AWS Glue API权限: 操作和资源参考 - AWS Glue
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

AWS Glue API权限: 操作和资源参考

在设置AWS Glue 中的 Identity and Access Management和编写可附加到 IAM 身份的权限策略(基于身份的策略)或可附加到资源的权限策略(资源策略)时,可以使用下面的作为参考。该表列出每个 AWS Glue API 操作、您可授予执行权限的对应操作以及您可授予权限的 AWS 资源。您可以在策略的 Action 字段中指定这些操作,并在策略的 Resource 字段中指定资源值。

对某些 AWS Glue 资源需要先祖和子资源 ARNs 也包含在政策的 Resource 字段。有关更多信息,请参阅数据目录 ARNs

通常,可将 ARN 分段替换为通配符。有关更多信息,请参阅 IAMJSON策略元素IAM 用户指南.

IAM 策略的条件键由 API 操作列出。您可以在 AWS Glue 策略中使用 AWS 范围的条件键来表达条件。有关整个AWS密钥的完整列表,请参阅 AWS全局条件键IAM 用户指南.

注意

要指定操作,请在 API 操作名称之前使用 glue: 前缀 (例如,glue:GetTable)。

使用滚动条查看表的其余部分。

AWS Glue API 和所需的操作权限
AWS Glue API 操作 所需权限(API 操作) 资源 条件键
BatchCreatePartition (batch_create_partition) glue:BatchCreatePartition
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
BatchDeleteConnection (批量_删除_连接) glue:BatchDeleteConnection
arn:aws-cn:glue:region:account-id:connection/connection-name arn:aws-cn:glue:region:account-id:catalog
注意

要通过调用执行的所有连接删除都必须由 IAM 授权。如果其中任何删除未经授权,调用将失败,且不会删除任何连接。

BatchDeletePartition (batch_delete_partition) glue:BatchDeletePartition
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
注意

要通过调用执行的所有分区删除都必须由 IAM 授权。如果其中任何删除未经授权,调用将失败,且不会删除任何分区。

BatchDeleteTable (batch_delete_table) glue:BatchDeleteTable
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
注意

要通过调用执行的所有表删除都必须由 IAM 授权。如果其中任何删除未经授权,调用将失败,且不会删除任何表。

BatchDeleteTableVersion (batch_delete_table_version) glue:BatchDeleteTableVersion
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
BatchGetCrawlers (batch_get_crawlers) glue:BatchGetCrawlers arn:aws-cn:glue:region:account-id:crawler/crawler-name glue:resourceTag
BatchGetDevEndpoints (批量_get_dev_端点) glue:BatchGetDevEndpoints arn:aws-cn:glue:region:account-id:devEndpoint/development-endpoint-name glue:resourceTag
BatchGetJobs (批量_获取_作业) glue:BatchGetJobs arn:aws-cn:glue:region:account-id:job/job-name glue:resourceTag
BatchGetPartition (batch_get_partition) glue:BatchGetPartition
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
BatchGetTriggers (批量_get_触发器) glue:BatchGetTriggers arn:aws-cn:glue:region:account-id:trigger/trigger-name glue:resourceTag
BatchStopJobRun (批量_停止_作业_运行) glue:BatchStopJobRun *
CreateClassifier (创建分类器) glue:CreateClassifier *
CreateConnection (创建连接) glue:CreateConnection
arn:aws-cn:glue:region:account-id:connection/connection-name arn:aws-cn:glue:region:account-id:catalog
CreateCrawler (create_crawler) glue:CreateCrawler arn:aws-cn:glue:region:account-id:crawler/crawler-name

arn:aws-cn:glue:region:account-id:crawler/*
aws:RequestTag
CreateDatabase (创建数据库) glue:CreateDatabase
arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
CreateDevEndpoint (创建dev_endpoint) glue:CreateDevEndpoint arn:aws-cn:glue:region:account-id:devEndpoint/development-endpoint-name

arn:aws-cn:glue:region:account-id:devEndpoint/*
aws:RequestTag
CreateJob (创建作业) glue:CreateJob arn:aws-cn:glue:region:account-id:job/job-name

arn:aws-cn:glue:region:account-id:job/*
aws:RequestTag
CreatePartition (create_partition) glue:CreatePartition
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
CreateScript (create_script) glue:CreateScript *
CreateSecurityConfiguration (创建安全配置) glue:CreateSecurityConfiguration *
CreateTable (create_table) glue:CreateTable
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
CreateTrigger (创建触发器) glue:CreateTrigger arn:aws-cn:glue:region:account-id:trigger/trigger-name

arn:aws-cn:glue:region:account-id:trigger/*
aws:RequestTag
CreateUserDefinedFunction (创建_user_defined_function) glue:CreateUserDefinedFunction >
arn:aws-cn:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
DeleteClassifier (删除分类器) glue:DeleteClassifier *
DeleteConnection (删除连接) glue:DeleteConnection
arn:aws-cn:glue:region:account-id:connection/connection-name arn:aws-cn:glue:region:account-id:catalog
DeleteCrawler (delete_crawler) glue:DeleteCrawler arn:aws-cn:glue:region:account-id:crawler/crawler-name

arn:aws-cn:glue:region:account-id:crawler/*
glue:resourceTag
DeleteDatabase (删除数据库) glue:DeleteDatabase
arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:userDefinedFunction/database-name/* arn:aws-cn:glue:region:account-id:table/database-name/* arn:aws-cn:glue:region:account-id:catalog
DeleteDevEndpoint (删除dev_endpoint) glue:DeleteDevEndpoint arn:aws-cn:glue:region:account-id:devEndpoint/development-endpoint-name

arn:aws-cn:glue:region:account-id:devEndpoint/*
glue:resourceTag
DeleteJob (删除作业) glue:DeleteJob arn:aws-cn:glue:region:account-id:job/job-name

arn:aws-cn:glue:region:account-id:job/*
glue:resourceTag
DeletePartition (delete_partition) glue:DeletePartition
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
DeleteResourcePolicy (删除资源策略) glue:DeleteResourcePolicy *
DeleteSecurityConfiguration (删除安全配置) glue:DeleteSecurityConfiguration *
DeleteTable (delete_table) glue:DeleteTable
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
DeleteTableVersion (delete_table_version) glue:DeleteTableVersion
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
DeleteTrigger (删除_触发) glue:DeleteTrigger arn:aws-cn:glue:region:account-id:trigger/trigger-name

arn:aws-cn:glue:region:account-id:trigger/*
glue:resourceTag
DeleteUserDefinedFunction (删除_user_defined_function) glue:DeleteUserDefinedFunction
arn:aws-cn:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetCatalogImportStatus (获取目录导入状态) glue:GetCatalogImportStatus
arn:aws-cn:glue:region:account-id:catalog
GetClassifier (获取分类器) glue:GetClassifier *
GetClassifiers (获取分类器) glue:GetClassifiers *
GetConnection (获取连接) glue:GetConnection
arn:aws-cn:glue:region:account-id:connection/connection-name arn:aws-cn:glue:region:account-id:catalog
GetConnections (获取连接) glue:GetConnections
arn:aws-cn:glue:region:account-id:connection/connection-names arn:aws-cn:glue:region:account-id:catalog
GetCrawler (get_crawler) glue:GetCrawler arn:aws-cn:glue:region:account-id:crawler/crawler-name

arn:aws-cn:glue:region:account-id:crawler/*
glue:resourceTag
GetCrawlerMetrics (get_crawler_metrics) glue:GetCrawlerMetrics *
GetCrawlers (get_crawlers) glue:GetCrawlers *
GetDatabase (获取数据库) glue:GetDatabase
arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetDatabases (获取数据库) glue:GetDatabases
arn:aws-cn:glue:region:account-id:database/database-names arn:aws-cn:glue:region:account-id:catalog
GetDataCatalogEncryptionSettings (获取data_catalog_encryption_settings) glue:GetDataCatalogEncryptionSettings *
GetDataflowGraph (get_dataflow_graph) glue:GetDataflowGraph *
GetDevEndpoint (获取终端) glue:GetDevEndpoint arn:aws-cn:glue:region:account-id:devEndpoint/development-endpoint-name

arn:aws-cn:glue:region:account-id:devEndpoint/*
glue:resourceTag
GetDevEndpoints (获取dev端点) glue:GetDevEndpoints *
GetJob (开始作业) glue:GetJob arn:aws-cn:glue:region:account-id:job/job-name

arn:aws-cn:glue:region:account-id:job/*
glue:resourceTag
GetJobRun (获取作业运行) glue:GetJobRun *
GetJobRuns (获取作业运行次数) glue:GetJobRuns *
GetJobs (获取作业) glue:GetJobs *
GetMapping(get_mapping) glue:GetMapping *
GetPartition (get_partition) glue:GetPartition
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetPartitions (get_partitions) glue:GetPartitions
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetPlan(get_plan) glue:GetPlan *
GetResourcePolicy (获取资源策略) glue:GetResourcePolicy *
GetSecurityConfiguration (获取安全配置) glue:GetSecurityConfiguration *
GetSecurityConfigurations (获取安全配置) glue:GetSecurityConfigurations *
GetTable (get_table) glue:GetTable
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetTables (get_tables) glue:GetTables
arn:aws-cn:glue:region:account-id:table/database-name/table-names arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetTableVersion (get_table_version) glue:GetTableVersion
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetTableVersions (get_table_versions) glue:GetTableVersions
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetTags (获取标签) glue:GetTags *
GetTrigger (获取触发器) glue:GetTrigger arn:aws-cn:glue:region:account-id:trigger/trigger-name

arn:aws-cn:glue:region:account-id:trigger/*
glue:resourceTag
GetTriggers (获取触发条件) glue:GetTriggers *
GetUserDefinedFunction (获取用户定义功能) glue:GetUserDefinedFunction
arn:aws-cn:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
GetUserDefinedFunctions (获取用户定义功能) glue:GetUserDefinedFunctions
arn:aws-cn:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-names arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
ImportCatalogToGlue (导入catalog到GLUE) glue:ImportCatalogToGlue
arn:aws-cn:glue:region:account-id:catalog
ListCrawlers (list_crawlers) glue:ListCrawlers *
ListDevEndpoints (列出dev端点) glue:ListDevEndpoints *
ListJobs (列出作业) glue:ListJobs *
ListTriggers (列出触发条件) glue:ListTriggers *
PutResourcePolicy (put_resource_policy)(输入_资源_策略) glue:PutResourcePolicy *
PutDataCatalogEncryptionSettings (put_data_catalog_encryption_settings)(输入_数据_目录_加密_设置) glue:PutDataCatalogEncryptionSettings *
ResetJobBookmark (重置_作业_书签) glue:ResetJobBookmark *
StartCrawler (start_crawler) glue:StartCrawler arn:aws-cn:glue:region:account-id:crawler/crawler-name

arn:aws-cn:glue:region:account-id:crawler/*
glue:resourceTag
StartCrawlerSchedule (开始_爬网程序) glue:StartCrawlerSchedule *
StartJobRun (开始_作业_运行) glue:StartJobRun *
StartTrigger (开始_触发) glue:StartTrigger arn:aws-cn:glue:region:account-id:trigger/trigger-name

arn:aws-cn:glue:region:account-id:trigger/*
glue:resourceTag
StopCrawler (stop_crawler) glue:StopCrawler arn:aws-cn:glue:region:account-id:crawler/crawler-name

arn:aws-cn:glue:region:account-id:crawler/*
glue:resourceTag
StopCrawlerSchedule (stop_crawler_schedule)(停止爬行程序) glue:StopCrawlerSchedule *
StopTrigger (停止_触发) glue:StopTrigger arn:aws-cn:glue:region:account-id:trigger/trigger-name

arn:aws-cn:glue:region:account-id:trigger/*
glue:resourceTag
TagResource (标签_资源) glue:TagResource * aws:RequestTag
UntagResource (untag_资源) glue:UntagResource * aws:TagKeys
UpdateClassifier (更新_分类器) glue:UpdateClassifier *
UpdateConnection (更新连接) glue:UpdateConnection
arn:aws-cn:glue:region:account-id:connection/connection-name arn:aws-cn:glue:region:account-id:catalog
UpdateCrawler (update_crawler) glue:UpdateCrawler arn:aws-cn:glue:region:account-id:crawler/crawler-name

arn:aws-cn:glue:region:account-id:crawler/*
glue:resourceTag
UpdateCrawlerSchedule (更新_爬网程序) glue:UpdateCrawlerSchedule *
UpdateDatabase (更新数据库) glue:UpdateDatabase
arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
UpdateDevEndpoint (更新_开发_端点) glue:UpdateDevEndpoint arn:aws-cn:glue:region:account-id:devEndpoint/development-endpoint-name

arn:aws-cn:glue:region:account-id:devEndpoint/*
glue:resourceTag
UpdateJob (更新作业) glue:UpdateJob arn:aws-cn:glue:region:account-id:job/job-name

arn:aws-cn:glue:region:account-id:job/*
glue:resourceTag
UpdatePartition (update_partition) glue:UpdatePartition
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
UpdateTable (update_table) glue:UpdateTable
arn:aws-cn:glue:region:account-id:table/database-name/table-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog
UpdateTrigger (更新_触发) glue:UpdateTrigger arn:aws-cn:glue:region:account-id:trigger/trigger-name

arn:aws-cn:glue:region:account-id:trigger/*
glue:resourceTag
UpdateUserDefinedFunction (更新_user_defined_function) glue:UpdateUserDefinedFunction
arn:aws-cn:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws-cn:glue:region:account-id:database/database-name arn:aws-cn:glue:region:account-id:catalog