翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
AmazonDataZoneRedshiftGlueProvisioningPolicy
説明: Amazon DataZone は、データのカタログ化、検出、管理、共有、分析を可能にするデータ管理サービスです。Amazon DataZone を使用すると、アカウントとサポートされているリージョン間でデータを共有してアクセスできます。Amazon DataZone は、Amazon Redshift、Amazon Athena、 AWS Glue、 AWS Lake Formation など、 AWS のサービス全体のエクスペリエンスを簡素化します。
AmazonDataZoneRedshiftGlueProvisioningPolicy は AWS マネージドポリシーです。
このポリシーを使用すると
ユーザー、グループおよびロールに AmazonDataZoneRedshiftGlueProvisioningPolicy をアタッチできます。
ポリシーの詳細
-
タイプ: AWS 管理ポリシー
-
作成日時: 2023 年 9 月 22 日 20:19 UTC
-
編集日時： 2024 年 10 月 23 日 18:29 UTC
-
ARN:
arn:aws:iam::aws:policy/AmazonDataZoneRedshiftGlueProvisioningPolicy
ポリシーのバージョン
ポリシーバージョン：v4 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを判断します。
JSON ポリシードキュメント
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AmazonDataZonePermissionsToCreateEnvironmentRole", "Effect" : "Allow", "Action" : [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource" : "arn:aws:iam::*:role/datazone*", "Condition" : { "StringEquals" : { "iam:PermissionsBoundary" : "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary", "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "IamPassRolePermissions", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/datazone*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ], "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZonePermissionsToManageCreatedEnvironmentRole", "Effect" : "Allow", "Action" : [ "iam:DeleteRole", "iam:GetRole" ], "Resource" : "arn:aws:iam::*:role/datazone*", "Condition" : { "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneCFStackCreationForEnvironments", "Effect" : "Allow", "Action" : [ "cloudformation:CreateStack", "cloudformation:TagResource" ], "Resource" : [ "arn:aws:cloudformation:*:*:stack/DataZone*" ], "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : "AmazonDataZoneEnvironment" }, "Null" : { "aws:ResourceTag/AmazonDataZoneEnvironment" : "false" } } }, { "Sid" : "AmazonDataZoneCFStackManagementForEnvironments", "Effect" : "Allow", "Action" : [ "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents" ], "Resource" : [ "arn:aws:cloudformation:*:*:stack/DataZone*" ] }, { "Sid" : "AmazonDataZoneEnvironmentParameterValidation", "Effect" : "Allow", "Action" : [ "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:CreateDatabase", "glue:GetDatabase", "athena:GetWorkGroup", "logs:DescribeLogGroups", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift:DescribeClusters", "secretsmanager:ListSecrets" ], "Resource" : "*" }, { "Sid" : "AmazonDataZoneEnvironmentLakeFormationPermissions", "Effect" : "Allow", "Action" : [ "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:ListResources" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneEnvironmentGlueDeletePermissions", "Effect" : "Allow", "Action" : [ "glue:DeleteDatabase" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneEnvironmentAthenaDeletePermissions", "Effect" : "Allow", "Action" : [ "athena:DeleteWorkGroup" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneEnvironmentAthenaResourceCreation", "Effect" : "Allow", "Action" : [ "athena:CreateWorkGroup", "athena:TagResource", "iam:TagRole", "iam:TagPolicy", "logs:TagLogGroup" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : "AmazonDataZoneEnvironment" }, "Null" : { "aws:ResourceTag/AmazonDataZoneEnvironment" : "false" }, "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneEnvironmentLogGroupCreation", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:DeleteLogGroup" ], "Resource" : "arn:aws:logs:*:*:log-group:datazone-*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : "AmazonDataZoneEnvironment" }, "Null" : { "aws:ResourceTag/AmazonDataZoneEnvironment" : "false" }, "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneEnvironmentLogGroupManagement", "Action" : [ "logs:PutRetentionPolicy" ], "Resource" : "arn:aws:logs:*:*:log-group:datazone-*", "Effect" : "Allow", "Condition" : { "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneEnvironmentIAMPolicyManagement", "Effect" : "Allow", "Action" : [ "iam:DeletePolicy", "iam:CreatePolicy", "iam:GetPolicy", "iam:ListPolicyVersions", "iam:DeletePolicyVersion" ], "Resource" : [ "arn:aws:iam::*:policy/datazone*" ], "Condition" : { "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "AmazonDataZoneEnvironmentS3ValidationPermissions", "Effect" : "Allow", "Action" : [ "s3:ListAllMyBuckets", "s3:ListBucket" ], "Resource" : "arn:aws:s3:::*" }, { "Sid" : "AmazonDataZoneEnvironmentKMSDecryptPermissions", "Effect" : "Allow", "Action" : [ "kms:GenerateDataKey", "kms:Decrypt" ], "Resource" : "*", "Condition" : { "Null" : { "aws:ResourceTag/AmazonDataZoneEnvironment" : "false" } } }, { "Sid" : "PermissionsToTagAmazonDataZoneEnvironmentGlueResources", "Effect" : "Allow", "Action" : [ "glue:TagResource" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : "AmazonDataZoneEnvironment" }, "Null" : { "aws:RequestTag/AmazonDataZoneEnvironment" : "false" } } }, { "Sid" : "PermissionsToGetAmazonDataZoneEnvironmentBlueprintTemplates", "Effect" : "Allow", "Action" : "s3:GetObject", "Resource" : "*", "Condition" : { "StringNotEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringEquals" : { "aws:CalledViaFirst" : [ "cloudformation.amazonaws.com" ] } } }, { "Sid" : "RedshiftDataPermissions", "Effect" : "Allow", "Action" : [ "redshift-data:ListSchemas", "redshift-data:ExecuteStatement" ], "Resource" : [ "arn:aws:redshift-serverless:*:*:workgroup/*", "arn:aws:redshift:*:*:cluster:*" ] }, { "Sid" : "DescribeStatementPermissions", "Effect" : "Allow", "Action" : [ "redshift-data:DescribeStatement" ], "Resource" : "*" }, { "Sid" : "GetSecretValuePermissions", "Effect" : "Allow", "Action" : [ "secretsmanager:GetSecretValue" ], "Resource" : "*", "Condition" : { "StringLike" : { "secretsmanager:ResourceTag/AmazonDataZoneDomain" : "dzd*" } } } ] }
詳細
