本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # AmazonDataZoneProjectDeploymentPermissionsBoundary **描述**：Amazon DataZone 创建用于部署数据分析项目的 IAM 角色。 DataZone 在创建这些角色时使用此策略来定义其权限边界。 `AmazonDataZoneProjectDeploymentPermissionsBoundary` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 您可以将 `AmazonDataZoneProjectDeploymentPermissionsBoundary` 附加到您的用户、组和角色。 ## 策略详细信息 + **类型**： AWS 托管策略 + **创建时间**：2023 年 3 月 21 日 02:54 UTC + **编辑时间：**2023 年 4 月 4 日 02:48 UTC + **ARN**: `arn:aws:iam::aws:policy/AmazonDataZoneProjectDeploymentPermissionsBoundary` ## 策略版本 **策略版本：**v2（默认） 此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Effect" : "Allow", "Action" : [ "iam:CreateRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy" ], "Resource" : "arn:aws:iam::*:role/*datazone*", "Condition" : { "StringEquals" : { "iam:PermissionsBoundary" : "arn:aws:iam::aws:policy/AmazonDataZoneProjectRolePermissionsBoundary" } } }, { "Effect" : "Allow", "Action" : [ "iam:DeleteRole" ], "Resource" : [ "arn:aws:iam::*:role/*datazone*" ] }, { "Effect" : "Allow", "Action" : [ "kms:CreateKey", "kms:TagResource", "athena:CreateWorkGroup", "athena:TagResource", "iam:TagRole", "iam:TagPolicy", "logs:CreateLogGroup", "logs:TagLogGroup", "ssm:AddTagsToResource" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : "datazone:*" }, "StringLike" : { "aws:ResourceTag/datazone:projectId" : "proj-*" } } }, { "Effect" : "Allow", "Action" : [ "athena:DeleteWorkGroup", "kms:ScheduleKeyDeletion", "kms:DescribeKey", "kms:EnableKeyRotation", "kms:DisableKeyRotation", "kms:GenerateDataKey", "kms:Encrypt", "kms:Decrypt", "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress" ], "Resource" : "*", "Condition" : { "StringLike" : { "aws:ResourceTag/datazone:projectId" : "proj-*" } } }, { "Effect" : "Allow", "Action" : [ "ec2:CreateTags" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : "datazone:projectId" } } }, { "Effect" : "Allow", "Action" : [ "iam:DeletePolicy", "s3:DeleteBucket" ], "Resource" : [ "arn:aws:iam::*:policy/datazone*", "arn:aws:s3:::datazone*" ] }, { "Effect" : "Allow", "Action" : [ "ssm:GetParameter*", "ssm:PutParameter", "ssm:DeleteParameter" ], "Resource" : [ "arn:aws:ssm:*:*:parameter/*datazone*" ] }, { "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:GetPolicy", "iam:GetRolePolicy", "iam:CreatePolicy", "iam:ListPolicyVersions", "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:PutDataLakeSettings", "lakeformation:GetDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:ListPermissions", "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabases", "glue:GetDatabase", "sts:GetCallerIdentity" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/*datazone*" ] }, { "Effect" : "Allow", "Action" : [ "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:DeleteBucketPolicy", "s3:CreateBucket", "s3:PutBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketVersioning", "s3:PutBucketTagging", "s3:PutBucketLogging", "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:GetEncryptionConfiguration", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*" ], "Resource" : "arn:aws:s3:::*datazone*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Allow", "Action" : [ "athena:Get*", "athena:List*", "ec2:CreateSecurityGroup", "ec2:RevokeSecurityGroupEgress", "ec2:DeleteSecurityGroup", "ec2:Describe*", "ec2:Get*", "ec2:List*", "logs:PutRetentionPolicy", "logs:DescribeLogGroups", "logs:DeleteLogGroup", "logs:DeleteRetentionPolicy" ], "Resource" : "*" }, { "Effect" : "Allow", "Action" : [ "kms:PutKeyPolicy" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "cloudformation.amazonaws.com" ] } } }, { "Effect" : "Allow", "Action" : "ec2:CreateVpcEndpoint", "NotResource" : "arn:aws:ec2:*:*:vpc-endpoint/*" }, { "Effect" : "Allow", "Action" : [ "ec2:CreateVpcEndpoint" ], "Resource" : "arn:aws:ec2:*:*:vpc-endpoint/*", "Condition" : { "StringLike" : { "ec2:VpceServiceName" : [ "com.amazonaws.*.logs", "com.amazonaws.*.s3", "com.amazonaws.*.glue", "com.amazonaws.*.athena" ] } } }, { "Action" : [ "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:DescribeChangeSet", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:TagResource", "cloudformation:GetTemplateSummary" ], "Effect" : "Allow", "Resource" : [ "arn:aws:cloudformation:*:*:stack/DataZone*" ] }, { "Effect" : "Deny", "Action" : [ "s3:GetObject*", "s3:GetBucket*", "s3:List*", "s3:GetEncryptionConfiguration", "s3:DeleteObject*", "s3:PutObject*", "s3:Abort*", "s3:DeleteBucket" ], "NotResource" : [ "arn:aws:s3:::*datazone*" ] }, { "Effect" : "Deny", "Action" : [ "kms:*" ], "Resource" : "*", "Condition" : { "StringNotEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Effect" : "Deny", "NotAction" : [ "ssm:PutParameter", "ssm:DeleteParameter", "ssm:AddTagsToResource", "ssm:GetParameters", "ssm:GetParameter", "s3:PutEncryptionConfiguration", "s3:PutBucketPublicAccessBlock", "s3:DeleteBucketPolicy", "s3:CreateBucket", "s3:PutBucketAcl", "s3:PutBucketPolicy", "s3:PutBucketVersioning", "s3:PutBucketTagging", "s3:ListBucket", "s3:PutBucketLogging", "s3:DeleteBucket", "iam:GetRole", "iam:GetRolePolicy", "iam:GetPolicy", "iam:CreatePolicy", "iam:ListPolicyVersions", "iam:DeletePolicy", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents", "cloudformation:GetTemplate", "cloudformation:DescribeChangeSet", "cloudformation:CreateChangeSet", "cloudformation:ExecuteChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:TagResource", "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack", "cloudformation:GetTemplateSummary", "athena:*", "kms:*", "glue:CreateDatabase", "glue:DeleteDatabase", "glue:GetDatabases", "glue:GetDatabase", "lambda:*", "ec2:*", "logs:*", "servicecatalog:CreateApplication", "servicecatalog:DeleteApplication", "servicecatalog:GetApplication", "lakeformation:RegisterResource", "lakeformation:DeregisterResource", "lakeformation:GrantPermissions", "lakeformation:PutDataLakeSettings", "lakeformation:RevokePermissions", "lakeformation:GetDataLakeSettings", "lakeformation:ListPermissions", "iam:CreateRole", "iam:DeleteRole", "iam:DetachRolePolicy", "iam:DeleteRolePolicy", "iam:AttachRolePolicy", "iam:PutRolePolicy", "iam:UntagRole", "iam:PassRole", "iam:TagRole", "s3:GetBucket*", "s3:GetObject*", "s3:Abort*", "s3:GetEncryptionConfiguration", "s3:PutObject*" ], "Resource" : [ "*" ] } ] } ``` ## 了解详情 + [在 IAM 身份中心使用 AWS 托管策略创建权限集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [添加和删除 IAM 身份权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM policy 版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略，转向最低权限权限](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)