翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
Amazon Athena
これらのテンプレート例では、ステートマシンの定義におけるリソースに基づき、AWS Step Functions による IAM ポリシーの生成方法を示します。詳細については、以下を参照してください。
StartQueryExecution
静的リソース
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:stopQueryExecution",
"athena:getQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
- Request Response
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
動的リソース
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:stopQueryExecution",
"athena:getQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
- Request Response
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
StopQueryExecution
リソース
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:stopQueryExecution"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
}
]
}
GetQueryExecution
リソース
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:getQueryExecution"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
}
]
}
GetQueryResults
リソース
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:getQueryResults"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}
