:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のElastic Compute Service (ECS)リソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のElastic Compute Service (ECS)リソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のElastic Compute Service (ECS)アクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ecs:DescribeAccountAttributes",
          "ecs:DescribeAccountCommonQuotas",
          "ecs:DescribeAccountLimits",
          "ecs:DescribeAvailableResource",
          "ecs:DescribeBandwidthHistory",
          "ecs:DescribeCarePlans",
          "ecs:DescribeChargeTypeModificationPrice",
          "ecs:DescribeClassicLinkInstances",
          "ecs:DescribeCloudAssistantSettings",
          "ecs:DescribeClusters",
          "ecs:DescribeCustomerIssueCategory",
          "ecs:DescribeDedicatedBlockStorageClusterDisks",
          "ecs:DescribeDeploymentSetTopology",
          "ecs:DescribeDeploymentSets",
          "ecs:DescribeDiagnosisOperateRecords",
          "ecs:DescribeDiagnosticMetrics",
          "ecs:DescribeDiagnosticReportAttributes",
          "ecs:DescribeDiskDefaultKMSKeyId",
          "ecs:DescribeDiskEncryptionByDefaultStatus",
          "ecs:DescribeEcsScenarioFacade",
          "ecs:DescribeEipAddresses",
          "ecs:DescribeEipPrice",
          "ecs:DescribeFunctionFeedback",
          "ecs:DescribeHpcClusters",
          "ecs:DescribeImageFromFamily",
          "ecs:DescribeInsightCheckItems",
          "ecs:DescribeInsightChecks",
          "ecs:DescribeInsightStatus",
          "ecs:DescribeInsightSummaries",
          "ecs:DescribeInstanceCrossZoneModifyConstraint",
          "ecs:DescribeInstanceMigrationLog",
          "ecs:DescribeInstanceStatus",
          "ecs:DescribeInstanceTypeResource",
          "ecs:DescribeInstanceTypes",
          "ecs:DescribeKMSKeyAttribute",
          "ecs:DescribeKMSKeys",
          "ecs:DescribeLimitation",
          "ecs:DescribeLinkedKMSKeys",
          "ecs:DescribeMigrationInstancesTask",
          "ecs:DescribeMigrationPlans",
          "ecs:DescribeMigrationPreferences",
          "ecs:DescribeNetworkInsightsAnalysisResult",
          "ecs:DescribeNetworkInsightsAnalysises",
          "ecs:DescribeNetworkInsightsPaths",
          "ecs:DescribeOrderAutoRebootTime",
          "ecs:DescribePlanMaintenanceWindows",
          "ecs:DescribePortRangeListAssociations",
          "ecs:DescribePortRangeListEntries",
          "ecs:DescribePurchaseRecommendation",
          "ecs:DescribeRegions",
          "ecs:DescribeReservationDemandCommittedAmount",
          "ecs:DescribeReservationDemands",
          "ecs:DescribeReservedInstanceCategories",
          "ecs:DescribeResourceByTags",
          "ecs:DescribeResourceDisplay",
          "ecs:DescribeResourceStatusDiagnosis",
          "ecs:DescribeSecurityGroupSnapshotAttributes",
          "ecs:DescribeSecurityGroupSnapshotPolicies",
          "ecs:DescribeSecurityGroupSnapshots",
          "ecs:DescribeSnapshotBusinessStatus",
          "ecs:DescribeSnapshotCampaign",
          "ecs:DescribeSnapshotMonitorData",
          "ecs:DescribeSnapshotPackage",
          "ecs:DescribeSnapshotPolicyAssociatedSecurityGroups",
          "ecs:DescribeSnapshotPrice",
          "ecs:DescribeSnapshotsUsage",
          "ecs:DescribeSpotPriceHistory",
          "ecs:DescribeStorageCapacityUnitDeductFactor",
          "ecs:DescribeStorageSetDetails",
          "ecs:DescribeTaskAttribute",
          "ecs:DescribeTasks",
          "ecs:DescribeUserBusinessBehavior",
          "ecs:DescribeVSwitches",
          "ecs:DescribeVolumes",
          "ecs:DescribeVpcHavsInstances",
          "ecs:DescribeVpcs",
          "ecs:DescribeWaitingOrders",
          "ecs:DescribeZones",
          "ecs:ListAccountEcsQuotas",
          "ecs:ListBandwidthHistory",
          "ecs:ListChangedBlocks",
          "ecs:ListServiceSettings",
          "ecs:ListSnapshotBlocks",
          "ecs:QueryConstraints",
          "ecs:QueryCopyImageSupportRegions",
          "ecs:QueryNeedKeepUsing",
          "ecs:QueryUsableSnapshots",
          "ecs:QueryUserInfo"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ecs:AddInstancesToCarePlan",
          "ecs:AddInvisibleChecks",
          "ecs:AllocateEipAddress",
          "ecs:ApplySecurityGroupSnapshot",
          "ecs:AssociateEipAddress",
          "ecs:AssociateSecurityGroupSnapshotPolicy",
          "ecs:CancelMigrationPlan",
          "ecs:CancelSystemEvent",
          "ecs:CancelTask",
          "ecs:CheckOpenSnapshotService",
          "ecs:ConfirmCarePlanBill",
          "ecs:CreateCarePlan",
          "ecs:CreateClassicToVpcRollbackTask",
          "ecs:CreateDeploymentSet",
          "ecs:CreateDiagnosisOperateRecords",
          "ecs:CreateDiagnosticMetricSet",
          "ecs:CreateFunctionFeedback",
          "ecs:CreateHpcCluster",
          "ecs:CreateIssueCategoryReportRelation",
          "ecs:CreateNetworkInsightsPath",
          "ecs:CreatePlanMaintenanceWindow",
          "ecs:CreatePortRangeList",
          "ecs:CreateSecurityGroupSnapshotPolicy",
          "ecs:CreateSystemEvent",
          "ecs:DeleteCarePlan",
          "ecs:DeleteDeploymentSet",
          "ecs:DeleteDiagnosticMetricSets",
          "ecs:DeleteDiagnosticReports",
          "ecs:DeleteHpcCluster",
          "ecs:DeleteNetworkInsightsAnalysis",
          "ecs:DeleteNetworkInsightsPath",
          "ecs:DeletePlanMaintenanceWindow",
          "ecs:DeletePortRangeList",
          "ecs:DeleteReservationDemand",
          "ecs:DeleteSecurityGroupSnapshotPolicy",
          "ecs:DeleteVolume",
          "ecs:DeleteWaitingOrders",
          "ecs:DescribeAccountAttributes",
          "ecs:DescribeAccountCommonQuotas",
          "ecs:DescribeAccountLimits",
          "ecs:DescribeAvailableResource",
          "ecs:DescribeBandwidthHistory",
          "ecs:DescribeCarePlans",
          "ecs:DescribeChargeTypeModificationPrice",
          "ecs:DescribeClassicLinkInstances",
          "ecs:DescribeCloudAssistantSettings",
          "ecs:DescribeClusters",
          "ecs:DescribeCustomerIssueCategory",
          "ecs:DescribeDedicatedBlockStorageClusterDisks",
          "ecs:DescribeDeploymentSetTopology",
          "ecs:DescribeDeploymentSets",
          "ecs:DescribeDiagnosisOperateRecords",
          "ecs:DescribeDiagnosticMetrics",
          "ecs:DescribeDiagnosticReportAttributes",
          "ecs:DescribeDiskDefaultKMSKeyId",
          "ecs:DescribeDiskEncryptionByDefaultStatus",
          "ecs:DescribeEcsScenarioFacade",
          "ecs:DescribeEipAddresses",
          "ecs:DescribeEipPrice",
          "ecs:DescribeFunctionFeedback",
          "ecs:DescribeHpcClusters",
          "ecs:DescribeImageFromFamily",
          "ecs:DescribeInsightCheckItems",
          "ecs:DescribeInsightChecks",
          "ecs:DescribeInsightStatus",
          "ecs:DescribeInsightSummaries",
          "ecs:DescribeInstanceCrossZoneModifyConstraint",
          "ecs:DescribeInstanceMigrationLog",
          "ecs:DescribeInstanceStatus",
          "ecs:DescribeInstanceTypeResource",
          "ecs:DescribeInstanceTypes",
          "ecs:DescribeKMSKeyAttribute",
          "ecs:DescribeKMSKeys",
          "ecs:DescribeLimitation",
          "ecs:DescribeLinkedKMSKeys",
          "ecs:DescribeMigrationInstancesTask",
          "ecs:DescribeMigrationPlans",
          "ecs:DescribeMigrationPreferences",
          "ecs:DescribeNetworkInsightsAnalysisResult",
          "ecs:DescribeNetworkInsightsAnalysises",
          "ecs:DescribeNetworkInsightsPaths",
          "ecs:DescribeOrderAutoRebootTime",
          "ecs:DescribePlanMaintenanceWindows",
          "ecs:DescribePortRangeListAssociations",
          "ecs:DescribePortRangeListEntries",
          "ecs:DescribePurchaseRecommendation",
          "ecs:DescribeRegions",
          "ecs:DescribeReservationDemandCommittedAmount",
          "ecs:DescribeReservationDemands",
          "ecs:DescribeReservedInstanceCategories",
          "ecs:DescribeResourceByTags",
          "ecs:DescribeResourceDisplay",
          "ecs:DescribeResourceStatusDiagnosis",
          "ecs:DescribeSecurityGroupSnapshotAttributes",
          "ecs:DescribeSecurityGroupSnapshotPolicies",
          "ecs:DescribeSecurityGroupSnapshots",
          "ecs:DescribeSnapshotBusinessStatus",
          "ecs:DescribeSnapshotCampaign",
          "ecs:DescribeSnapshotMonitorData",
          "ecs:DescribeSnapshotPackage",
          "ecs:DescribeSnapshotPolicyAssociatedSecurityGroups",
          "ecs:DescribeSnapshotPrice",
          "ecs:DescribeSnapshotsUsage",
          "ecs:DescribeSpotPriceHistory",
          "ecs:DescribeStorageCapacityUnitDeductFactor",
          "ecs:DescribeStorageSetDetails",
          "ecs:DescribeTaskAttribute",
          "ecs:DescribeTasks",
          "ecs:DescribeUserBusinessBehavior",
          "ecs:DescribeVSwitches",
          "ecs:DescribeVolumes",
          "ecs:DescribeVpcHavsInstances",
          "ecs:DescribeVpcs",
          "ecs:DescribeWaitingOrders",
          "ecs:DescribeZones",
          "ecs:DisableDiskEncryptionByDefault",
          "ecs:DiskDefaultEncryptionQueryByParam",
          "ecs:EnableDiskEncryptionByDefault",
          "ecs:EnableInsight",
          "ecs:GetSnapshotBlock",
          "ecs:GetSnapshotInfo",
          "ecs:InnerCreateDiagnosticReport",
          "ecs:InnerOpenSnapShotService",
          "ecs:InnerReleaseDedicatedHost",
          "ecs:InnerReleaseElasticAssurance",
          "ecs:JoinSnapshotCampaign",
          "ecs:KeepUsing",
          "ecs:ListAccountEcsQuotas",
          "ecs:ListBandwidthHistory",
          "ecs:ListChangedBlocks",
          "ecs:ListServiceSettings",
          "ecs:ListSnapshotBlocks",
          "ecs:ModifyCarePlanAttribute",
          "ecs:ModifyCloudAssistantSettings",
          "ecs:ModifyDeploymentSetAttribute",
          "ecs:ModifyDiskDefaultKMSKeyId",
          "ecs:ModifyEipAddressAttribute",
          "ecs:ModifyHpcClusterAttribute",
          "ecs:ModifyOrderAutoRebootTime",
          "ecs:ModifyPlanMaintenanceWindow",
          "ecs:ModifyPortRangeList",
          "ecs:ModifyReservationDemand",
          "ecs:ModifyResourceMeta",
          "ecs:ModifySecurityGroupSnapshotPolicy",
          "ecs:ModifySnapshotBusinessStatus",
          "ecs:ModifySystemEventAttribute",
          "ecs:ModifyUserBusinessBehavior",
          "ecs:ModifyVolumeAttribute",
          "ecs:OpenSnapShotService",
          "ecs:OpenSnapshotService",
          "ecs:PurchaseSavingPlanOffering",
          "ecs:PurchaseStorageCapacityUnit",
          "ecs:QueryConstraints",
          "ecs:QueryCopyImageSupportRegions",
          "ecs:QueryNeedKeepUsing",
          "ecs:QueryUsableSnapshots",
          "ecs:QueryUserInfo",
          "ecs:ReAddMigrationTaskInPlan",
          "ecs:ReInitVolume",
          "ecs:ReinitDisk",
          "ecs:ReleaseCapacityReservation",
          "ecs:ReleaseEipAddress",
          "ecs:RemoveInvisibleChecks",
          "ecs:RepairDiagnosticReports",
          "ecs:ResetDiskDefaultKMSKeyId",
          "ecs:ResizeVolume",
          "ecs:RollbackVolume",
          "ecs:RunInstance",
          "ecs:StartNetworkInsightsAnalysis",
          "ecs:UnassociateEipAddress",
          "ecs:UnassociateSecurityGroupSnapshotPolicy",
          "ecs:UpdateServiceSettings",
          "ecs:ValidatePurchaseRule",
          "ecs:WithdrawCarePlan",
          "ecs:describeImageFromFamily",
          "ecs:describeInstances",
          "ecs:describenetworkinterfaces",
          "ecs:modifyDiskAttribute",
          "ecs:runInstances",
          "ecs:unmountPEDisk"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問