As traduções são geradas por tradução automática. Em caso de conflito entre o conteúdo da tradução e da versão original em inglês, a versão em inglês prevalecerá. # AmazonDataZoneFullAccess **Descrição**: Fornece acesso total à Amazon DataZone por meio do Console de gerenciamento da AWS acesso limitado e aos serviços relacionados que são exigidos por ela. `AmazonDataZoneFullAccess` é uma [política gerenciada pelo AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies). ## Utilização desta política Você pode vincular a `AmazonDataZoneFullAccess` aos seus usuários, grupos e perfis. ## Detalhes desta política + **Tipo**: política AWS gerenciada + **Hora da criação**: 22 de setembro de 2023, 20:06 UTC + **Horário editado:** 12 de fevereiro de 2026, 17:59 UTC + **ARN**: `arn:aws:iam::aws:policy/AmazonDataZoneFullAccess` ## Versão da política **Versão da política:** v13 (padrão) A versão padrão da política é aquela que define as permissões desta política. Quando um usuário ou função da política faz uma solicitação para acessar um AWS recurso, AWS verifica a versão padrão da política para determinar se a solicitação deve ser permitida. ## Documento da política JSON ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AmazonDataZoneStatement", "Effect" : "Allow", "Action" : [ "datazone:*" ], "Resource" : [ "*" ] }, { "Sid" : "ReadOnlyStatement", "Effect" : "Allow", "Action" : [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "sso:DescribeRegisteredRegions", "s3:ListAllMyBuckets", "redshift:DescribeClusters", "redshift-serverless:ListWorkgroups", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "secretsmanager:ListSecrets", "iam:ListUsers", "glue:GetDatabases", "codeconnections:ListConnections", "codeconnections:ListTagsForResource", "codewhisperer:ListProfiles", "bedrock:ListInferenceProfiles", "bedrock:ListFoundationModels", "bedrock:ListTagsForResource", "aoss:ListSecurityPolicies" ], "Resource" : [ "*" ] }, { "Sid" : "BucketReadOnlyStatement", "Effect" : "Allow", "Action" : [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource" : "arn:aws:s3:::*" }, { "Sid" : "CreateBucketStatement", "Effect" : "Allow", "Action" : [ "s3:CreateBucket" ], "Resource" : [ "arn:aws:s3:::amazon-datazone*", "arn:aws:s3:::amazon-sagemaker*" ] }, { "Sid" : "ConfigureBucketStatement", "Effect" : "Allow", "Action" : [ "s3:PutBucketCORS", "s3:PutBucketPolicy", "s3:PutBucketVersioning" ], "Resource" : [ "arn:aws:s3:::amazon-sagemaker*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "RamCreateResourceStatement", "Effect" : "Allow", "Action" : [ "ram:CreateResourceShare" ], "Resource" : "*", "Condition" : { "StringEqualsIfExists" : { "ram:RequestedResourceType" : "datazone:Domain" } } }, { "Sid" : "RamResourceStatement", "Effect" : "Allow", "Action" : [ "ram:DeleteResourceShare", "ram:AssociateResourceShare", "ram:DisassociateResourceShare", "ram:RejectResourceShareInvitation" ], "Resource" : "*", "Condition" : { "StringLike" : { "ram:ResourceShareName" : [ "DataZone*" ] } } }, { "Sid" : "RamResourceReadOnlyStatement", "Effect" : "Allow", "Action" : [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations", "ram:ListResourceSharePermissions" ], "Resource" : "*" }, { "Sid" : "RamAssociateResourceSharePermissionStatement", "Effect" : "Allow", "Action" : "ram:AssociateResourceSharePermission", "Resource" : "*", "Condition" : { "StringEquals" : { "ram:PermissionArn" : [ "arn:aws:ram::aws:permission/AWSRAMDefaultPermissionAmazonDataZoneDomain", "arn:aws:ram::aws:permission/AWSRAMPermissionAmazonDataZoneDomainFullAccessWithPortalAccess", "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceAccess", "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceWithPortalAccess" ] } } }, { "Sid" : "IAMPassRoleStatement", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonSageMaker*" ], "Condition" : { "StringEquals" : { "iam:passedToService" : "datazone.amazonaws.com" } } }, { "Sid" : "IAMGetPolicyStatement", "Effect" : "Allow", "Action" : "iam:GetPolicy", "Resource" : [ "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*" ] }, { "Sid" : "DataZoneTagOnCreateDomainProjectTags", "Effect" : "Allow", "Action" : [ "secretsmanager:TagResource" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "AmazonDataZoneDomain", "AmazonDataZoneProject" ] }, "StringLike" : { "aws:RequestTag/AmazonDataZoneDomain" : "dzd*", "aws:ResourceTag/AmazonDataZoneDomain" : "dzd*" } } }, { "Sid" : "DataZoneTagOnCreate", "Effect" : "Allow", "Action" : [ "secretsmanager:TagResource" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "AmazonDataZoneDomain" ] }, "StringLike" : { "aws:RequestTag/AmazonDataZoneDomain" : "dzd*", "aws:ResourceTag/AmazonDataZoneDomain" : "dzd*" } } }, { "Sid" : "CreateSecretStatement", "Effect" : "Allow", "Action" : [ "secretsmanager:CreateSecret" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*", "Condition" : { "StringLike" : { "aws:RequestTag/AmazonDataZoneDomain" : "dzd*" } } }, { "Sid" : "ConnectionStatement", "Effect" : "Allow", "Action" : [ "codeconnections:GetConnection" ], "Resource" : [ "arn:aws:codeconnections:*:*:connection/*" ] }, { "Sid" : "TagCodeConnectionsStatement", "Effect" : "Allow", "Action" : [ "codeconnections:TagResource" ], "Resource" : [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : [ "for-use-with-all-datazone-projects" ] }, "StringEquals" : { "aws:RequestTag/for-use-with-all-datazone-projects" : "true" } } }, { "Sid" : "UntagCodeConnectionsStatement", "Effect" : "Allow", "Action" : [ "codeconnections:UntagResource" ], "Resource" : [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition" : { "ForAllValues:StringEquals" : { "aws:TagKeys" : "for-use-with-all-datazone-projects" } } }, { "Sid" : "SSMParameterStatement", "Effect" : "Allow", "Action" : [ "ssm:GetParameter", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource" : [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI*", "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*" ] }, { "Sid" : "UseKMSKeyPermissionsStatement", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : [ "*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/EnableKeyForAmazonDataZone" : "true" }, "Null" : { "aws:ResourceTag/EnableKeyForAmazonDataZone" : "false" }, "StringLike" : { "kms:ViaService" : "ssm.*.amazonaws.com" } } }, { "Sid" : "SecurityPolicyStatement", "Effect" : "Allow", "Action" : [ "aoss:GetSecurityPolicy", "aoss:CreateSecurityPolicy" ], "Resource" : [ "*" ], "Condition" : { "StringLike" : { "aoss:collection" : "genai-studio-*" } } }, { "Sid" : "GetFoundationModelStatement", "Effect" : "Allow", "Action" : [ "bedrock:GetFoundationModel", "bedrock:GetFoundationModelAvailability" ], "Resource" : [ "arn:aws:bedrock:*::foundation-model/*" ] }, { "Sid" : "GetInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:GetInferenceProfile" ], "Resource" : [ "arn:aws:bedrock:*:*:inference-profile/*", "arn:aws:bedrock:*:*:application-inference-profile/*" ] }, { "Sid" : "ApplicationInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:CreateInferenceProfile" ], "Resource" : [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition" : { "Null" : { "aws:RequestTag/AmazonDataZoneProject" : "true", "aws:RequestTag/AmazonDataZoneDomain" : "false" } } }, { "Sid" : "TagApplicationInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:TagResource" ], "Resource" : [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition" : { "Null" : { "aws:ResourceTag/AmazonDataZoneProject" : "true", "aws:RequestTag/AmazonDataZoneProject" : "true", "aws:ResourceTag/AmazonDataZoneDomain" : "false", "aws:RequestTag/AmazonDataZoneDomain" : "false" } } }, { "Sid" : "DeleteApplicationInferenceProfileStatement", "Effect" : "Allow", "Action" : [ "bedrock:DeleteInferenceProfile" ], "Resource" : [ "arn:aws:bedrock:*:*:application-inference-profile/*" ], "Condition" : { "Null" : { "aws:ResourceTag/AmazonDataZoneProject" : "true", "aws:ResourceTag/AmazonDataZoneDomain" : "false" } } } ] } ``` ## Saiba mais + [Crie um conjunto de permissões usando políticas AWS gerenciadas no IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [Adicionar e remover permissões de identidade IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [Compreenda o controle de versionamento das políticas do IAM](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [Comece com políticas AWS gerenciadas e adote permissões com privilégios mínimos](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)