Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon managed views

A managed view is how other Amazon Web Services services can access resource information indexed by Resource Explorer for your Amazon Web Services account or organization with your consent.

About managed views

Managed views can be updated or deleted only by the service that created the managed view. An Amazon Web Services service creates a managed view using IAM forward access sessions (FAS) or a service-linked role (SLR).

Resource Explorer uses a resource-based policy to control access to the managed view. When an Amazon service creates a managed view, Resource Explorer attaches the resource-based policy to the view. This policy allows the managing Amazon service to use and delete the view and allows view's resource owners to list and retrieve details about the view. The following is an example resource-based policy attached to a managed view:

Managed views can only be updated or deleted by the service that created the managed view. An Amazon Web Services service creates a managed view using IAM forward access sessions (FAS) or a service-linked role (SLR).

Resource Explorer uses a resource-based policy to control access to the managed view. When an Amazon service creates a managed view, Resource Explorer attaches the resource-based policy to the view. This policy allows the managing Amazon service to use and delete the view and allows view's resource owners to list and retrieve details about the view. The following is an example resource-based policy attached to a managed view:

JSON

{
  "Version":"2012-10-17",
  "Statement": [
  {
  "Sid": "view_UUID_ACCESS_TO_SERVICE_PRINCIPAL",
  "Effect": "Allow",
  "Principal": {
  "Service": "sampleservice.amazonaws.com"
  },
  "Action": [
  "resource-explorer-2:GetManagedView",
  "resource-explorer-2:Search"
  ],
  "Resource": "arn:aws-cn:resource-explorer-2:us-east-1:111122223333:managed-view/ExampleManagedViewName/EXAMPLE8-90ab-cdef-fedc-EXAMPLE11111",
  "Condition": {
  "StringEquals": {
  "aws:SourceAccount": "111122223333"
  }
  }
  },
  {
  "Sid": "view_UUID_DENY_ACCESS_TO_NON_SERVICE_PRINCIPAL",
  "Effect": "Deny",
  "Principal": "*",
  "Condition": {
  "ForAllValues:StringNotEquals": {
  "aws:PrincipalServiceNamesList": [
  "sampleservice.amazonaws.com"
  ]
  }
  },
  "NotAction": [
  "resource-explorer-2:GetManagedView"
  ],
  "Resource": "arn:aws-cn:resource-explorer-2:us-east-1:111122223333:managed-view/ExampleManagedViewName/EXAMPLE8-90ab-cdef-fedc-EXAMPLE11111"
  }
  ]
  }

Managed views can only be deleted by the Amazon service that manages them. Before the managing service can delete the view, you may need to perform service-specific tasks to remove a managed view from your account.

Resource Explorer managed views use the Amazon Systems Manager AWSManagedViewForSSM unified console resource, which allows Systems Manager to access resource information indexed by Resource Explorer for your organization. If you want to delete the managed view, you must disable the unified console in Systems Manager. For instructions, see Disabling the Systems Manager unified console in the Amazon Systems Manager User Guide.