Amazon 的 IAM 政策示例 QuickSight - Amazon QuickSight
身分型政策

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

Amazon 的 IAM 政策示例 QuickSight

本節提供可與 Amazon 搭配使用的 IAM 政策範例 QuickSight。

適用於 Amazon 的 IAM 身分識別政策 QuickSight

本節顯示與 Amazon 搭配使用的基於身分的政策範例。 QuickSight

IAM 主控台管理的 QuickSight IAM 身分型政策

下列範例顯示 IAM 主控台管理動作所需的 QuickSight IAM 許可。

{
   "Statement": [
       {
           "Sid": "Statement1",
           "Effect": "Allow",
           "Action": [
               "quicksight:*",
               "iam:AttachRolePolicy",
               "iam:DetachRolePolicy",
               "iam:ListAttachedRolePolicies",
               "iam:GetPolicy",
               "iam:CreatePolicyVersion",
               "iam:DeletePolicyVersion",
               "iam:GetPolicyVersion",
               "iam:ListPolicyVersions",
               "iam:DeleteRole",
               "iam:CreateRole",
               "iam:GetRole",
               "iam:ListRoles",
               "iam:CreatePolicy",
               "iam:ListEntitiesForPolicy",
               "iam:listPolicies",
               "s3:ListAllMyBuckets",
               "athena:ListDataCatalogs",
               "athena:GetDataCatalog"
           ],
           "Resource": [
               "*"
           ]
       }
}

適用於 Amazon QuickSight 的 IAM 身分識別政策：儀表板

下列範例所顯示的 IAM 政策允許為特定儀表板啟用儀表板共用和內嵌功能。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "quicksight:RegisterUser",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "quicksight:GetDashboardEmbedUrl",
            "Resource": "arn:aws:quicksight:us-west-2:111122223333:dashboard/1a1ac2b2-3fc3-4b44-5e5d-c6db6778df89",
            "Effect": "Allow"
        }
    ]
}

適用於 Amazon QuickSight 的 IAM 身分識別政策：命名空間

下列範例顯示允許 QuickSight 管理員建立或刪除命名空間的 IAM 政策。

正在建立命名空間

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "ds:DescribeDirectories",
                "quicksight:CreateNamespace"
            ],
            "Resource": "*"
        }
    ]
}

刪除命名空間

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:UnauthorizeApplication",
                "ds:DeleteDirectory",
                "ds:DescribeDirectories",
                "quicksight:DeleteNamespace"
            ],
            "Resource": "*"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：自訂許可

下列範例顯示允許管理 QuickSight 員或開發人員管理自訂權限的 IAM 政策。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:*CustomPermissions"
            ],
            "Resource": "*"
        }
    ]
}

下列範例顯示授予與上一範例中所示相同許可的另一種方法。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:CreateCustomPermissions",
                "quicksight:DescribeCustomPermissions",
                "quicksight:ListCustomPermissions",
                "quicksight:UpdateCustomPermissions",
                "quicksight:DeleteCustomPermissions"
 
            ],
            "Resource": "*"
        }
    ]
}

Amazon 的 IAM 身分型政策 QuickSight：自訂電子郵件報告範本

下列範例顯示的政策允許在中檢視、更新和建立電子郵件報告範本 QuickSight，以及取得 Amazon 簡易電子郵件服務身分的驗證屬性。此原則可讓 QuickSight 系統管理員建立和更新自訂電子郵件報告範本，並確認他們想要傳送電子郵件報告的任何自訂電子郵件地址都是 SES 中已驗證的身分。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight: DescribeAccountCustomization",
                "quicksight: CreateAccountCustomization",
                "quicksight: UpdateAccountCustomization",
                "quicksight: DescribeEmailCustomizationTemplate",
                "quicksight: CreateEmailCustomizationTemplate",
                "quicksight: UpdateEmailCustomizationTemplate",
                "ses: GetIdentityVerificationAttributes"
            ],
            "Resource": "*"
        }
    ]
}

Amazon 的基於 IAM 身份的政策 QuickSight：創建用戶

下列範例顯示僅允許建立 Amazon QuickSight 使用者的政策。如果是 quicksight:CreateReader、quicksight:CreateUser 和 quicksight:CreateAdmin，您能將許可限制在 "Resource": "arn:aws:quicksight::<YOUR_AWS_ACCOUNTID>:user/${aws:userid}"。對於本指南中敘述的所有其他許可，請使用 "Resource": "*"。您指定的資源會限制特定資源的許可範圍。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "quicksight:CreateUser"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:quicksight::<YOUR_AWS_ACCOUNTID>:user/${aws:userid}"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：建立和管理群組

下列範例顯示可讓 QuickSight 系統管理員和開發人員建立和管理群組的原則。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:ListGroups",
                "quicksight:CreateGroup",
                "quicksight:SearchGroups",
                "quicksight:ListGroupMemberships",
                "quicksight:CreateGroupMembership",
                "quicksight:DeleteGroupMembership",
                "quicksight:DescribeGroupMembership",
                "quicksight:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：標準版的所有存取權

以下 Amazon QuickSight 標準版範例顯示允許訂閱和建立作者和讀者的政策。此範例明確拒絕 Amazon QuickSight 取消訂閱的權限。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ds:AuthorizeApplication",
        "ds:UnauthorizeApplication",
        "ds:CheckAlias",
        "ds:CreateAlias",
        "ds:DescribeDirectories",
        "ds:DescribeTrusts",
        "ds:DeleteDirectory",
        "ds:CreateIdentityPoolDirectory",
        "iam:ListAccountAliases",
        "quicksight:CreateUser",
        "quicksight:DescribeAccountSubscription",
        "quicksight:Subscribe"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "quicksight:Unsubscribe",
      "Resource": "*"
    }
  ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：透過 IAM 身分中心 (專業角色) 存取企業版的所有存取權

Amazon QuickSight 企業版的下列範例顯示了一項政策 QuickSight，該政策允許使用 QuickSight 者在與 IAM 身分中心整合的 QuickSight 帳戶中訂閱、建立使用者和管理 Active Directory。

此政策還允許使用者訂閱 QuickSight 專業角色，以授與 QuickSight 生成 BI 功能中 Amazon Q 的存取權。如需 Amazon 中專業版角色的詳細資訊 QuickSight，請參閱開始使用生成式 BI。

此範例明確拒絕 Amazon QuickSight 取消訂閱的權限。

{
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "quicksight:*",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:GetPolicy",
                "iam:CreatePolicyVersion",
                "iam:DeletePolicyVersion",
                "iam:GetPolicyVersion",
                "iam:ListPolicyVersions",
                "iam:DeleteRole",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:ListRoles",
                "iam:CreatePolicy",
                "iam:ListEntitiesForPolicy",
                "iam:listPolicies",
                "iam:CreateServiceLinkedRole",
                "s3:ListAllMyBuckets",
                "athena:ListDataCatalogs",
                "athena:GetDataCatalog",
                "sso:DescribeApplication",
                "sso:DescribeInstance",
                "sso:CreateApplication",
                "sso:PutApplicationAuthenticationMethod",
                "sso:PutApplicationGrant",
                "sso:DeleteApplication",
                "sso:DescribeGroup",
                "sso:SearchGroups",
                "sso:GetProfile",
                "sso:CreateApplicationAssignment",
                "sso:DeleteApplicationAssignment",
                "sso:ListInstances",
                "sso:DescribeRegisteredRegions",
                "organizations:DescribeOrganization",
                "user-subscriptions:CreateClaim",
                "user-subscriptions:UpdateClaim"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：使用 IAM 身分中心的所有企業版存取權

Amazon QuickSight 企業版的下列範例顯示了一項政策，該政策允許在與 IAM 身分中心整合的 QuickSight 帳戶中訂閱、建立使用者和管理 Active Directory。

此原則不會授與在中建立 Pro 角色的權限 QuickSight。若要建立授與中專業角色訂閱權限的政策 QuickSight，請參閱適用於 Amazon 的 IAM 身分識別政策 QuickSight：透過 IAM 身分中心 (專業角色) 存取企業版的所有存取權。

此範例明確拒絕 Amazon QuickSight 取消訂閱的權限。

{
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "quicksight:*",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:GetPolicy",
                "iam:CreatePolicyVersion",
                "iam:DeletePolicyVersion",
                "iam:GetPolicyVersion",
                "iam:ListPolicyVersions",
                "iam:DeleteRole",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:ListRoles",
                "iam:CreatePolicy",
                "iam:ListEntitiesForPolicy",
                "iam:listPolicies",
                "s3:ListAllMyBuckets",
                "athena:ListDataCatalogs",
                "athena:GetDataCatalog",
                "sso:DescribeApplication",
                "sso:DescribeInstance",
                "sso:CreateApplication",
                "sso:PutApplicationAuthenticationMethod",
                "sso:PutApplicationGrant",
                "sso:DeleteApplication",
                "sso:DescribeGroup",
                "sso:SearchGroups",
                "sso:GetProfile",
                "sso:CreateApplicationAssignment",
                "sso:DeleteApplicationAssignment",
                "sso:ListInstances",
                "sso:DescribeRegisteredRegions",
                "organizations:DescribeOrganization" 
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

Amazon 的 IAM 基於身份的政策 QuickSight：使用活動目錄的企業版的所有訪問

Amazon QuickSight 企業版的下列範例顯示一項政策，該政策允許在使用 Active Directory 進行身分管理的 QuickSight 帳戶中訂閱、建立使用者和管理 Active Directory。此範例明確拒絕 Amazon QuickSight 取消訂閱的權限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:CheckAlias",
                "ds:CreateAlias",
                "ds:DescribeDirectories",
                "ds:DescribeTrusts",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "iam:ListAccountAliases",
                "quicksight:CreateAdmin",
                "quicksight:Subscribe",
                "quicksight:GetGroupMapping",
                "quicksight:SearchDirectoryGroups",
                "quicksight:SetGroupMapping"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "quicksight:Unsubscribe",
            "Resource": "*"
        }
    ]
}

適用於 Amazon 的 IAM 身分識別政策 QuickSight：作用中目錄群組

下列範例顯示允許針對 Amazon QuickSight 企業版帳戶進行作用中目錄群組管理的 IAM 政策。

{
    "Statement": [
        {
            "Action": [
                "ds:DescribeTrusts",
                "quicksight:GetGroupMapping",
                "quicksight:SearchDirectoryGroups",
                "quicksight:SetGroupMapping"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

Amazon 的 IAM 身分型政策 QuickSight：使用管理資產管理主控台

下列範例所顯示的 IAM 政策允許存取管理員資產管理主控台。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [          
                "quicksight:SearchGroups",
                "quicksight:SearchUsers",              
                "quicksight:ListNamespaces",            
                "quicksight:DescribeAnalysisPermissions",
                "quicksight:DescribeDashboardPermissions",
                "quicksight:DescribeDataSetPermissions",
                "quicksight:DescribeDataSourcePermissions",
                "quicksight:DescribeFolderPermissions",
                "quicksight:ListAnalyses",
                "quicksight:ListDashboards",
                "quicksight:ListDataSets",
                "quicksight:ListDataSources",
                "quicksight:ListFolders",
                "quicksight:SearchAnalyses",
                "quicksight:SearchDashboards",
                "quicksight:SearchFolders",
                "quicksight:SearchDatasets",
                "quicksight:SearchDatasources",               
                "quicksight:UpdateAnalysisPermissions",
                "quicksight:UpdateDashboardPermissions",
                "quicksight:UpdateDataSetPermissions",
                "quicksight:UpdateDataSourcePermissions",
                "quicksight:UpdateFolderPermissions"
            ],
            "Resource": "*"
        }
    ]
}

Amazon 的 IAM 身分型政策 QuickSight：使用管理金鑰管理主控台

下列範例所顯示的 IAM 政策允許存取管理員金鑰管理主控台。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "quicksight:DescribeKeyRegistration",
            "quicksight:UpdateKeyRegistration",
            "quicksight:ListKMSKeysForUser",
            "kms:CreateGrant",
            "kms:ListGrants",
            "kms:ListAliases"
         ],
         "Resource":"*"
      }
   ]
}

需要"quicksight:ListKMSKeysForUser"和"kms:ListAliases"權限才能從 QuickSight 主控台存取客戶受管金鑰。 "quicksight:ListKMSKeysForUser"而"kms:ListAliases"且不需要使用 QuickSight 金鑰管理 API。

若要指定您希望使用者能夠存取的金鑰，請新增您希望使用者使用條件索引鍵存取UpdateKeyRegistration條件的quicksight:KmsKeyArns金鑰 ARN。使用者只能存取中指定的金鑰UpdateKeyRegistration。如需有關的支援條件金鑰的詳細資訊 QuickSight，請參閱 Amazon 的條件金鑰 QuickSight。

以下範例會授Describe予註冊至帳戶的所有 CMK 的Update權限，並授予註冊至該 QuickSight 帳戶的特定 CMK 的權限。 QuickSight 

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "quicksight:DescribeKeyRegistration"
         ],
         "Resource":"arn:aws:quicksight:us-west-2:123456789012:*"
      },
      {
         "Effect":"Allow",
         "Action":[
            "quicksight:UpdateKeyRegistration"
         ],
         "Resource":"arn:aws:quicksight:us-west-2:123456789012:*",
         "Condition":{
            "ForAllValues:StringEquals":{
               "quicksight:KmsKeyArns":[
                  "arn:aws:kms:us-west-2:123456789012:key/key-id-of-key1",
                  "arn:aws:kms:us-west-2:123456789012:key/key-id-of-key2",
                  "..."
               ]
            }
         }
      },
      {
         "Effect":"Allow",
         "Action":[
            "kms:CreateGrant",
            "kms:ListGrants"
         ],
         "Resource":"arn:aws:kms:us-west-2:123456789012:key/*"
      }
   ]
}

AWS Amazon 資源 QuickSight：企業版中的範圍政策

以下 Amazon QuickSight 企業版範例顯示了一項政策，該政策允許設定對資源的預設存取權限，以及為 AWS 資源的許可設定政策的範圍。 AWS 

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "quicksight:*IAMPolicyAssignment*",
                "quicksight:AccountConfigurations"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}