本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # AmazonDataZoneGlueManageAccessRolePolicy **描述**：该政策授予 DataZone 允许Amazon启用发布和数据访问权限的权限。 `AmazonDataZoneGlueManageAccessRolePolicy` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 您可以将 `AmazonDataZoneGlueManageAccessRolePolicy` 附加到您的用户、组和角色。 ## 策略详细信息 + **类型**：服务角色策略 + **创建时间**：2023 年 9 月 22 日 20:21 UTC + **编辑时间：世界标准时间** 2026 年 2 月 12 日 18:00 + **ARN**: `arn:aws:iam::aws:policy/service-role/AmazonDataZoneGlueManageAccessRolePolicy` ## 策略版本 **策略版本：**v18（默认） 此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "GlueTagDatabase", "Effect" : "Allow", "Action" : [ "glue:TagResource", "glue:UntagResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAnyValue:StringLikeIfExists" : { "aws:TagKeys" : "DataZoneDiscoverable_*" } } }, { "Sid" : "GlueDataQuality", "Effect" : "Allow", "Action" : [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource" : "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueCrawler", "Effect" : "Allow", "Action" : "glue:ListCrawls", "Resource" : "arn:aws:glue:*:*:crawler/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueConnection", "Effect" : "Allow", "Action" : "glue:GetConnection", "Resource" : [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueTableDatabaseCatalog", "Effect" : "Allow", "Action" : [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables", "glue:SearchTables", "glue:CreateCatalog", "glue:CreateDatabase", "glue:DeleteCatalog", "glue:DeleteDatabase" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueGetTags", "Effect" : "Allow", "Action" : [ "glue:GetTags", "glue:GetCatalog" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "LakeformationResourceSharing", "Effect" : "Allow", "Action" : [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateDataCellsFilter", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteDataCellsFilter", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetDataCellsFilter", "lakeformation:GetResourceLFTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:UpdateDataCellsFilter", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource" : "*" }, { "Sid" : "LakeformationResourceFederatedSharing", "Effect" : "Allow", "Action" : [ "lakeformation:GetDataAccess" ], "Resource" : "*", "Condition" : { "Null" : { "lakeformation:GlueARN" : "true" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceSharing", "Effect" : "Allow", "Action" : [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "ram.amazonaws.com" ] } } }, { "Sid" : "CrossAccountLakeFormationResourceSharing", "Effect" : "Allow", "Action" : [ "ram:CreateResourceShare" ], "Resource" : "*", "Condition" : { "StringEqualsIfExists" : { "ram:RequestedResourceType" : [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceShareInvitation", "Effect" : "Allow", "Action" : [ "ram:AcceptResourceShareInvitation" ], "Resource" : "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid" : "CrossAccountRAMResourceSharingViaLakeFormation", "Effect" : "Allow", "Action" : [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource" : "*", "Condition" : { "StringLike" : { "ram:ResourceShareName" : [ "LakeFormation*" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "GetResourceSharesViaLakeFormation", "Effect" : "Allow", "Action" : "ram:GetResourceShares", "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect" : "Allow", "Action" : "ram:AssociateResourceSharePermission", "Resource" : "*", "Condition" : { "ArnLike" : { "ram:PermissionArn" : "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "KMSDecrypt", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/datazone:projectId" : "proj-all" } } }, { "Sid" : "GetRoleForDataZone", "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*" ] }, { "Sid" : "PassRoleForDataLocationRegistration", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/datazone_usr_role*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "lakeformation.amazonaws.com", "glue.amazonaws.com" ] } } }, { "Sid" : "CreateCatalogEC2", "Effect" : "Allow", "Action" : [ "ec2:DescribeAccountAttributes", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeAvailabilityZones" ], "Resource" : "*" }, { "Sid" : "CreateCatalogS3", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource" : "arn:aws:s3:::redshift-staging-bucket*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] } ``` ## 了解详情 + [在 IAM 身份中心使用 AWS 托管策略创建权限集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [添加和删除 IAM 身份权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM policy 版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略，转向最低权限权限](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)