本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# 存取 Amazon S3 的私有子網路的範例政策
<a name="private-subnet-iampolicy"></a>

對於私有子網路，您至少必須可以讓 Amazon EMR 存取 Amazon Linux 儲存庫。此私有子網路政策是用於存取 Amazon S3 的 VPC 端點政策的一部分。

自 Amazon EMR 5.25.0 版或更新版本起，若要啟用持續性 Spark 歷史記錄伺服器的一鍵式存取功能，您必須允許 Amazon EMR 存取收集 Spark 事件日誌的系統儲存貯體。如果您啟用記錄，請將 PUT 許可提供給下列儲存貯體：

```
aws157-logs-${AWS::Region}/*
```

如需詳細資訊，請參閱[持續性 Spark 歷史記錄伺服器的一鍵式存取功能](https://docs.aws.amazon.com/emr/latest/ManagementGuide/app-history-spark-UI.html)。

您必須決定符合業務需求的政策限制。下列範例政策提供存取 Amazon Linux 儲存庫和 Amazon EMR 系統儲存貯體的許可，以收集 Spark 事件日誌。它顯示儲存貯體的一些範例資源名稱。

如需有關將 IAM 政策與 Amazon VPC 端點搭配使用的詳細資訊，請參閱 [Amazon S3 的端點政策](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#vpc-endpoints-policies-s3)。

下列政策範例包含 us-east-1 區域中的範例資源。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "AmazonLinuxAMIRepositoryAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::packages.us-east-1.amazonaws.com/*",
        "arn:aws:s3:::repo.us-east-1.amazonaws.com/*"
      ]
    },
    {
      "Sid": "EnableApplicationHistory",
      "Effect": "Allow",
      "Action": [
        "s3:Put*",
        "s3:Get*",
        "s3:Create*",
        "s3:Abort*",
        "s3:List*"
      ],
      "Resource": [
        "arn:aws:s3:::prod.us-east-1.appinfo.src/*"
      ]
    }
  ]
}
```

------

下列範例政策提供存取 us-east-1 區域中 Amazon Linux 2 儲存庫所需的許可。

```
{
   "Statement": [
       {
           "Sid": "AmazonLinux2AMIRepositoryAccess",
           "Effect": "Allow",
           "Principal": "*",
           "Action": "s3:GetObject",
           "Resource": [
           	"arn:aws:s3:::amazonlinux.us-east-1.amazonaws.com/*",
           	"arn:aws:s3:::amazonlinux-2-repos-us-east-1/*"
           ]
       }
   ]
}
```

下列範例政策提供存取 us-east-1 區域中 Amazon Linux 2023 儲存庫所需的許可。

```
{       
    "Statement": [                                       
        {                                                        
            "Sid": "AmazonLinux2023AMIRepositoryAccess",
            "Effect": "Allow",           
            "Principal": "*",                    
            "Action": "s3:GetObject",                    
            "Resource": [                                
                 "arn:aws:s3:::al2023-repos-us-east-1-de612dc2/*"
            ]                                            
        }                                                
    ]                                                    
 }
```

## 可用區域
<a name="private-subnet-iampolicy-regions"></a>

下表包含依區域列出的儲存貯體清單，並同時包含儲存庫的 Amazon Resource Name (ARN) 和代表 的 ARN 的字串`appinfo.src`。ARN 或 Amazon Resource Name 是可唯一識別 AWS 資源的字串。


| 區域 | 儲存庫儲存貯體 | AppInfo 儲存貯體 | 
| --- | --- | --- | 
| 美國東部 (俄亥俄) | "arn：aws：s3：：packages.us-east-2.amazonaws.com/","arn:aws:s3:::repo.us-east-2.amazonaws.com/","arn:aws:s3:::repo.us-east-2.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.us-east-2.appinfo.src/\$1" | 
| 美國東部 (維吉尼亞北部) | 「arn：aws：s3：：packages.us-east-1.amazonaws.com/","arn:aws:s3:::repo.us-east-1.amazonaws.com/","arn:aws:s3:::repo.us-east-1.emr.amazonaws.com/\$1」 | "arn：aws：s3：：prod.us-east-1.appinfo.src/\$1" | 
| 美國西部 (加州北部) | 「arn：aws：s3：：packages.us-west-1.amazonaws.com/","arn:aws:s3:::repo.us-west-1.amazonaws.com/","arn:aws:s3:::repo.us-west-1.emr.amazonaws.com/\$1」 | 「arn：aws：s3：：prod.us-west-1.appinfo.src/\$1」 | 
| 美國西部 (奧勒岡) | 「arn：aws：s3：：packages.us-west-2.amazonaws.com/","arn:aws:s3:::repo.us-west-2.amazonaws.com/","arn:aws:s3:::repo.us-west-2.emr.amazonaws.com/\$1」 | "arn：aws：s3：：prod.us-west-2.appinfo.src/\$1" | 
| 非洲 (開普敦) | "arn：aws：s3：：packages.af-south-1.amazonaws.com/","arn:aws:s3:::repo.af-south-1.amazonaws.com/","arn:aws:s3:::repo.af-south-1.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.af-south-1.appinfo.src/\$1" | 
| 非洲 (開普敦) | "arn：aws：s3：：packages.ap-east-1.amazonaws.com/","arn:aws:s3:::repo.ap-east-1.amazonaws.com/","arn:aws:s3:::repo.ap-east-1.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.ap-east-1.appinfo.src/\$1" | 
| 亞太區域 (海德拉巴) | "arn：aws：s3：：packages.ap-south-2.amazonaws.com/","arn:aws:s3:::repo.ap-south-2.amazonaws.com/","arn:aws:s3:::repo.ap-south-2.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-south-2.appinfo.src/\$1」 | 
| 亞太區域 (雅加達) | "arn：aws：s3：：packages.ap-southeast-3.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-3.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-3.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-southeast-3.appinfo.src/\$1」 | 
| 亞太區域 （馬來西亞） | "arn：aws：s3：：packages.ap-southeast-5.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-5.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-5.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.ap-southeast-5.appinfo.src/\$1" | 
| 亞太區域 (墨爾本) | "arn：aws：s3：：packages.ap-southeast-4.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-4.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-4.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-south-4.appinfo.src/\$1」 | 
| 亞太區域 (孟買) | "arn：aws：s3：：packages.ap-south-1.amazonaws.com/","arn:aws:s3:::repo.ap-south-1.amazonaws.com/","arn:aws:s3:::repo.ap-south-1.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-south-1.appinfo.src/\$1」 | 
| 亞太區域 (大阪) | "arn：aws：s3：：packages.ap-northeast-3.amazonaws.com/","arn:aws:s3:::repo.ap-northeast-3.amazonaws.com/","arn:aws:s3:::repo.ap-northeast-3.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-northeast-3.appinfo.src/\$1」 | 
| 亞太區域 (首爾) | "arn：aws：s3：：packages.ap-northeast-2.amazonaws.com/","arn:aws:s3:::repo.ap-northeast-2.amazonaws.com/","arn:aws:s3:::repo.ap-northeast-2.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-northeast-2.appinfo.src/\$1」 | 
| 亞太區域 (新加坡) | "arn：aws：s3：：packages.ap-southeast-1.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-1.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-1.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-southeast-1.appinfo.src/\$1」 | 
| 亞太區域 (雪梨) | "arn：aws：s3：：packages.ap-southeast-2.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-2.amazonaws.com/","arn:aws:s3:::repo.ap-southeast-2.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ap-southeast-2.appinfo.src/\$1」 | 
| 亞太區域 (東京) | 「arn：aws：s3：：packages.ap-northeast-1.amazonaws.com/","arn:aws:s3:::repo.ap-northeast-1.amazonaws.com/","arn:aws:s3:::repo.ap-northeast-1.emr.amazonaws.com/\$1」 | 「arn：aws：s3：：prod.ap-northeast-1.appinfo.src/\$1」 | 
| 加拿大 (中部) | "arn：aws：s3：：packages.ca-central-1.amazonaws.com/","arn:aws:s3:::repo.ca-central-1.amazonaws.com/","arn:aws:s3:::repo.ca-central-1.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.ca-central-1.appinfo.src/\$1" | 
| 加拿大西部 (卡加利) | "arn：aws：s3：：packages.ca-west-1.amazonaws.com/","arn:aws:s3:::repo.ca-west-1.amazonaws.com/","arn:aws:s3:::repo.ca-west-1.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.ca-west-1.appinfo.src/\$1」 | 
| 歐洲 (法蘭克福) | 「arn：aws：s3：：packages.eu-central-1.amazonaws.com/","arn:aws:s3:::repo.eu-central-1.amazonaws.com/","arn:aws:s3:::repo.eu-central-1.emr.amazonaws.com/\$1」 | "arn：aws：s3：：prod.eu-central-1.appinfo.src/\$1" | 
| 歐洲 (愛爾蘭) | "arn：aws：s3：：packages.eu-west-1.amazonaws.com/","arn:aws:s3:::repo.eu-west-1.amazonaws.com/","arn:aws:s3:::repo.eu-west-1.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.eu-west-1.appinfo.src/\$1」 | 
| 歐洲 (倫敦) | "arn：aws：s3：：packages.eu-west-2.amazonaws.com/","arn:aws:s3:::repo.eu-west-2.amazonaws.com/","arn:aws:s3:::repo.eu-west-2.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.eu-west-2.appinfo.src/\$1" | 
| 歐洲 (米蘭) | "arn：aws：s3：：packages.eu-south-1.amazonaws.com/","arn:aws:s3:::repo.eu-south-1.amazonaws.com/","arn:aws:s3:::repo.eu-south-1.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.eu-south-1.appinfo.src/\$1" | 
| 歐洲 (巴黎) | "arn：aws：s3：：packages.eu-west-3.amazonaws.com/","arn:aws:s3:::repo.eu-west-3.amazonaws.com/","arn:aws:s3:::repo.eu-west-3.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.eu-west-3.appinfo.src/\$1」 | 
| 歐洲 (西班牙) | "arn：aws：s3：：packages.eu-south-2.amazonaws.com/","arn:aws:s3:::repo.eu-south-2.amazonaws.com/","arn:aws:s3:::repo.eu-south-2.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.eu-south-2.appinfo.src/\$1」 | 
| 歐洲 (斯德哥爾摩) | "arn：aws：s3：：packages.eu-north-1.amazonaws.com/","arn:aws:s3:::repo.eu-north-1.amazonaws.com/","arn:aws:s3:::repo.eu-north-1.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.eu-north-1.appinfo.src/\$1" | 
| 歐洲 (蘇黎世) | "arn：aws：s3：：packages.eu-central-2.amazonaws.com/","arn:aws:s3:::repo.eu-central-2.amazonaws.com/","arn:aws:s3:::repo.eu-central-2.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.eu-central-2.appinfo.src/\$1" | 
| 以色列 (特拉維夫) | "arn：aws：s3：：packages.il-central-1.amazonaws.com/","arn:aws:s3:::repo.il-central-1.amazonaws.com/","arn:aws:s3:::repo.il-central-1.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.il-central-1.appinfo.src/\$1" | 
| 中東 (巴林) | "arn：aws：s3：：packages.me-south-1.amazonaws.com/","arn:aws:s3:::repo.me-south-1.amazonaws.com/","arn:aws:s3:::repo.me-south-1.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.me-south-1.appinfo.src/\$1」 | 
| 中東 (阿拉伯聯合大公國) | 「arn：aws：s3：：packages.me-central-1.amazonaws.com/","arn:aws:s3:::repo.me-central-1.amazonaws.com/","arn:aws:s3:::repo.me-central-1.emr.amazonaws.com/\$1」 | "arn：aws：s3：：prod.me-central-1.appinfo.src/\$1" | 
| 南美洲 (聖保羅) | "arn：aws：s3：：packages.sa-east-1.amazonaws.com/","arn:aws:s3:::repo.sa-east-1.amazonaws.com/","arn:aws:s3:::repo.sa-east-1.emr.amazonaws.com/\$1" | "arn：aws：s3：：prod.sa-east-1.appinfo.src/\$1" | 
| AWS GovCloud （美國東部） | 「arn：aws：s3：：packages.us-gov-east-1.amazonaws.com/","arn:aws:s3:::repo.us-gov-east-1.amazonaws.com/","arn:aws:s3:::repo.us-gov-east-1.emr.amazonaws.com/\$1」 | "arn：aws：s3：：prod.us-gov-east-1.appinfo.src/\$1" | 
| AWS GovCloud （美國西部） | "arn：aws：s3：：packages.us-gov-west-1.amazonaws.com/","arn:aws:s3:::repo.us-gov-west-1.amazonaws.com/","arn:aws:s3:::repo.us-gov-west-1.emr.amazonaws.com/\$1" | 「arn：aws：s3：：prod.me-south-1.appinfo.src/\$1」 |