権限のリスト (Permissions List)

次の表に、アマゾン ウェブ サービスのすべてのアクティビティ、実行可能な処理、関連するアクセス許可を示します。

EC2 アクティビティ

アクティビティ	操作	権限
Robot を構成	GetDocumentAsync CreateDocumentAsync CreateAssociationAsync SendCommandAsync DeleteDocumentAsync	ssm:GetDocument ssm:CreateDocument ssm:CreateAssociation ssm:SendCommand ssm:DeleteDocument ssm:ListAssociations
インスタンスを作成	RunInstancesAsync CreateTagsAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:RunInstances ec2:CreateTags ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
インスタンスを起動テンプレートから作成	RunInstancesAsync CreateTagsAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:RunInstances ec2:CreateTags ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
ID でインスタンスを取得	DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
インスタンス リストを取得	DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
インスタンスを再起動	RebootInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:RebootInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
PowerShell コマンドを実行	GetDocumentAsync CreateDocumentAsync CreateAssociationAsync SendCommandAsync DeleteDocumentAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ssm:GetDocument ssm:CreateDocument ssm:CreateAssociation ssm:SendCommand ssm:DeleteDocument ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages ssm:ListAssociations
インスタンスを起動	StartInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:StartInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
インスタンスを停止	StopInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:StopInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages
インスタンスを終了	TerminateInstancesAsync DescribeInstancesAsync DescribeInstanceAttributeAsync DescribeImagesAsync	ec2:TerminateInstances ec2:DescribeInstances ec2:DescribeInstanceAttribute ec2:DescribeImages

S3 Buckets アクティビティ

アクティビティ	操作	権限
バケットのログ記録を設定	GetACLAsync PutACLAsync PutBucketLoggingAsync	s3:GetBucketAcl s3:PutBucketAcl s3:PutBucketLogging
バケットへのパブリック アクセスを設定	PutPublicAccessBlockAsync	s3:PutBucketPublicAccessBlock
バケットを作成	DoesS3BucketExistV2Async PutBucketAsync PutBucketVersioningAsync DeleteBucketEncryptionAsync PutBucketEncryptionAsync PutBucketTaggingAsync PutPublicAccessBlockAsync ListBucketsAsync GetBucketLocationAsync GetBucketTaggingAsync GetBucketVersioningAsync GetACLAsync GetBucketLoggingAsync GetObjectLockConfigurationAsync GetPublicAccessBlockAsync GetBucketEncryptionAsync DeleteS3BucketWithObjectsAsync	s3:GetBucketAcl s3:CreateBucket s3:PutBucketObjectLockConfiguration s3:PutBucketVersioning s3:PutEncryptionConfiguration s3:PutEncryptionConfiguration s3:PutBucketTagging s3:PutBucketPublicAccessBlock s3:ListBucket s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketVersioning s3:GetBucketAcl s3:GetBucketLogging s3:GetBucketObjectLockConfiguration s3:GetBucketPublicAccessBlock s3:GetEncryptionConfiguration s3:DeleteBucket s3:DeleteObject
バケットを削除	GetBucketVersioningAsync ListVersionsAsync ListObjectsV2Async DeleteObjectsAsync DeleteBucketAsync	s3:GetBucketVersioning s3:ListBucketVersions s3:ListBucket s3:DeleteObjectVersion s3:DeleteBucket s3:ListAllMyBuckets
バケット ポリシーを削除	DeleteBucketPolicyAsync	s3:DeleteBucketPolicy
バケットを空にする	GetBucketVersioningAsync ListVersionsAsync ListObjectsV2Async DeleteObjectsAsync	s3:GetBucketVersioning s3:ListBucketVersions s3:ListBucket s3:DeleteObjectVersion
バケットを取得	DoesS3BucketExistV2Async ListBucketsAsync GetBucketLocationAsync GetBucketTaggingAsync GetACLAsync GetBucketVersioningAsync GetBucketLoggingAsync GetObjectLockConfigurationAsync GetPublicAccessBlockAsync GetBucketEncryptionAsync	s3:GetBucketAcl (任意) s3:ListBucket s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketAcl s3:GetBucketVersioning s3:GetBucketLogging s3:GetBucketObjectLockConfiguration s3:GetBucketPublicAccessBlock s3:GetEncryptionConfiguration
バケット リストを取得	ListBucketsAsync GetBucketLocationAsync GetBucketTaggingAsync DoesS3BucketExistV2Async	s3:ListBucket s3:GetBucketLocation s3:GetBucketTagging s3:GetBucketAcl
バケット ポリシーを取得	GetBucketPolicyAsync	s3:GetBucketPolicy
バケット ポリシーを設定	PutBucketPolicyAsync	s3:PutBucketPolicy
バケットのプロパティを更新	DoesS3BucketExistV2Async PutBucketVersioningAsync DeleteBucketEncryptionAsync PutBucketEncryptionAsync PutBucketTaggingAsync PutPublicAccessBlockAsync	s3:GetBucketAcl s3:PutBucketVersioning s3:PutEncryptionConfiguration s3:PutEncryptionConfiguration s3:PutBucketTagging s3:PutBucketPublicAccessBlock

S3 オブジェクト アクティビティ

アクティビティ	操作	権限
オブジェクトをコピー	GetBucketLocationAsync CopyObjectAsync	s3:GetBucketLocation s3:GetObject s3:PutObject
複数のオブジェクトを削除	DeleteObjectsAsync	s3:DeleteObjectVersion s3:GetObject
1 つのオブジェクトを削除	DeleteObjectsAsync	s3:DeleteObjectVersion s3:GetObject
オブジェクトをファイルにダウンロード	GetObjectAsync	s3:GetObject
繰り返し (バケットの各オブジェクト)	ListObjectsV2Async GetObjectMetadataAsync GetBucketLocationAsync GetObjectTaggingAsync ListVersionsAsync	s3:ListBucket s3:GetObject s3:ListBucketVersions s3:GetBucketLocation s3:GetObjectTagging s3:ListBucketVersions
オブジェクトを取得	GetObjectMetadataAsync GetBucketLocationAsync GetObjectTaggingAsync ListVersionsAsync	s3:ListBucketVersions s3:GetBucketLocation s3:GetObjectTagging s3:ListBucketVersions s3:GetObject
オブジェクトの ACL を取得	GetACLAsync	s3:GetObjectAcl s3:GetObject
オブジェクトの ACL を設定	GetACLAsync PutACLAsync	s3:GetObjectAcl s3:PutObjectAcl s3:GetObject
オブジェクトをフォルダーからアップロード	UploadDirectoryAsync	s3:PutObject s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:AbortMultipartUpload s3:GetObject
オブジェクトをファイルからアップロード	UploadAsync GetObjectMetadataAsync GetBucketLocationAsync GetObjectTaggingAsync ListVersionsAsync GetACLAsync PutACLAsync	s3:GetObject s3:PutObject s3:PutObjectTagging s3:PutObjectVersionTagging s3:ListBucketVersions s3:GetBucketLocation s3:GetObjectTagging s3:GetObjectVersionTagging s3:GetObjectAcl s3:PutObjectAcl s3:ListBucketMultipartUploads s3:ListMultipartUploadParts s3:AbortMultipartUpload

IAM グループ アクティビティ

アクティビティ	操作	権限
ユーザーをグループに追加	AddUserToGroupAsync	iam:AddUserToGroup
グループを作成	CreateGroupAsync	iam:CreateGroup
グループを削除	DeleteGroupAsync GetGroupAsync RemoveUserFromGroupAsync ListGroupPoliciesAsync DeleteGroupPolicyAsync ListAttachedGroupPoliciesAsync DetachGroupPolicyAsync	iam:DeleteGroup iam:GetGroup iam:RemoveUserFromGroup iam:ListGroupPolicies iam:DeleteGroupPolicy iam:ListAttachedGroupPolicies iam:DetachGroupPolicy
繰り返し (各グループ)	ListGroupsAsync	iam:ListGroups
グループを取得	GetGroupAsync	iam:GetGroup
ユーザーをグループから削除	RemoveUserFromGroupAsync	iam:RemoveUserFromGroup
グループを更新	UpdateGroupAsync GetGroupAsync	iam:UpdateGroup iam:GetGroup

IAM ポリシー アクティビティ

アクティビティ	操作	権限
インライン ポリシーを追加/削除	PutGroupPolicyAsync DeleteGroupPolicyAsync PutRolePolicyAsync DeleteRolePolicyAsync PutUserPolicyAsync DeleteUserPolicyAsync	iam:PutGroupPolicy iam:DeleteGroupPolicy iam:PutRolePolicy iam:DeleteRolePolicy iam:PutUserPolicy iam:DeleteUserPolicy
管理ポリシーをアタッチ/デタッチ	AttachGroupPolicyAsync DetachGroupPolicyAsync AttachRolePolicyAsync DetachRolePolicyAsync AttachUserPolicyAsync DetachUserPolicyAsync	iam:AttachGroupPolicy iam:DetachGroupPolicy iam:AttachRolePolicy iam:DetachRolePolicy iam:AttachUserPolicy iam:DetachUserPolicy
管理ポリシーを作成	CreatePolicyAsync GetPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:CreatePolicy iam:GetPolicy iam:ListPolicyVersions iam:GetPolicyVersion
管理ポリシーを削除	ListEntitiesForPolicyAsync DetachGroupPolicyAsync DetachRolePolicyAsync DetachUserPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync DeletePolicyVersionAsync DeletePolicyAsync	iam:ListEntitiesForPolicy iam:DetachGroupPolicy iam:DetachRolePolicy iam:DetachUserPolicy iam:ListPolicyVersions iam:GetPolicyVersion iam:DeletePolicyVersion iam:DeletePolicy
繰り返し (各管理ポリシー)	ListPoliciesAsync ListPolicyTagsAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:ListPolicies iam:ListPolicyTags iam: ListPolicyVersions iam;GetPolicyVersion
IAM アイデンティティのインライン ポリシーを取得	ListGroupPoliciesAsync GetGroupPolicyAsync ListRolePoliciesAsync GetRolePolicyAsync ListUserPoliciesAsync GetUserPolicyAsync	iam:ListGroupPolicies iam:GetGroupPolicy iam:ListRolePolicies iam:GetRolePolicy iam:ListUserPolicies iam:GetUSerPolicy
IAM アイデンティティの管理ポリシーを取得	ListAttachedGroupPoliciesAsync ListAttachedRolePoliciesAsync ListAttachedUserPoliciesAsync	iam:ListAttachedGroupPolicies iam:ListAttachedRolePolicies iam:ListAttachedUserPolicies
管理ポリシーにアタッチされた IAM アイデンティティを取得	ListEntitiesForPolicyAsync	iam:ListEntitiesForPolicy
管理ポリシーを取得	GetPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:GetPolicy iam:ListPolicyVersions iam:GetPolicyVersion
管理ポリシーを更新	UntagPolicyAsync TagPolicyAsync CreatePolicyVersionAsync SetDefaultPolicyVersionAsync DeletePolicyVersionAsync GetPolicyAsync ListPolicyVersionsAsync GetPolicyVersionAsync	iam:UntagPolicy iam:TagPolicy iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:DeletePolicyVersion iam:GetPolicy iam:ListPolicyVersions iam:GetPolicyVersion

IAM Role アクティビティ

アクティビティ	操作	権限
ロールをインスタンス プロファイルに追加	AddRoleToInstanceProfileAsync GetInstanceProfileAsync RemoveRoleFromInstanceProfileAsync	iam:AddRoleToInstanceProfile iam:GetInstanceProfile iam:RemoveRoleFromInstanceProfile
ロールをインスタンス プロファイルから削除	RemoveRoleFromInstanceProfileAsync	iam:RemoveRoleFromInstanceProfile
ロールを作成	CreateRoleAsync GetRoleAsync	iam:CreateRole iam:GetRole
ロールを削除	DeleteRoleAsync ListInstanceProfilesForRoleAsync RemoveRoleFromInstanceProfileAsync ListRolePoliciesAsync DeleteRolePolicyAsync ListAttachedRolePoliciesAsync DetachRolePolicyAsync GetInstanceProfileAsync DeleteInstanceProfileAsync	iam:DeleteRole iam:ListInstanceProfilesForRole iam:RemoveRoleFromInstanceProfile iam:ListRolePolicies iam:DeleteRolePolicy iam:ListAttachedRolePolicies iam:DetachRolePolicy iam:GetInstanceProfile iam:DeleteInstanceProfile
ロールを取得	GetRoleAsync	iam:GetRole
ロールを更新	UpdateRoleAsync DeleteRolePermissionsBoundaryAsync PutRolePermissionsBoundaryAsync UntagRoleAsync TagRoleAsync GetRoleAsync	iam:UpdateRole iam:DeleteRolePermissionsBoundary iam:PutRolePermissionsBoundary iam:UntagRole iam:TagRole iam:GetRole
繰り返し (各ロール)	ListRolesAsync ListRoleTagsAsync	iam:ListRoles iam:ListRoleTags

IAM User アクティビティ

アクティビティ	操作	権限
ユーザー パスワードを変更	UpdateLoginProfileAsync AttachUserPolicyAsync	iam:UpdateLoginProfile iam:AttachUserPolicy
ユーザーを作成	CreateUserAsync CreateLoginProfileAsync AttachUserPolicyAsync CreateAccessKeyAsync	iam:CreateUser iam:CreateLoginProfile iam:AttachUserPolicy iam:CreateAccessKey
ユーザーを取得	GetUserAsync	iam:GetUser
ユーザーを削除	DeleteUserAsync DeleteLoginProfileAsync ListAccessKeysAsync DeleteAccessKeyAsync ListSigningCertificatesAsync DeleteSigningCertificateAsync ListSSHPublicKeysAsync DeleteSSHPublicKeyAsync ListServiceSpecificCredentialsAsync DeleteServiceSpecificCredentialAsync ListVirtualMFADevicesAsync DeactivateMFADeviceAsync DeleteVirtualMFADeviceAsync ListUserPoliciesAsync DeleteUserPolicyAsync ListAttachedUserPoliciesAsync DetachUserPolicyAsync ListGroupsForUserAsync RemoveUserFromGroupAsync	iam:DeleteUser iam:DeleteLoginProfile iam:ListAccessKeys iam:DeleteAccessKey iam:ListSigningCertificates iam:DeleteSigningCertificate iam:ListSSHPublicKeys iam:DeleteSSHPublicKey iam:ListServiceSpecificCredentials iam:DeleteServiceSpecificCredential iam:ListVirtualMFADevices iam:DeactivateMFADevice iam:DeleteVirtualMFADevice iam:ListUserPolicies iam:DeleteUserPolicy iam:ListAttachedUserPolicies iam:DetachUserPolicy iam:ListGroupsForUser iam:RemoveUserFromGroup
ユーザーを更新	UpdateUserAsync DeleteUserPermissionsBoundaryAsync PutUserPermissionsBoundaryAsync UntagUserAsync TagUserAsync GetUserAsync	iam:UpdateUser iam:DeleteUserPermissionsBoundary iam:PutUserPermissionsBoundary iam:UntagUser iam:TagUser iam:GetUser
繰り返し (各ユーザー)	ListUsersAsync ListUserTagsAsync	iam:ListUsers iam:ListUserTags
繰り返し (各ユーザー グループ)	ListGroupsForUserAsync	iam:ListGroupsForUser
繰り返し (グループ内の各ユーザー)	GetGroupAsync ListUserTagsAsync	iam:GetGroup iam:ListUserTags