IAM(Identity And Access Management)

• 最終更新日: 2026年6月9日
• 最終更新者: 都築

概要

本資料では、AWSにおけるIAMの設定を記載します。

ユーザーグループ

S3-zabbix-backup.vt-FullAccess-Group

• ユーザー: S3-zabbix-backup.vt-FullAccess-User
• 許可ポリシー: S3-zabbix-backup.vt-FullAccess

ユーザー

S3-unitbase-backup.vt-PutList-User

• コンソールを通じたアクセス: 無効
• アクセスキー: 設定済み(ID一覧.xlsx 参照)
• 許可
• 許可ポリシー: S3-unitbase-backup.vt-PutList
• グループ: (なし)

S3-zabbix-backup.vt-FullAccess-User

• コンソールを通じたアクセス: 無効
• アクセスキー: 設定済み(ID一覧.xlsx 参照)
• グループ: S3-zabbix-backup.vt-FullAccess-Group
• アタッチされたポリシー: s3-zabbix-backup.vt-FullAccess

ポリシー

S3-202507renketsu.vt-FullAccess

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::202507renketsu.vt"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::202507renketsu.vt/*"
        }
    ]
}

S3-unitbase-backup.vt-PutList

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads"
            ],
            "Resource": "arn:aws:s3:::unitbase-backup.vt"
        },
        {
            "Sid": "PutObjectsWithMPU",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:AbortMultipartUpload",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": "arn:aws:s3:::unitbase-backup.vt/*"
        }
    ]
}

S3-vt-holdings-sp-archive_compliance-rw

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListComplianceFolder",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "compliance/*"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive"
        },
        {
            "Sid": "AllowReadWriteComplianceFolder",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive/compliance/*"
        }
    ]
}

S3-vt-holdings-sp-archive_internal_audit-rw-nodelete

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListInternalAuditFolder",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "internal_audit/*"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive"
        },
        {
            "Sid": "AllowReadWriteInternalAuditFolder",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive/internal_audit/*"
        },
        {
            "Sid": "ExplicitDenyDeleteInternalAuditFolder",
            "Effect": "Deny",
            "Action": [
                "s3:DeleteObject",
                "s3:DeleteObjectVersion"
            ],
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive/internal_audit/*"
        }
    ]
}

S3-vt-holdings-sp-archive_ir-rw

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListIRFolder",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "ir/*"
                    ]
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive"
        },
        {
            "Sid": "AllowReadWriteIRFolder",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::vt-holdings-sp-archive/ir/*"
        }
    ]
}

S3-zabbix-backup.vt-FullAccess

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": "arn:aws:s3:::zabbix-backup.vt"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::zabbix-backup.vt/*"
        }
    ]
}

目次へ

参考

• 2025.7.28 STRAVISの前のシステムのデータのバックアップ(Wrike#1690417781)にてAWS利用開始に伴い、管理開始。
• 2025.11.21 Unitbaseにつながらない(Wrike#1789977214)にて、UnibaseのバックアップをAWS S3に退避する設定を行ったので、これを反映。

以上です。

目次へ