翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。 # AmazonDataZoneFullAccess **説明**: 経由で Amazon DataZone へのフルアクセス AWS マネジメントコンソール と、それに必要な関連サービスへの制限付きアクセスを提供します。 `AmazonDataZoneFullAccess` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。 ## このポリシーを使用すると ユーザー、グループおよびロールに `AmazonDataZoneFullAccess` をアタッチできます。 ## ポリシーの詳細 + **タイプ**: AWS 管理ポリシー + **作成日時**: 2023 年 9 月 22 日 20:06 UTC + **編集日時:** 2026 年 2 月 12 日 17:59 UTC + **ARN**: `arn:aws:iam::aws:policy/AmazonDataZoneFullAccess` ## ポリシーのバージョン **ポリシーのバージョン:** v13 (デフォルト) ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。 ## JSON ポリシードキュメント ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AmazonDataZoneStatement", "Effect" : "Allow", "Action" : [ "datazone:*" ], "Resource" : [ "*" ] }, { "Sid" : "ReadOnlyStatement", "Effect" : "Allow", "Action" : [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets", "iam:ListUsers", "glue:GetDatabases", "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codewhisperer:ListProfiles", "bedrock:ListInferenceProfiles", "bedrock:ListFoundationModels", "bedrock:ListTagsForResource", "aoss:ListSecurityPolicies" ], "Resource" : [ "*" ] }, { "Sid" : "BucketReadOnlyStatement", "Effect" : "Allow", "Action" : [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource" : "arn:aws:s3:::*" }, { "Sid" : "CreateBucketStatement", "Effect" : "Allow", "Action" : [ "s3:CreateBucket" ], "Resource" : [ "arn:aws:s3:::amazon-datazone*", "arn:aws:s3:::amazon-sagemaker*" ] }, { "Sid" : "ConfigureBucketStatement", "Effect" : "Allow", "Action" : [ "s3:PutBucketCORS", "s3:PutBucketPolicy", "s3:PutBucketVersioning" ], "Resource" : [ "arn:aws:s3:::amazon-sagemaker*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "RamCreateResourceStatement", "Effect" : "Allow", "Action" : [ "ram:CreateResourceShare" ], "Resource" : "*", "Condition" : { "StringEqualsIfExists" : { "ram:RequestedResourceType" : "datazone:Domain" } } }, { "Sid" : "RamResourceStatement", "Effect" : "Allow", "Action" : [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource" : "*", "Condition" : { "StringLike" : { "ram:ResourceShareName" : [ "DataZone*" ] } } }, { "Sid" : "RamResourceReadOnlyStatement", "Effect" : "Allow", "Action" : [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations", "ram:ListResourceSharePermissions" ], "Resource" : "*" }, { "Sid" : "RamAssociateResourceSharePermissionStatement", "Effect" : "Allow", "Action" : "ram:AssociateResourceSharePermission", "Resource" : "*", "Condition" : { "StringEquals" : { "ram:PermissionArn" : [ "arn:aws:ram::aws:permission/AWSRAMDefaultPermissionAmazonDataZoneDomain", "arn:aws:ram::aws:permission/AWSRAMPermissionAmazonDataZoneDomainFullAccessWithPortalAccess", "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceAccess", "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceWithPortalAccess" ] } } }, { "Sid" : "IAMPassRoleStatement", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonSageMaker*" ], "Condition" : { "StringEquals" : { "iam:passedToService" : "datazone.amazonaws.com" } } }, { "Sid" : "IAMGetPolicyStatement", "Effect" : "Allow", "Action" : "iam:GetPolicy", "Resource" : [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*" ] }, { "Sid" : "DataZoneTagOnCreateDomainProjectTags", "Effect" : "Allow", "Action" : [ "secretsmanager:TagResource" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] }, "StringLike" : { "aws:RequestTag/AmazonDataZoneDomain" : "dzd*", "aws:ResourceTag/AmazonDataZoneDomain" : "dzd*" } } }, { "Sid" : "DataZoneTagOnCreate", "Effect" : "Allow", "Action" : [ "secretsmanager:TagResource" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "AmazonDataZoneDomain" ] }, "StringLike" : { "aws:RequestTag/AmazonDataZoneDomain" : "dzd*", "aws:ResourceTag/AmazonDataZoneDomain" : "dzd*" } } }, { "Sid" : "CreateSecretStatement", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition" : { "StringLike" : { "aws:RequestTag/AmazonDataZoneDomain" : "dzd*" } } }, { "Sid" : "ConnectionStatement", "Effect" : "Allow", "Action" : [ "codeconnections:GetConnection" ], "Resource" : [ "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid" : "TagCodeConnectionsStatement", "Effect" : "Allow", "Action" : [ "codeconnections:TagResource" ], "Resource" : [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "for-use-with-all-datazone-projects" ] }, "StringEquals" : { "aws:RequestTag/for-use-with-all-datazone-projects" : "true" } } }, { "Sid" : "UntagCodeConnectionsStatement", "Effect" : "Allow", "Action" : [ "codeconnections:UntagResource" ], "Resource" : [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : "for-use-with-all-datazone-projects" } } }, { "Sid" : "SSMParameterStatement", "Effect" : "Allow", "Action" : [ "ssm:GetParameter", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource" : [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI*", "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*" ] }, { "Sid" : "UseKMSKeyPermissionsStatement", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/EnableKeyForAmazonDataZone" : "true" }, "Null" : { "aws:ResourceTag/EnableKeyForAmazonDataZone" : "false" }, "StringLike" : { "kms:ViaService" : "ssm.*.amazonaws.com" } } }, { "Sid" : "SecurityPolicyStatement", "Effect" : "Allow", "Action" : [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy" ], "Resource" : [ "*" ], "Condition" : { "StringLike" : { "aoss:collection" : "genai-studio-*" } } }, { "Sid" : "GetFoundationModelStatement", "Effect" : "Allow", "Action" : [ "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability" ], "Resource" : [ "arn:aws:bedrock:*::foundation-model/*" ] }, { "Sid" : "GetInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:GetInferenceProfile" ], "Resource" : [ "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] }, { "Sid" : "ApplicationInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:CreateInferenceProfile" ], "Resource" : [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition" : { "Null" : { "aws:RequestTag/AmazonDataZoneProject" : "true", "aws:RequestTag/AmazonDataZoneDomain" : "false" } } }, { "Sid" : "TagApplicationInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:TagResource" ], "Resource" : [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition" : { "Null" : { "aws:ResourceTag/AmazonDataZoneProject" : "true", "aws:RequestTag/AmazonDataZoneProject" : "true", "aws:ResourceTag/AmazonDataZoneDomain" : "false", "aws:RequestTag/AmazonDataZoneDomain" : "false" } } }, { "Sid" : "DeleteApplicationInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:DeleteInferenceProfile" ], "Resource" : [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition" : { "Null" : { "aws:ResourceTag/AmazonDataZoneProject" : "true", "aws:ResourceTag/AmazonDataZoneDomain" : "false" } } } ] } ``` ## 詳細情報 + [IAM Identity Center で AWS マネージドポリシーを使用してアクセス許可セットを作成する](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [IAM ID のアクセス許可の追加および削除](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [AWS 管理ポリシーを開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)