AmazonDataZoneGlueManageAccessRolePolicy - AWS Policy gestita

Le traduzioni sono generate tramite traduzione automatica. In caso di conflitto tra il contenuto di una traduzione e la versione originale in Inglese, quest'ultima prevarrà.

AmazonDataZoneGlueManageAccessRolePolicy

Descrizione: la politica concede le autorizzazioni per consentire ad Amazon di DataZone abilitare la pubblicazione e le concessioni di accesso ai dati.

AmazonDataZoneGlueManageAccessRolePolicyè una politica gestita AWS .

Utilizzo di questa politica

Puoi collegarti AmazonDataZoneGlueManageAccessRolePolicy ai tuoi utenti, gruppi e ruoli.

Dettagli della politica

  • Tipo: politica del ruolo di servizio

  • Ora di creazione: 22 settembre 2023, 20:21 UTC

  • Ora modificata: 8 aprile 2025, 21:22 UTC

  • ARN: arn:aws:iam::aws:policy/service-role/AmazonDataZoneGlueManageAccessRolePolicy

Versione della politica

Versione della politica: v9 (default) (predefinito)

La versione predefinita della politica è la versione che definisce le autorizzazioni per la politica. Quando un utente o un ruolo con la politica effettua una richiesta di accesso a una AWS risorsa, AWS controlla la versione predefinita della politica per determinare se consentire la richiesta.

Documento di policy JSON

{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "GlueTagDatabase", "Effect" : "Allow", "Action" : [ "glue:TagResource", "glue:UntagResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAnyValue:StringLikeIfExists" : { "aws:TagKeys" : "DataZoneDiscoverable_*" } } }, { "Sid" : "GlueDataQuality", "Effect" : "Allow", "Action" : [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource" : "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueCrawler", "Effect" : "Allow", "Action" : "glue:ListCrawls", "Resource" : "arn:aws:glue:*:*:crawler/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueTableDatabaseCatalog", "Effect" : "Allow", "Action" : [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables", "glue:SearchTables", "glue:CreateCatalog", "glue:CreateDatabase", "glue:DeleteCatalog", "glue:DeleteDatabase" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueGetTags", "Effect" : "Allow", "Action" : [ "glue:GetTags", "glue:GetCatalog" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "LakeformationResourceSharing", "Effect" : "Allow", "Action" : [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateDataCellsFilter", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteDataCellsFilter", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetDataCellsFilter", "lakeformation:GetResourceLFTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:UpdateDataCellsFilter", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource" : "*" }, { "Sid" : "LakeformationResourceFederatedSharing", "Effect" : "Allow", "Action" : [ "lakeformation:GetDataAccess" ], "Resource" : "*", "Condition" : { "Null" : { "lakeformation:GlueARN" : "true" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceSharing", "Effect" : "Allow", "Action" : [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "ram.amazonaws.com" ] } } }, { "Sid" : "CrossAccountLakeFormationResourceSharing", "Effect" : "Allow", "Action" : [ "ram:CreateResourceShare" ], "Resource" : "*", "Condition" : { "StringEqualsIfExists" : { "ram:RequestedResourceType" : [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceShareInvitation", "Effect" : "Allow", "Action" : [ "ram:AcceptResourceShareInvitation" ], "Resource" : "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid" : "CrossAccountRAMResourceSharingViaLakeFormation", "Effect" : "Allow", "Action" : [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource" : "*", "Condition" : { "StringLike" : { "ram:ResourceShareName" : [ "LakeFormation*" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "GetResourceSharesViaLakeFormation", "Effect" : "Allow", "Action" : "ram:GetResourceShares", "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect" : "Allow", "Action" : "ram:AssociateResourceSharePermission", "Resource" : "*", "Condition" : { "ArnLike" : { "ram:PermissionArn" : "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "KMSDecrypt", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/datazone:projectId" : "proj-all" } } }, { "Sid" : "GetRoleForDataZone", "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*" ] }, { "Sid" : "PassRoleForDataLocationRegistration", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/datazone_usr_role*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "lakeformation.amazonaws.com", "glue.amazonaws.com" ] } } }, { "Sid" : "CreateCatalogEC2", "Effect" : "Allow", "Action" : [ "ec2:DescribeAccountAttributes", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeAvailabilityZones" ], "Resource" : "*" }, { "Sid" : "CreateCatalogS3", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource" : "arn:aws:s3:::redshift-staging-bucket*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] }

Ulteriori informazioni