Amazon 的 IAM 政策示例 QuickSight - Amazon QuickSight
身分型政策

重要事項：我們重新設計了 Amazon QuickSight 分析工作區。您可能會遇到無法反映 QuickSight 主控台中新外觀的螢幕擷取畫面或程序文字。我們正在更新螢幕擷取畫面和程序文字。

若要尋找功能或項目，請使用快速搜尋列。

有關新外觀 QuickSight的更多信息，請參閱在 Amazon 上引入新的分析體驗 QuickSight。

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

Amazon 的 IAM 政策示例 QuickSight

本節提供可與 Amazon 搭配使用的 IAM 政策範例 QuickSight。

適用於 Amazon 的 IAM 身分識別政策 QuickSight

本節顯示與 Amazon 搭配使用的基於身分的政策範例。 QuickSight

IAM 主控台管理的 QuickSight IAM 身分型政策

下列範例顯示 IAM 主控台管理動作所需的 QuickSight IAM 許可。

{
   "Statement": [
       {
           "Sid": "Statement1",
           "Effect": "Allow",
           "Action": [
               "quicksight:*",
               "iam:AttachRolePolicy",
               "iam:DetachRolePolicy",
               "iam:ListAttachedRolePolicies",
               "iam:GetPolicy",
               "iam:CreatePolicyVersion",
               "iam:DeletePolicyVersion",
               "iam:GetPolicyVersion",
               "iam:ListPolicyVersions",
               "iam:DeleteRole",
               "iam:CreateRole",
               "iam:GetRole",
               "iam:ListRoles",
               "iam:CreatePolicy",
               "iam:ListEntitiesForPolicy",
               "iam:listPolicies",
               "s3:ListAllMyBuckets",
               "athena:ListDataCatalogs",
               "athena:GetDataCatalog"
           ],
           "Resource": [
               "*"
           ]
       }
}

適用於 Amazon QuickSight 的 IAM 身分識別政策：儀表板

下列範例所顯示的 IAM 政策允許為特定儀表板啟用儀表板共用和內嵌功能。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "quicksight:RegisterUser",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "quicksight:GetDashboardEmbedUrl",
            "Resource": "arn:aws:quicksight:us-west-2:111122223333:dashboard/1a1ac2b2-3fc3-4b44-5e5d-c6db6778df89",
            "Effect": "Allow"
        }
    ]
}

適用於 Amazon QuickSight 的 IAM 身分識別政策：命名空間

下列範例顯示允許 QuickSight 管理員建立或刪除命名空間的 IAM 政策。

正在建立命名空間

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "ds:DescribeDirectories",
                "quicksight:CreateNamespace"
            ],
            "Resource": "*"
        }
    ]
}

刪除命名空間

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:UnauthorizeApplication",
                "ds:DeleteDirectory",
                "ds:DescribeDirectories",
                "quicksight:DeleteNamespace"
            ],
            "Resource": "*"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：自訂許可

下列範例顯示允許管理 QuickSight 員或開發人員管理自訂權限的 IAM 政策。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:*CustomPermissions"
            ],
            "Resource": "*"
        }
    ]
}

下列範例顯示授予與上一範例中所示相同許可的另一種方法。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:CreateCustomPermissions",
                "quicksight:DescribeCustomPermissions",
                "quicksight:ListCustomPermissions",
                "quicksight:UpdateCustomPermissions",
                "quicksight:DeleteCustomPermissions"
 
            ],
            "Resource": "*"
        }
    ]
}

Amazon 的 IAM 身分型政策 QuickSight：自訂電子郵件報告範本

下列範例顯示的政策允許在中檢視、更新和建立電子郵件報告範本 QuickSight，以及取得 Amazon 簡易電子郵件服務身分的驗證屬性。此原則可讓 QuickSight 系統管理員建立和更新自訂電子郵件報告範本，並確認他們想要傳送電子郵件報告的任何自訂電子郵件地址都是 SES 中已驗證的身分。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight: DescribeAccountCustomization",
                "quicksight: CreateAccountCustomization",
                "quicksight: UpdateAccountCustomization",
                "quicksight: DescribeEmailCustomizationTemplate",
                "quicksight: CreateEmailCustomizationTemplate",
                "quicksight: UpdateEmailCustomizationTemplate",
                "ses: GetIdentityVerificationAttributes"
            ],
            "Resource": "*"
        }
    ]
}

Amazon 的基於 IAM 身份的政策 QuickSight：創建用戶

下列範例顯示僅允許建立 Amazon QuickSight 使用者的政策。如果是 quicksight:CreateReader、quicksight:CreateUser 和 quicksight:CreateAdmin，您能將許可限制在 "Resource": "arn:aws:quicksight::<YOUR_AWS_ACCOUNTID>:user/${aws:userid}"。對於本指南中敘述的所有其他許可，請使用 "Resource": "*"。您指定的資源會限制特定資源的許可範圍。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "quicksight:CreateUser"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:quicksight::<YOUR_AWS_ACCOUNTID>:user/${aws:userid}"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：建立和管理群組

下列範例顯示可讓 QuickSight 系統管理員和開發人員建立和管理群組的原則。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:ListGroups",
                "quicksight:CreateGroup",
                "quicksight:SearchGroups",
                "quicksight:ListGroupMemberships",
                "quicksight:CreateGroupMembership",
                "quicksight:DeleteGroupMembership",
                "quicksight:DescribeGroupMembership",
                "quicksight:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：標準版的所有存取權

以下 Amazon QuickSight 標準版範例顯示允許訂閱和建立作者和讀者的政策。此範例明確拒絕 Amazon QuickSight 取消訂閱的權限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:CheckAlias",
                "ds:CreateAlias",
                "ds:DescribeDirectories",
                "ds:DescribeTrusts",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "iam:ListAccountAliases",
                "quicksight:CreateUser",
                "quicksight:Subscribe"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": 
                "quicksight:Unsubscribe",
            "Resource": "*"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：使用 IAM 身分中心的所有企業版存取權

Amazon QuickSight 企業版的下列範例顯示了一項政策，該政策允許在與 IAM 身分中心整合的 QuickSight 帳戶中訂閱、建立使用者和管理 Active Directory。此範例明確拒絕 Amazon QuickSight 取消訂閱的權限。

{
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "quicksight:*",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:GetPolicy",
                "iam:CreatePolicyVersion",
                "iam:DeletePolicyVersion",
                "iam:GetPolicyVersion",
                "iam:ListPolicyVersions",
                "iam:DeleteRole",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:ListRoles",
                "iam:CreatePolicy",
                "iam:ListEntitiesForPolicy",
                "iam:listPolicies",
                "s3:ListAllMyBuckets",
                "athena:ListDataCatalogs",
                "athena:GetDataCatalog",
                "sso:GetManagedApplicationInstance" ,
                "sso:CreateManagedApplicationInstance",
                "sso:GetManagedApplicationInstance",
                "sso:DeleteManagedApplicationInstance",
                "sso:GetManagedApplicationInstance",
                "sso:DescribeGroup",
                "sso:SearchGroups",
                "sso:GetProfile",
                "sso:AssociateProfile", 
                "sso:DisassociateProfile", 
                "sso:ListProfiles", 
                "sso:ListDirectoryAssociations", 
                "sso:DescribeRegisteredRegions" 
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Amazon 的 IAM 基於身份的政策 QuickSight：使用活動目錄的企業版的所有訪問

Amazon QuickSight 企業版的下列範例顯示一項政策，該政策允許在使用 Active Directory 進行身分管理的 QuickSight 帳戶中訂閱、建立使用者和管理 Active Directory。此範例明確拒絕 Amazon QuickSight 取消訂閱的權限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:CheckAlias",
                "ds:CreateAlias",
                "ds:DescribeDirectories",
                "ds:DescribeTrusts",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "iam:ListAccountAliases",
                "quicksight:CreateAdmin",
                "quicksight:Subscribe",
                "quicksight:GetGroupMapping",
                "quicksight:SearchDirectoryGroups",
                "quicksight:SetGroupMapping"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "quicksight:Unsubscribe",
            "Resource": "*"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：作用中目錄群組

下列範例顯示允許針對 Amazon QuickSight 企業版帳戶進行作用中目錄群組管理的 IAM 政策。

{
    "Statement": [
        {
            "Action": [
                "ds:DescribeTrusts",
                "quicksight:GetGroupMapping",
                "quicksight:SearchDirectoryGroups",
                "quicksight:SetGroupMapping"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

Amazon 的 IAM 身分型政策 QuickSight：使用管理資產管理主控台

下列範例所顯示的 IAM 政策允許存取管理員資產管理主控台。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [          
                "quicksight:SearchGroups",
                "quicksight:SearchUsers",              
                "quicksight:ListNamespaces",            
                "quicksight:DescribeAnalysisPermissions",
                "quicksight:DescribeDashboardPermissions",
                "quicksight:DescribeDataSetPermissions",
                "quicksight:DescribeDataSourcePermissions",
                "quicksight:DescribeFolderPermissions",
                "quicksight:ListAnalyses",
                "quicksight:ListDashboards",
                "quicksight:ListDataSets",
                "quicksight:ListDataSources",
                "quicksight:ListFolders",
                "quicksight:SearchAnalyses",
                "quicksight:SearchDashboards",
                "quicksight:SearchFolders",
                "quicksight:SearchDatasets",
                "quicksight:SearchDatasources",               
                "quicksight:UpdateAnalysisPermissions",
                "quicksight:UpdateDashboardPermissions",
                "quicksight:UpdateDataSetPermissions",
                "quicksight:UpdateDataSourcePermissions",
                "quicksight:UpdateFolderPermissions"
            ],
            "Resource": "*"
        }
    ]
}

Amazon 的 IAM 身分型政策 QuickSight：使用管理金鑰管理主控台

下列範例所顯示的 IAM 政策允許存取管理員金鑰管理主控台。

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "kms:CreateGrant",
              "kms:ListAliases",
              "kms:ListKeys",
              "quicksight:ListCustomerManagedKeys",
              "quicksight:ListKMSKeysForUser",
              "quicksight:RegisterCustomerManagedKey"
              "quicksight:RemoveCustomerManagedKey",
          ],
          "Resource": "*"
      }
  ]

AWS Amazon 資源 QuickSight：企業版中的範圍政策

以下 Amazon QuickSight 企業版範例顯示了一項政策，該政策允許設定對資源的預設存取權限，以及為 AWS 資源的許可設定政策的範圍。 AWS 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "quicksight:*IAMPolicyAssignment*",
                "quicksight:AccountConfigurations"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}