fis"
127 "AWS Firewall Manager","fms"
128 "Amazon Forecast","forecast"
129 "Amazon Fraud Detector","frauddetector"
130 "Amazon FreeRTOS","freertos"
131 "Amazon FSx","fsx"
132 "Amazon GameLift","gamelift"
133 "Amazon GameSparks","gamesparks"
134 "Amazon Location","geo"
135 "Amazon S3 Glacier","glacier"
136 "AWS Global Accelerator","globalaccelerator"
137 "AWS Glue","glue"
138 "Amazon Managed Grafana","grafana"
139 "AWS IoT Greengrass","greengrass"
140 "AWS Ground Station","groundstation"
141 "Amazon GroundTruth Labeling","groundtruthlabeling"
142 "Amazon GuardDuty","guardduty"
143 "AWS Health APIs and Notifications","health"
144 "Amazon HealthLake","healthlake"
145 "Amazon Honeycode","honeycode"
146 "AWS Identity and Access Management","iam"
147 "AWS Identity Sync","identity-sync"
148 "AWS Identity Store","identitystore"
149 "AWS Identity Store Auth","identitystore-auth"
150 "Amazon EC2 Image Builder","imagebuilder"
151 "AWS Import Export","importexport"
152 "Amazon Inspector","inspector"
153 "Amazon Inspector2","inspector2"
154 "AWS IoT","iot"
155 "AWS IoT Device Tester","iot-device-tester"
156 "AWS IoT 1-Click","iot1click"
157 "AWS IoT Analytics","iotanalytics"
158 "AWS IoT Core Device Advisor","iotdeviceadvisor"
159 "AWS IoT Events","iotevents"
160 "AWS IoT Fleet Hub for Device Management","iotfleethub"
161 "AWS IoT FleetWise","iotfleetwise"
162 "AWS IoT Jobs DataPlane","iotjobsdata"
163 "AWS IoT RoboRunner","iotroborunner"
164 "AWS IoT SiteWise","iotsitewise"
165 "AWS IoT Things Graph","iotthingsgraph"
166 "AWS IoT TwinMaker","iottwinmaker"
167 "AWS IoT Core for LoRaWAN","iotwireless"
168 "AWS IQ","iq"
169 "AWS IQ Permissions","iq-permission"
170 "Amazon Interactive Video Service","ivs"
171 "Amazon Interactive Video Service Chat","ivschat"
172 "Amazon Managed Streaming for Apache Kafka","kafka"
173 "Apache Kafka APIs for Amazon MSK clusters","kafka-cluster"
174 "Amazon Managed Streaming for Kafka Connect","kafkaconnect"
175 "Amazon Kendra","kendra"
176 "Amazon Kinesis","kinesis"
177 "Amazon Kinesis Analytics","kinesisanalytics"
178 "Amazon Kinesis Video Streams","kinesisvideo"
179 "AWS Key Management Service","kms"
180 "AWS Lake Formation","lakeformation"
181 "AWS Lambda","lambda"
182 "Launch Wizard","launchwizard"
183 "Amazon Lex","lex"
184 "AWS License Manager","license-manager"
185 "AWS License Manager User Subscriptions","license-manager-user-subscriptions"
186 "Amazon Lightsail","lightsail"
187 "Amazon CloudWatch Logs","logs"
188 "Amazon Lookout for Equipment","lookoutequipment"
189 "Amazon Lookout for Metrics","lookoutmetrics"
190 "Amazon Lookout for Vision","lookoutvision"
191 "AWS Mainframe Modernization Service","m2"
192 "Amazon Machine Learning","machinelearning"
193 "Amazon Macie","macie2"
194 "Amazon Managed Blockchain","managedblockchain"
195 "AWS Marketplace Commerce Analytics Service","marketplacecommerceanalytics"
196 "Amazon Mechanical Turk","mechanicalturk"
197 "AWS Elemental MediaConnect","mediaconnect"
198 "AWS Elemental MediaConvert","mediaconvert"
199 "AmazonMediaImport","mediaimport"
200 "AWS Elemental MediaLive","medialive"
201 "AWS Elemental MediaPackage","mediapackage"
202 "AWS Elemental MediaPackage VOD","mediapackage-vod"
203 "AWS Elemental MediaStore","mediastore"
204 "AWS Elemental MediaTailor","mediatailor"
205 "Amazon MemoryDB","memorydb"
206 "AWS Migration Hub","mgh"
207 "AWS Application Migration Service","mgn"
208 "AWS Migration Hub Orchestrator","migrationhub-orchestrator"
209 "AWS Migration Hub Strategy Recommendations","migrationhub-strategy"
210 "Amazon Mobile Analytics","mobileanalytics"
211 "AWS Mobile Hub","mobilehub"
212 "Amazon Pinpoint","mobiletargeting"
213 "Amazon Monitron","monitron"
214 "Amazon MQ","mq"
215 "Amazon Neptune","neptune-db"
216 "AWS Network Firewall","network-firewall"
217 "AWS Network Manager","networkmanager"
218 "Amazon Nimble Studio","nimble"
219 "AWS OpsWorks","opsworks"
220 "AWS OpsWorks Configuration Management","opsworks-cm"
221 "AWS Organizations","organizations"
222 "AWS Outposts","outposts"
223 "AWS Panorama","panorama"
224 "Amazon Personalize","personalize"
225 "AWS Performance Insights","pi"
226 "Amazon Polly","polly"
227 "AWS Price List","pricing"
228 "AWS service providing managed private networks","private-networks"
229 "Amazon Connect Customer Profiles","profile"
230 "AWS Proton","proton"
231 "AWS Purchase Orders Console","purchase-orders"
232 "Amazon QLDB","qldb"
233 "Amazon QuickSight","quicksight"
234 "AWS Resource Access Manager","ram"
235 "AWS Recycle Bin","rbin"
236 "Amazon RDS","rds"
237 "Amazon RDS Data API","rds-data"
238 "Amazon RDS IAM Authentication","rds-db"
239 "Amazon Redshift","redshift"
240 "Amazon Redshift Data API","redshift-data"
241 "Amazon Redshift Serverless","redshift-serverless"
242 "AWS Migration Hub Refactor Spaces","refactor-spaces"
243 "Amazon Rekognition","rekognition"
244 "AWS Resilience Hub Service","resiliencehub"
245 "AWS Tag Editor","resource-explorer"
246 "AWS Resource Groups","resource-groups"
247 "Amazon RHEL Knowledgebase Portal","rhelkb"
248 "AWS RoboMaker","robomaker"
249 "AWS Identity and Access Management Roles Anywhere","rolesanywhere"
250 "Amazon Route 53","route53"
251 "Amazon Route 53 Recovery Cluster","route53-recovery-cluster"
252 "Amazon Route 53 Recovery Controls","route53-recovery-control-config"
253 "Amazon Route 53 Recovery Readiness","route53-recovery-readiness"
254 "Amazon Route 53 Domains","route53domains"
255 "Amazon Route 53 Resolver","route53resolver"
256 "AWS CloudWatch RUM","rum"
257 "Amazon S3","s3"
258 "Amazon S3 Object Lambda","s3-object-lambda"
259 "Amazon S3 on Outposts","s3-outposts"
260 "Amazon SageMaker","sagemaker"
261 "Amazon SageMaker Ground Truth Synthetic","sagemaker-groundtruth-synthetic"
262 "AWS Savings Plans","savingsplans"
263 "Amazon EventBridge Schemas","schemas"
264 "Amazon SimpleDB","sdb"
265 "AWS Secrets Manager","secretsmanager"
266 "AWS Security Hub","securityhub"
267 "AWS Serverless Application Repository","serverlessrepo"
268 "AWS Service Catalog","servicecatalog"
269 "AWS Cloud Map","servicediscovery"
270 "AWS Microservice Extractor for .NET","serviceextract"
271 "Service Quotas","servicequotas"
272 "Amazon SES","ses"
273 "AWS Shield","shield"
274 "AWS Signer","signer"
275 "AWS Server Migration Service","sms"
276 "Amazon Pinpoint SMS Voice V2","sms-voice"
277 "AWS Snow Device Management","snow-device-management"
278 "AWS Snowball","snowball"
279 "Amazon SNS","sns"
280 "AWS SQL Workbench","sqlworkbench"
281 "Amazon SQS","sqs"
282 "AWS Systems Manager","ssm"
283 "AWS Systems Manager Incident Manager Contacts","ssm-contacts"
284 "AWS Systems Manager GUI Connect","ssm-guiconnect"
285 "AWS Systems Manager Incident Manager","ssm-incidents"
286 "Amazon Session Manager Message Gateway Service","ssmmessages"
287 "AWS IAM Identity Center (successor to AWS Single Sign-On)","sso"
288 "AWS IAM Identity Center (successor to AWS Single Sign-On) directory","sso-directory"
289 "AWS Step Functions","states"
290 "AWS Storage Gateway","storagegateway"
291 "AWS Security Token Service","sts"
292 "Amazon Sumerian","sumerian"
293 "AWS Support","support"
294 "AWS Support App for Slack","supportapp"
295 "AWS Support Plans","supportplans"
296 "AWS Sustainability","sustainability"
297 "Amazon Simple Workflow Service","swf"
298 "Amazon CloudWatch Synthetics","synthetics"
299 "Amazon Resource Group Tagging API","tag"
300 "AWS Tax Settings","tax"
301 "Amazon Textract","textract"
302 "Amazon Timestream","timestream"
303 "AWS Tiros","tiros"
304 "Amazon Transcribe","transcribe"
305 "AWS Transfer Family","transfer"
306 "Amazon Translate","translate"
307 "AWS Trusted Advisor","trustedadvisor"
308 "AWS Marketplace Vendor Insights","vendor-insights"
309 "Amazon Connect Voice ID","voiceid"
310 "AWS WAF","waf"
311 "AWS WAF Regional","waf-regional"
312 "AWS WAF V2","wafv2"
313 "Amazon WorkSpaces Application Manager","wam"
314 "AWS Well-Architected Tool","wellarchitected"
315 "Amazon Connect Wisdom","wisdom"
316 "Amazon WorkDocs","workdocs"
317 "Amazon WorkLink","worklink"
318 "Amazon WorkMail","workmail"
319 "Amazon WorkMail Message Flow","workmailmessageflow"
320 "Amazon WorkSpaces","workspaces"
321 "Amazon WorkSpaces Web","workspaces-web"
322 "AWS X-Ray","xray"やってみた
IAM Access Analyzer によるポリシー生成を試してみます。
Trail 証跡が有効であること、コンソールでは一度に一つまでしかポリシー生成できないこと、など事前に知っておくべきことが以下にまとまっているので目を通しておくと良いでしょう。
今回は検証環境でよく使用する個人用の IAM ロールでポリシー生成を試みます。 *1
IAM ロールの詳細画面のうち、アタッチされた IAM ポリシーが確認できる画面の下部にある以下ボタンを押下します。
次の画面で以下を選択し、「ポリシーを生成」を押下します。
- 分析対象とする期間
- 使用する CloudTrail 証跡
- アクティビティを確認するリージョン
- 分析に使用するサービスロール
なお、対象期間を長くかつリージョンを多数選択した場合、分析対象の CloudTrail ログファイルが多数にのぼり上限に抵触する可能性が高くなりますので注意してください。 *2 今回は対象のリージョンを 2 つに絞ってみました。
ポリシーの生成が開始されます。完了まで数分かかる場合があります。
今回のケースでは 8分程度で生成が完了しました。生成されたポリシーを表示します。
アクションレベルの情報に対応しているサービスは、以下のように表示されます。
オプションとしてアクションを追加できます。ここでは上記の「生成されたポリシーに含まれるアクション」で登場したサービスに加え、サービスレベルの情報にのみ対応したサービスも表示されます。（アクティビティ実績があるものに限ります。）
アクションを追加する場合は以下のようにプルダウンから選択します。指定が完了したら「次へ」を押下します。
続いてのステップでポリシーのカスタマイズを行います。IAM Access Analyzer によるポリシーの生成では、アクションの対象となるリソースまでは分析してくれません。
例えば"Resource": "arn:aws:ec2:${Region}:${Account}:security-group/${SecurityGroupId}"のようにプレースホルダ（${}で囲まれている部分）を含む形で生成されているため、そこを適宜変更してあげる必要があります。
↑プレースホルダを含む状態ではエラーとして検知されるので、適宜手動で修正してあげます。（具体的な値を入れる、一部もしくはすべてを*にするなど。）カスタマイズが完了したら、画面下部の「次へ」を押下します。 *3
最後のステップで以下を行い、最下部のボタンを押下します。
- 名前の指定
- 説明の指定
- 権限の概要の確認
- タグの追加
- 生成したポリシーのアタッチ有無の指定
カスタマイズした内容に応じたカスタマー管理ポリシーが生成され、IAM ロールにアタッチされました。
終わりに
IAM Acces Analyzer による CloudTrail 履歴をベースにしたポリシー生成で「アクションレベルの情報」に対応した AWS サービスが増えた、というアップデートでした。
サービスレベルの情報だけだと自分でアクションを選択する必要があり少し手間がかかるので、アクションレベルに対応したサービスが増えたのは嬉しいです。
まだ半分以上のサービスがアクションレベルに非対応なので、今後も対応サービス数が増えていくことに期待です。
以上、 チバユキ (@batchicchi) がお送りしました。
参考
脚注
- 対象のロールを選定する中で気づいたのですが、パスが「/aws-service-role/」である AWS サービスリンクロールではポリシーの生成ができないようです。（コンソール上でポリシー生成のボタンが無かった。）「/service-role/」のロールは可能でした。 ↩
- 詳細は以下をご参考ください IAM Access Analyzer によるポリシーの生成が失敗し CloudTrail ログファイルの処理数が上限を超えたエラーが表示された時どうする | DevelopersIO ↩
- 今回のケースではエラーが46個もでた上に、ポリシーサイズが上限を超える13,000程度あったのでカスタマイズが大変でした ↩
46
