允许 Athena Federated Query (Preview) 的示例 IAM 权限策略 - Amazon Athena
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

允许 Athena Federated Query (Preview) 的示例 IAM 权限策略

本主题中的权限策略示例演示了需要允许的操作以及允许执行这些操作的资源。仔细检查这些策略并根据您的需求修改它们,然后再将它们附加到 IAM 身份。

– 允许 IAM 委托人使用 Athena Federated Query (Preview) 运行并返回结果

以下基于身份的权限策略允许用户或其他 IAM 委托人执行使用 Athena Federated Query (Preview) 运行查询所需的操作。允许执行这些操作的委托人可以运行指定与联合数据源关联的 Athena 目录的查询。

{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "athena:GetWorkGroup", "s3:PutObject", "s3:GetObject", "athena:StartQueryExecution", "s3:AbortMultipartUpload", "lambda:InvokeFunction", "athena:CancelQueryExecution", "athena:StopQueryExecution", "athena:GetQueryExecution", "athena:GetQueryResults", "s3:ListMultipartUploadParts" ], "Resource": [ "arn:aws:athena:*:MyAWSAcctId:workgroup/AmazonAthenaPreviewFunctionality", "arn:aws:s3:::MyQueryResultsBucket/*", "arn:aws:s3:::MyLambdaSpillBucket/MyLambdaSpillPrefix*", "arn:aws:lambda:*:MyAWSAcctId:function:OneAthenaLambdaFunction", "arn:aws:lambda:*:MyAWSAcctId:function:AnotherAthenaLambdaFunction" ] }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": "athena:ListWorkGroups", "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetBucketLocation" ], "Resource": "arn:aws:s3:::MyLambdaSpillBucket" } ] }
权限说明
允许的操作 说明
"athena:StartQueryExecution", "athena:GetQueryResults", "athena:GetWorkGroup", "athena:CancelQueryExecution", "athena:StopQueryExecution", "athena:GetQueryExecution",

AmazonAthenaPreviewFunctionality 工作组中运行查询所需的 Athena 权限。

"s3:PutObject", "s3:GetObject", "s3:AbortMultipartUpload"

s3:PutObjects3:AbortMultipartUpload 允许将查询结果写入由 arn:aws:s3:::MyQueryResultsBucket/* 资源标识符指定的查询结果存储桶的所有子文件夹,其中 MyQueryResultsBucket 是 Athena 查询结果存储桶。有关更多信息,请参阅使用查询结果、输出文件和查询历史记录

s3:GetObject 允许读取指定为 arn:aws:s3:::MyQueryResultsBucket 的资源的查询结果和查询历史记录,其中 MyQueryResultsBucket 是 Athena 查询结果存储桶。

s3:GetObject 还允许从指定为 "arn:aws:s3:::MyLambdaSpillBucket/MyLambdaSpillPrefix*" 的资源中读取,其中 MyLambdaSpillPrefix 在被调用的一个或多个 Lambda 函数的配置中指定。

"lambda:InvokeFunction"
允许查询为 Resource 块中指定的 AWS Lambda 函数调用 AWS Lambda 函数。例如 arn:aws:lambda:*:MyAWSAcctId:function:MyAthenaLambdaFunction,其中 MyAthenaLambdaFunction 指定要调用的 Lambda 函数的名称。如示例中所示,可以指定多个函数。

– 允许 IAM 委托人创建数据源连接器

{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:ListVersionsByFunction", "iam:CreateRole", "lambda:GetFunctionConfiguration", "iam:AttachRolePolicy", "iam:PutRolePolicy", "lambda:PutFunctionConcurrency", "iam:PassRole", "iam:DetachRolePolicy", "lambda:ListTags", "iam:ListAttachedRolePolicies", "iam:DeleteRolePolicy", "lambda:DeleteFunction", "lambda:GetAlias", "iam:ListRolePolicies", "iam:GetRole", "iam:GetPolicy", "lambda:InvokeFunction", "lambda:GetFunction", "lambda:ListAliases", "lambda:UpdateFunctionConfiguration", "iam:DeleteRole", "lambda:UpdateFunctionCode", "s3:GetObject", "lambda:AddPermission", "iam:UpdateRole", "lambda:DeleteFunctionConcurrency", "lambda:RemovePermission", "iam:GetRolePolicy", "lambda:GetPolicy" ], "Resource": [ "arn:aws:lambda:*:MyAWSAcctId:function:MyAthenaLambdaFunctionsPrefix*", "arn:aws:s3:::awsserverlessrepo-changesets-1iiv3xa62ln3m/*", "arn:aws:iam::*:role/*", "arn:aws:iam::MyAWSAcctId:policy/*" ] }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "cloudformation:CreateUploadBucket", "cloudformation:DescribeStackDriftDetectionStatus", "cloudformation:ListExports", "cloudformation:ListStacks", "cloudformation:ListImports", "lambda:ListFunctions", "iam:ListRoles", "lambda:GetAccountSettings", "ec2:DescribeSecurityGroups", "cloudformation:EstimateTemplateCost", "ec2:DescribeVpcs", "lambda:ListEventSourceMappings", "cloudformation:DescribeAccountLimits", "ec2:DescribeSubnets", "cloudformation:CreateStackSet", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Sid": "VisualEditor2", "Effect": "Allow", "Action": "cloudformation:*", "Resource": [ "arn:aws:cloudformation:*:MyAWSAcctId:stack/aws-serverless-repository-MyCFStackPrefix*/*", "arn:aws:cloudformation:*:MyAWSAcctId:stack/serverlessrepo-MyCFStackPrefix*/*", "arn:aws:cloudformation:*:*:transform/Serverless-*", "arn:aws:cloudformation:*:MyAWSAcctId:stackset/aws-serverless-repository-MyCFStackPrefix*:*", "arn:aws:cloudformation:*:MyAWSAcctId:stackset/serverlessrepo-MyCFStackPrefix*:*" ] }, { "Sid": "VisualEditor3", "Effect": "Allow", "Action": "serverlessrepo:*", "Resource": "arn:aws:serverlessrepo:*:*:applications/*" } ] }
权限说明
允许的操作 说明
"lambda:CreateFunction", "lambda:ListVersionsByFunction", "lambda:GetFunctionConfiguration", "lambda:PutFunctionConcurrency", "lambda:ListTags", "lambda:DeleteFunction", "lambda:GetAlias", "lambda:InvokeFunction", "lambda:GetFunction", "lambda:ListAliases", "lambda:UpdateFunctionConfiguration", "lambda:UpdateFunctionCode", "lambda:AddPermission", "lambda:DeleteFunctionConcurrency", "lambda:RemovePermission", "lambda:GetPolicy" "lambda:GetAccountSettings", "lambda:ListFunctions", "lambda:ListEventSourceMappings",

允许创建和管理列为资源的 Lambda 函数。在此示例中,资源标识符 arn:aws:lambda:*:MyAWSAcctId:function:MyAthenaLambdaFunctionsPrefix* 中使用名称前缀,其中 MyAthenaLambdaFunctionsPrefix 是一组 Lambda 函数的名称中使用的共享前缀,因此它们不需要单独指定为资源。您可以指定一个或多个 Lambda 函数资源。

"s3:GetObject"
允许读取 AWS Serverless Application Repository 所需的存储桶,如资源标识符 arn:aws:s3:::awsserverlessrepo-changesets-1iiv3xa62ln3m/* 所指定。此存储桶可能特定于您的账户。
"cloudformation:*"

允许创建和管理由资源 MyCFStackPrefix 指定的 AWS CloudFormation 堆栈。这些堆栈和堆栈集是 AWS Serverless Application Repository 部署连接器和 UDF 的方式。

"serverlessrepo:*"
允许在由资源标识符 arn:aws:serverlessrepo:*:*:applications/* 指定的 AWS Serverless Application Repository 中搜索、查看、发布和更新应用程序。