本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。 # AmazonDataZoneGlueManageAccessRolePolicy **描述**：政策授予許可，以允許 Amazon DataZone 啟用資料的發佈和存取授予。 `AmazonDataZoneGlueManageAccessRolePolicy` 是 [AWS 受管政策](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此政策 您可以將 `AmazonDataZoneGlueManageAccessRolePolicy` 連接至使用者、群組與角色。 ## 政策詳細資訊 + **類型**：服務角色政策 + **建立時間**：2023 年 9 月 22 日 20：21 UTC + **編輯時間：**2026 年 2 月 12 日 18：00 UTC + **ARN**: `arn:aws:iam::aws:policy/service-role/AmazonDataZoneGlueManageAccessRolePolicy` ## 政策版本 **政策版本：** v18 （預設） 政策的預設版本是定義政策許可的版本。當具有 政策的使用者或角色提出存取 AWS 資源的請求時， 會 AWS 檢查政策的預設版本，以決定是否允許請求。 ## JSON 政策文件 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "GlueTagDatabase", "Effect" : "Allow", "Action" : [ "glue:TagResource", "glue:UntagResource" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAnyValue:StringLikeIfExists" : { "aws:TagKeys" : "DataZoneDiscoverable_*" } } }, { "Sid" : "GlueDataQuality", "Effect" : "Allow", "Action" : [ "glue:ListDataQualityResults", "glue:GetDataQualityResult" ], "Resource" : "arn:aws:glue:*:*:dataQualityRuleset/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueCrawler", "Effect" : "Allow", "Action" : "glue:ListCrawls", "Resource" : "arn:aws:glue:*:*:crawler/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueConnection", "Effect" : "Allow", "Action" : "glue:GetConnection", "Resource" : [ "arn:aws:glue:*:*:connection/*", "arn:aws:glue:*:*:catalog" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueTableDatabaseCatalog", "Effect" : "Allow", "Action" : [ "glue:CreateTable", "glue:DeleteTable", "glue:GetDatabases", "glue:GetTables", "glue:SearchTables", "glue:CreateCatalog", "glue:CreateDatabase", "glue:DeleteCatalog", "glue:DeleteDatabase" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:userDefinedFunction/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "GlueGetTags", "Effect" : "Allow", "Action" : [ "glue:GetTags", "glue:GetCatalog" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "LakeformationResourceSharing", "Effect" : "Allow", "Action" : [ "lakeformation:BatchGrantPermissions", "lakeformation:BatchRevokePermissions", "lakeformation:CreateDataCellsFilter", "lakeformation:CreateLakeFormationOptIn", "lakeformation:DeleteDataCellsFilter", "lakeformation:DeleteLakeFormationOptIn", "lakeformation:GrantPermissions", "lakeformation:GetDataCellsFilter", "lakeformation:GetResourceLFTags", "lakeformation:ListDataCellsFilter", "lakeformation:ListLakeFormationOptIns", "lakeformation:ListPermissions", "lakeformation:RegisterResource", "lakeformation:RevokePermissions", "lakeformation:UpdateDataCellsFilter", "glue:GetDatabase", "glue:GetTable", "organizations:DescribeOrganization", "ram:GetResourceShareInvitations", "ram:ListResources" ], "Resource" : "*" }, { "Sid" : "LakeformationResourceFederatedSharing", "Effect" : "Allow", "Action" : [ "lakeformation:GetDataAccess" ], "Resource" : "*", "Condition" : { "Null" : { "lakeformation:GlueARN" : "true" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "glue.amazonaws.com", "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceSharing", "Effect" : "Allow", "Action" : [ "glue:DeleteResourcePolicy", "glue:PutResourcePolicy" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*", "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*" ], "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "ram.amazonaws.com" ] } } }, { "Sid" : "CrossAccountLakeFormationResourceSharing", "Effect" : "Allow", "Action" : [ "ram:CreateResourceShare" ], "Resource" : "*", "Condition" : { "StringEqualsIfExists" : { "ram:RequestedResourceType" : [ "glue:Table", "glue:Database", "glue:Catalog" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceShareInvitation", "Effect" : "Allow", "Action" : [ "ram:AcceptResourceShareInvitation" ], "Resource" : "arn:aws:ram:*:*:resource-share-invitation/*" }, { "Sid" : "CrossAccountRAMResourceSharingViaLakeFormation", "Effect" : "Allow", "Action" : [ "ram:AssociateResourceShare", "ram:DeleteResourceShare", "ram:DisassociateResourceShare", "ram:ListResourceSharePermissions", "ram:UpdateResourceShare" ], "Resource" : "*", "Condition" : { "StringLike" : { "ram:ResourceShareName" : [ "LakeFormation*" ] }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "GetResourceSharesViaLakeFormation", "Effect" : "Allow", "Action" : "ram:GetResourceShares", "Resource" : "*", "Condition" : { "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "CrossAccountRAMResourceSharingViaLakeFormationHybrid", "Effect" : "Allow", "Action" : "ram:AssociateResourceSharePermission", "Resource" : "*", "Condition" : { "ArnLike" : { "ram:PermissionArn" : "arn:aws:ram::aws:permission/AWSRAMLFEnabled*" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : [ "lakeformation.amazonaws.com" ] } } }, { "Sid" : "KMSDecrypt", "Effect" : "Allow", "Action" : [ "kms:Decrypt" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/datazone:projectId" : "proj-all" } } }, { "Sid" : "GetRoleForDataZone", "Effect" : "Allow", "Action" : [ "iam:GetRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*" ] }, { "Sid" : "PassRoleForDataLocationRegistration", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/AmazonDataZone*", "arn:aws:iam::*:role/service-role/AmazonDataZone*", "arn:aws:iam::*:role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/service-role/AmazonSageMakerManageAccess*", "arn:aws:iam::*:role/datazone_usr_role*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "lakeformation.amazonaws.com", "glue.amazonaws.com" ] } } }, { "Sid" : "CreateCatalogEC2", "Effect" : "Allow", "Action" : [ "ec2:DescribeAccountAttributes", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeAvailabilityZones" ], "Resource" : "*" }, { "Sid" : "CreateCatalogS3", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketPolicy", "s3:PutEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:PutBucketVersioning", "s3:PutBucketTagging" ], "Resource" : "arn:aws:s3:::redshift-staging-bucket*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] } ``` ## 進一步了解 + [在 IAM Identity Center 中使用 AWS 受管政策建立許可集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [新增和移除 IAM 身分許可](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM 政策的版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [開始使用 AWS 受管政策並邁向最低權限許可](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)