翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
# SageMakerStudioDomainExecutionRolePolicy
**説明**: このポリシーは、Amazon SageMaker Studio による Amazon SageMaker ドメイン内のデータのカタログ化、検出、管理、共有、分析に使用されます。
`SageMakerStudioDomainExecutionRolePolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。
## このポリシーを使用すると
ユーザー、グループおよびロールに `SageMakerStudioDomainExecutionRolePolicy` をアタッチできます。
## ポリシーの詳細
+ **タイプ**: サービスロールポリシー
+ **作成日時**: 2024 年 11 月 20 日 21:56 UTC
+ **編集日時:** 2026 年 2 月 26 日 00:42 UTC
+ **ARN**: `arn:aws:iam::aws:policy/service-role/SageMakerStudioDomainExecutionRolePolicy`
## ポリシーのバージョン
**ポリシーのバージョン:** v20 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。
## JSON ポリシードキュメント
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "DataZonePermissions",
"Effect" : "Allow",
"Action" : [
"datazone:AcceptPredictions",
"datazone:AcceptSubscriptionRequest",
"datazone:AddEntityOwner",
"datazone:AddPolicyGrant",
"datazone:AssociateGovernedTerms",
"datazone:BatchGetAttributesMetadata",
"datazone:BatchPutAttributesMetadata",
"datazone:CancelMetadataGenerationRun",
"datazone:CancelSubscription",
"datazone:CreateAsset",
"datazone:CreateAssetFilter",
"datazone:CreateAssetRevision",
"datazone:CreateAssetType",
"datazone:CreateConnection",
"datazone:CreateDataProduct",
"datazone:CreateDataProductRevision",
"datazone:CreateDataSource",
"datazone:CreateDomainUnit",
"datazone:CreateEnvironment",
"datazone:CreateEnvironmentProfile",
"datazone:CreateFormType",
"datazone:CreateGlossary",
"datazone:CreateGlossaryTerm",
"datazone:CreateListingChangeSet",
"datazone:CreateProject",
"datazone:CreateProjectMembership",
"datazone:CreateRule",
"datazone:CreateSubscriptionGrant",
"datazone:CreateSubscriptionRequest",
"datazone:DeleteAsset",
"datazone:DeleteAssetFilter",
"datazone:DeleteAssetType",
"datazone:DeleteConnection",
"datazone:DeleteDataProduct",
"datazone:DeleteDataSource",
"datazone:DeleteDomainUnit",
"datazone:DeleteEnvironment",
"datazone:DeleteEnvironmentProfile",
"datazone:DeleteFormType",
"datazone:DeleteGlossary",
"datazone:DeleteGlossaryTerm",
"datazone:DeleteListing",
"datazone:DeleteProject",
"datazone:DeleteProjectMembership",
"datazone:DeleteRule",
"datazone:DeleteSubscriptionGrant",
"datazone:DeleteSubscriptionRequest",
"datazone:DeleteSubscriptionTarget",
"datazone:DeleteTimeSeriesDataPoints",
"datazone:DisassociateGovernedTerms",
"datazone:GetAsset",
"datazone:GetAssetFilter",
"datazone:GetAssetType",
"datazone:GetConnection",
"datazone:GetDataProduct",
"datazone:GetDataSource",
"datazone:GetDataSourceRun",
"datazone:GetDomain",
"datazone:GetDomainUnit",
"datazone:GetEnvironment",
"datazone:GetEnvironmentAction",
"datazone:GetEnvironmentActionLink",
"datazone:GetEnvironmentBlueprint",
"datazone:GetEnvironmentBlueprintConfiguration",
"datazone:GetEnvironmentCredentials",
"datazone:GetEnvironmentProfile",
"datazone:GetFormType",
"datazone:GetGlossary",
"datazone:GetGlossaryTerm",
"datazone:GetGroupProfile",
"datazone:GetLineageNode",
"datazone:GetListing",
"datazone:GetMetadataGenerationRun",
"datazone:GetProject",
"datazone:GetRule",
"datazone:GetSubscription",
"datazone:GetSubscriptionEligibility",
"datazone:GetSubscriptionGrant",
"datazone:GetSubscriptionRequestDetails",
"datazone:GetSubscriptionTarget",
"datazone:GetTimeSeriesDataPoint",
"datazone:GetUpdateEligibility",
"datazone:GetUserProfile",
"datazone:ListAccountEnvironments",
"datazone:ListAssetFilters",
"datazone:ListAssetRevisions",
"datazone:ListConnections",
"datazone:ListDataProductRevisions",
"datazone:ListDataSourceRunActivities",
"datazone:ListDataSourceRuns",
"datazone:ListDataSources",
"datazone:ListDomainUnitsForParent",
"datazone:ListEntityOwners",
"datazone:ListEnvironmentActions",
"datazone:ListEnvironmentBlueprintConfigurationSummaries",
"datazone:ListEnvironmentBlueprintConfigurations",
"datazone:ListEnvironmentBlueprints",
"datazone:ListEnvironmentProfiles",
"datazone:ListEnvironments",
"datazone:ListGroupsForUser",
"datazone:ListLineageNodeHistory",
"datazone:ListMetadataGenerationRuns",
"datazone:ListNotifications",
"datazone:ListPolicyGrants",
"datazone:ListProjectMemberships",
"datazone:ListProjects",
"datazone:ListRules",
"datazone:ListSubscriptionGrants",
"datazone:ListSubscriptionRequests",
"datazone:ListSubscriptionTargets",
"datazone:ListSubscriptions",
"datazone:ListTimeSeriesDataPoints",
"datazone:ListWarehouseMetadata",
"datazone:QueryGraph",
"datazone:RejectPredictions",
"datazone:RejectSubscriptionRequest",
"datazone:RemoveEntityOwner",
"datazone:RemovePolicyGrant",
"datazone:RevokeSubscription",
"datazone:Search",
"datazone:SearchGroupProfiles",
"datazone:SearchListings",
"datazone:SearchRules",
"datazone:SearchTypes",
"datazone:SearchUserProfiles",
"datazone:StartDataSourceRun",
"datazone:StartMetadataGenerationRun",
"datazone:UpdateAssetFilter",
"datazone:UpdateConnection",
"datazone:UpdateDataSource",
"datazone:UpdateDomainUnit",
"datazone:UpdateEnvironment",
"datazone:UpdateEnvironmentDeploymentStatus",
"datazone:UpdateEnvironmentProfile",
"datazone:UpdateGlossary",
"datazone:UpdateGlossaryTerm",
"datazone:UpdateProject",
"datazone:UpdateRule",
"datazone:UpdateSubscriptionGrantStatus",
"datazone:UpdateSubscriptionRequest"
],
"Resource" : "*"
},
{
"Sid" : "RAMResourceShareStatement",
"Effect" : "Allow",
"Action" : [
"ram:GetResourceShareAssociations",
"ram:GetResourceShares"
],
"Resource" : "*"
},
{
"Sid" : "AmazonQPermissionsStatement",
"Effect" : "Allow",
"Action" : [
"q:StartConversation",
"q:SendMessage",
"q:ListConversations",
"q:GetConversation",
"q:PassRequest",
"q:GetIdentityMetadata",
"glue:StartCompletion",
"glue:GetCompletion"
],
"Resource" : "*"
},
{
"Sid" : "AllowSetTrustedIdentity",
"Effect" : "Allow",
"Action" : [
"sts:SetContext"
],
"Resource" : "arn:aws:sts::*:self"
},
{
"Sid" : "SSMGetParameterStatement",
"Effect" : "Allow",
"Action" : [
"ssm:GetParameter"
],
"Resource" : [
"arn:aws:ssm:*:*:parameter/amazon/datazone/q/${aws:PrincipalTag/datazone-domainId}*",
"arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/${aws:PrincipalTag/datazone-domainId}/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "GetCodeConnectionsPermissionsStatement",
"Effect" : "Allow",
"Action" : [
"codeconnections:GetConnection",
"codeconnections:GetHost",
"codestar-connections:GetConnection",
"codestar-connections:GetHost"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/for-use-with-all-datazone-projects" : "false"
},
"StringEquals" : {
"aws:ResourceTag/for-use-with-all-datazone-projects" : "true"
}
}
},
{
"Sid" : "ListCodeConnectionsPermissionsStatement",
"Effect" : "Allow",
"Action" : [
"codeconnections:ListConnections",
"codeconnections:ListTagsForResource",
"codestar-connections:ListConnections",
"codestar-connections:ListTagsForResource"
],
"Resource" : "*"
},
{
"Sid" : "UseCodeConnectionsPermissionsStatement",
"Effect" : "Allow",
"Action" : [
"codeconnections:UseConnection",
"codestar-connections:UseConnection"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/for-use-with-all-datazone-projects" : "false"
},
"StringEquals" : {
"aws:ResourceTag/for-use-with-all-datazone-projects" : "true"
}
}
},
{
"Sid" : "ProjectProfilePermissionsStatement",
"Effect" : "Allow",
"Action" : [
"datazone:GetProjectProfile",
"datazone:ListProjectProfiles"
],
"Resource" : "arn:aws:datazone:*:*:domain/*"
},
{
"Sid" : "AccountPoolPermissionsStatement",
"Effect" : "Allow",
"Action" : [
"datazone:GetAccountPool",
"datazone:ListAccountPools",
"datazone:ListAccountsInAccountPool"
],
"Resource" : "arn:aws:datazone:*:*:domain/*"
}
]
}
```
## 詳細情報
+ [IAM Identity Center で AWS マネージドポリシーを使用してアクセス許可セットを作成する](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [IAM ID のアクセス許可の追加および削除](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [AWS 管理ポリシーを開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)