Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés. # AmazonDataZoneProjectRolePermissionsBoundary **Descripción**: Amazon DataZone crea funciones de IAM para que los proyectos realicen acciones de análisis de datos y utiliza esta política al crear estas funciones para definir el límite de sus permisos. `AmazonDataZoneProjectRolePermissionsBoundary` es una [política administrada de AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies). ## Uso de la política Puede asociar `AmazonDataZoneProjectRolePermissionsBoundary` a los usuarios, grupos y roles. ## Información de la política + **Tipo**: política AWS gestionada + **Hora de creación**: 21 de marzo de 2023 a las 2:51 UTC + **Hora de edición:** 21 de marzo de 2023 a las 2:51 UTC + **ARN**: `arn:aws:iam::aws:policy/AmazonDataZoneProjectRolePermissionsBoundary` ## Versión de la política **Versión de la política:** v1 (predeterminada) La versión predeterminada de la política define qué permisos tendrá. Cuando un usuario o un rol con la política solicita el acceso a un AWS recurso, AWS comprueba la versión predeterminada de la política para determinar si permite la solicitud. ## Documento de política JSON ``` { "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Action" : [ "s3:List*", "s3:Get*", "s3:DeleteObjectVersion", "s3:RestoreObject", "s3:ReplicateObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutObjectRetention", "s3:DeleteObject" ], "Resource" : "arn:aws:s3:::datazone*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Allow", "Action" : [ "s3:List*", "s3:Get*", "kms:List*", "kms:Get*", "kms:Describe*", "kms:Decrypt" ], "Resource" : "*", "Condition" : { "StringNotEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Allow", "Action" : [ "ec2:Describe*", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "logs:*", "athena:TerminateSession", "athena:CreatePreparedStatement", "athena:StopCalculationExecution", "athena:StartQueryExecution", "athena:UpdatePreparedStatement", "athena:BatchGet*", "athena:List*", "athena:UpdateNotebook", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:UpdateNotebookMetadata", "athena:DeleteNamedQuery", "athena:Get*", "athena:UpdateNamedQuery", "athena:CreateNamedQuery", "athena:ExportNotebook", "athena:StopQueryExecution", "athena:StartCalculationExecution", "athena:StartSession", "athena:CreatePresignedNotebookUrl", "athena:CreateNotebook", "athena:ImportNotebook", "organizations:DescribeOrganization", "organizations:DescribeAccount", "lakeformation:GetDataAccess", "lakeformation:BatchGrantPermissions", "lakeformation:GrantPermissions", "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:BatchRevokePermissions", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "ram:CreateResourceShare", "ram:UpdateResourceShare", "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:AcceptResourceShareInvitation", "ram:Get*", "ram:List*", "redshift:DescribeClusters", "redshift:JoinGroup", "redshift:CreateClusterUser", "redshift:GetClusterCredentials", "redshift-data:*", "redshift:AuthorizeDataShare", "redshift:DescribeDataShares", "redshift:AssociateDataShareConsumer", "tag:GetResources", "iam:ListRoles", "iam:ListUsers", "iam:ListGroups", "iam:ListRolePolicies", "iam:GetRole", "iam:GetRolePolicy", "glue:CreateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:CreatePartitionIndex", "glue:CreateDataQualityRuleset", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:CreateWorkflow", "sqlworkbench:*", "datazone:*" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "ec2:CreateTags", "ec2:DeleteTags" ], "Resource" : [ "arn:aws:ec2:*:*:network-interface/*" ], "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "aws-glue-service-resource" ] } } }, { "Effect" : "Allow", "Action" : [ "kms:List*", "kms:Get*", "kms:Describe*", "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:Verify", "kms:Sign", "kms:GenerateDataKey", "glue:*" ], "Resource" : "*", "Condition" : { "Null" : { "aws:ResourceTag/datazone:projectId" : "false" } } }, { "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/datazone*" ] }, { "Effect" : "Allow", "Action" : [ "glue:BatchGet*", "glue:SearchTables", "glue:List*", "glue:Get*", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:PutResourcePolicy", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:UpdatePartition", "glue:NotifyEvent", "glue:DeleteResourcePolicy" ], "Resource" : "*" }, { "Effect" : "Deny", "NotAction" : [ "s3:List*", "s3:Get*", "s3:Describe*", "s3:DeleteObjectVersion", "s3:RestoreObject", "s3:ReplicateObject", "s3:PutObject", "s3:AbortMultipartUpload", "s3:CreateBucket", "s3:PutBucketPublicAccessBlock", "s3:PutObjectRetention", "s3:DeleteObject", "kms:List*", "kms:Get*", "kms:Describe*", "kms:Decrypt", "kms:Encrypt", "kms:ReEncrypt*", "kms:Verify", "kms:Sign", "kms:GenerateDataKey", "ec2:Describe*", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:CreateTags", "ec2:DeleteTags", "logs:*", "athena:*", "glue:BatchGet*", "glue:Get*", "glue:SearchTables", "glue:List*", "glue:CreateDatabase", "glue:UpdateDatabase", "glue:CreateTable", "glue:DeleteTable", "glue:BatchDeleteTable", "glue:UpdateTable", "glue:BatchCreatePartition", "glue:CreatePartition", "glue:DeletePartition", "glue:BatchDeletePartition", "glue:PutResourcePolicy", "glue:CreatePartitionIndex", "glue:BatchUpdatePartition", "glue:DeleteTableVersion", "glue:DeleteColumnStatisticsForPartition", "glue:DeleteColumnStatisticsForTable", "glue:DeletePartitionIndex", "glue:UpdateColumnStatisticsForPartition", "glue:UpdateColumnStatisticsForTable", "glue:BatchDeleteTableVersion", "glue:UpdatePartition", "glue:NotifyEvent", "glue:StartBlueprintRun", "glue:PutWorkflowRunProperties", "glue:StopCrawler", "glue:DeleteJob", "glue:DeleteWorkflow", "glue:UpdateCrawler", "glue:DeleteBlueprint", "glue:UpdateWorkflow", "glue:StartCrawler", "glue:ResetJobBookmark", "glue:UpdateJob", "glue:StartWorkflowRun", "glue:StopCrawlerSchedule", "glue:ResumeWorkflowRun", "glue:DeleteCrawler", "glue:UpdateBlueprint", "glue:BatchStopJobRun", "glue:StopWorkflowRun", "glue:UpdateCrawlerSchedule", "glue:DeleteConnection", "glue:UpdateConnection", "glue:BatchDeleteConnection", "glue:StartCrawlerSchedule", "glue:StartJobRun", "glue:CreateWorkflow", "glue:*DataQuality*", "glue:CreateBlueprint", "glue:CreateJob", "glue:CreateConnection", "glue:CreateCrawler", "glue:DeleteResourcePolicy", "organizations:DescribeOrganization", "organizations:DescribeAccount", "lakeformation:GetDataAccess", "lakeformation:BatchGrantPermissions", "lakeformation:GrantPermissions", "lakeformation:GetDataLakeSettings", "lakeformation:PutDataLakeSettings", "lakeformation:BatchRevokePermissions", "lakeformation:GetResourceLFTags", "lakeformation:ListPermissions", "ram:*", "redshift:*", "redshift-data:*", "tag:GetResources", "iam:List*", "iam:GetRole", "iam:GetRolePolicy", "iam:PassRole", "sqlworkbench:*", "datazone:*" ], "Resource" : [ "*" ] } ] } ``` ## Más información + [Cree un conjunto de permisos mediante políticas AWS administradas en el Centro de identidades de IAM](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [Adición y eliminación de permisos de identidad de IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [Conozca el control de versiones de las políticas de IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [Comience con las políticas AWS administradas y avance hacia los permisos con privilegios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)