本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
AmazonSecurityLakeMetastoreManager
說明:Amazon SecurityLake 元存儲管理器 lambda 的政策,允許訪問雲觀察,S3,Glue 和 SQS。
AmazonSecurityLakeMetastoreManager
是AWS 受管理的策略。
使用此政策
您可以附加AmazonSecurityLakeMetastoreManager
至您的使用者、群組和角色。
政策詳情
-
類型:服務角色策略
-
創建時間:2024 年 1 月 23 日, 世界標準時間 15:26
-
編輯時間:世界標準時間 2024 年 4 月 1 日, 20:04
-
ARN:
arn:aws:iam::aws:policy/service-role/AmazonSecurityLakeMetastoreManager
政策版本
策略版本:v2(預設值)
原則的預設版本是定義原則權限的版本。當具有策略的使用者或角色發出要求以存取 AWS 資源時,請 AWS 檢查原則的預設版本,以決定是否允許該要求。
政策文件
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "AllowWriteLambdaLogs",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:CreateLogGroup"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:/aws/lambda/AmazonSecurityLake*",
"arn:aws:logs:*:*:/aws/lambda/AmazonSecurityLake*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowGlueManage",
"Effect" : "Allow",
"Action" : [
"glue:CreatePartition",
"glue:BatchCreatePartition",
"glue:GetTable",
"glue:UpdateTable"
],
"Resource" : [
"arn:aws:glue:*:*:table/amazon_security_lake_glue_db*/*",
"arn:aws:glue:*:*:database/amazon_security_lake_glue_db*",
"arn:aws:glue:*:*:catalog"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowToReadFromSqs",
"Effect" : "Allow",
"Action" : [
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:GetQueueAttributes"
],
"Resource" : [
"arn:aws:sqs:*:*:AmazonSecurityLake*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowMetaDataReadWrite",
"Effect" : "Allow",
"Action" : [
"s3:ListBucket",
"s3:PutObject",
"s3:GetObject"
],
"Resource" : [
"arn:aws:s3:::aws-security-data-lake*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowMetaDataCleanup",
"Effect" : "Allow",
"Action" : [
"s3:DeleteObject"
],
"Resource" : [
"arn:aws:s3:::aws-security-data-lake*/metadata/*.avro",
"arn:aws:s3:::aws-security-data-lake*/metadata/*.metadata.json"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
}
]
}