AmazonGlue API 权限:操作和资源参考 - Amazon连接词
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

本文属于机器翻译版本。若本译文内容与英语原文存在差异,则一律以英文原文为准。

AmazonGlue API 权限:操作和资源参考

使用以下table作为参考,当您设置中的 Identity and Access ManagementAmazon连接词并编写要附加到 IAM 身份(基于身份的策略)或资源(资源策略)的权限策略。这些区域有:表列表 EAccessAmazonGlue API 操作、您可授予执行权限的对应操作以及Amazon资源,您可以授予权限。您可以在策略的 Action 字段中指定这些操作,并在策略的 Resource 字段中指定资源值。

对某些操作AmazonGlue 资源要原级和子资源 ARN 也包含在策略的Resource字段。有关更多信息,请参阅 数据目录 ARN

通常,可将 ARN 分段替换为通配符。有关更多信息,请参阅 。IAM JSON 策略元素中的IAM 用户指南

IAM 策略的条件键由 API 操作列出。您可以使用Amazon-范围的条件键Amazon表达条件的 Glue 政策。有关Amazon-宽键,请参阅Amazon全局条件键中的IAM 用户指南

注意

要指定操作,请在 API 操作名称之前使用 glue: 前缀 (例如,glue:GetTable)。

使用滚动条查看表的其余部分。

AmazonGlue API 和必需的操作权限
AmazonAPI 操作 所需权限(API 操作) 资源 条件键
BatchCreatePartition (batch_create_partition) glue:BatchCreatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchDeleteConnection (batch_delete_connection) glue:BatchDeleteConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
注意

要通过调用执行的所有连接删除都必须由 IAM 授权。如果其中任何删除未经授权,调用将失败,且不会删除任何连接。

BatchDeletePartition (batch_delete_partition) glue:BatchDeletePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
注意

要通过调用执行的所有分区删除都必须由 IAM 授权。如果其中任何删除未经授权,调用将失败,且不会删除任何分区。

BatchDeleteTable (batch_delete_table) glue:BatchDeleteTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
注意

要通过调用执行的所有表删除都必须由 IAM 授权。如果其中任何删除未经授权,调用将失败,且不会删除任何表。

BatchDeleteTableVersion (batch_delete_table_version) glue:BatchDeleteTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchGetCrawlers (batch_get_crawlers) glue:BatchGetCrawlers arn:aws:glue:region:account-id:crawler/crawler-name glue:resourceTag
BatchGetDevEndpoints (batch_get_dev_endpoints) glue:BatchGetDevEndpoints arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name glue:resourceTag
BatchGetJobs (batch_get_jobs) glue:BatchGetJobs arn:aws:glue:region:account-id:job/job-name glue:resourceTag
BatchGetPartition (batch_get_partition) glue:BatchGetPartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
BatchGetTriggers (batch_get_triggers) glue:BatchGetTriggers arn:aws:glue:region:account-id:trigger/trigger-name glue:resourceTag
BatchStopJobRun (batch_stop_job_run) glue:BatchStopJobRun *
CreateClassifier (create_classifier) glue:CreateClassifier *
CreateConnection (create_connection) glue:CreateConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
CreateCrawler (create_crawler) glue:CreateCrawler arn:aws:glue:region:account-id:crawler/crawler-name

或者

arn:aws:glue:region:account-id:crawler/*
aws:RequestTag
CreateDatabase (create_database) glue:CreateDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateDevEndpoint (create_dev_endpoint) glue:CreateDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

或者

arn:aws:glue:region:account-id:devEndpoint/*
aws:RequestTag
CreateJob (create_job) glue:CreateJob arn:aws:glue:region:account-id:job/job-name

或者

arn:aws:glue:region:account-id:job/*
aws:RequestTag
CreatePartition (create_partition) glue:CreatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateScript (create_script) glue:CreateScript *
CreateSecurityConfiguration (create_security_configuration) glue:CreateSecurityConfiguration *
CreateTable (create_table) glue:CreateTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
CreateTrigger (create_trigger) glue:CreateTrigger arn:aws:glue:region:account-id:trigger/trigger-name

或者

arn:aws:glue:region:account-id:trigger/*
aws:RequestTag
CreateUserDefinedFunction (create_user_defined_function) glue:CreateUserDefinedFunction >
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteClassifier (delete_classifier) glue:DeleteClassifier *
DeleteConnection (delete_connection) glue:DeleteConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
DeleteCrawler (delete_crawler) glue:DeleteCrawler arn:aws:glue:region:account-id:crawler/crawler-name

或者

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
DeleteDatabase (delete_database) glue:DeleteDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:userDefinedFunction/database-name/* arn:aws:glue:region:account-id:table/database-name/* arn:aws:glue:region:account-id:catalog
DeleteDevEndpoint (delete_dev_endpoint) glue:DeleteDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

或者

arn:aws:glue:region:account-id:devEndpoint/*
glue:resourceTag
DeleteJob (delete_job) glue:DeleteJob arn:aws:glue:region:account-id:job/job-name

或者

arn:aws:glue:region:account-id:job/*
glue:resourceTag
DeletePartition (delete_partition) glue:DeletePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteResourcePolicy (delete_resource_policy) glue:DeleteResourcePolicy *
DeleteSecurityConfiguration (delete_security_configuration) glue:DeleteSecurityConfiguration *
DeleteTable (delete_table) glue:DeleteTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteTableVersion (delete_table_version) glue:DeleteTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
DeleteTrigger (delete_trigger) glue:DeleteTrigger arn:aws:glue:region:account-id:trigger/trigger-name

或者

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
DeleteUserDefinedFunction (delete_user_defined_function) glue:DeleteUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetCatalogImportStatus (get_catalog_import_status) glue:GetCatalogImportStatus
arn:aws:glue:region:account-id:catalog
GetClassifier (get_classifier) glue:GetClassifier *
GetClassifiers (get_classifiers) glue:GetClassifiers *
GetConnection (get_connection) glue:GetConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
GetConnections (get_connections) glue:GetConnections
arn:aws:glue:region:account-id:connection/connection-names arn:aws:glue:region:account-id:catalog
GetCrawler (get_crawler) glue:GetCrawler arn:aws:glue:region:account-id:crawler/crawler-name

或者

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
GetCrawlerMetrics (get_crawler_metrics) glue:GetCrawlerMetrics *
GetCrawlers (get_crawlers) glue:GetCrawlers *
GetDatabase (get_database) glue:GetDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetDatabases (get_databases) glue:GetDatabases
arn:aws:glue:region:account-id:database/database-names arn:aws:glue:region:account-id:catalog
GetDataCatalogEncryptionSettings (get_data_catalog_encryption_settings) glue:GetDataCatalogEncryptionSettings *
GetDataflowGraph (get_dataflow_graph) glue:GetDataflowGraph *
GetDevEndpoint (get_dev_endpoint) glue:GetDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

或者

arn:aws:glue:region:account-id:devEndpoint/*
glue:resourceTag
GetDevEndpoints (get_dev_endpoints) glue:GetDevEndpoints *
GetJob (get_job) glue:GetJob arn:aws:glue:region:account-id:job/job-name

或者

arn:aws:glue:region:account-id:job/*
glue:resourceTag
GetJobRun (get_job_run) glue:GetJobRun *
GetJobRuns (get_job_runs) glue:GetJobRuns *
GetJobs (get_jobs) glue:GetJobs *
GetMapping (get_mapping) glue:GetMapping *
GetPartition (get_partition) glue:GetPartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetPartitions (get_partitions) glue:GetPartitions
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetPlan (get_plan) glue:GetPlan *
GetResourcePolicy (get_resource_policy) glue:GetResourcePolicy *
GetSecurityConfiguration (get_security_configuration) glue:GetSecurityConfiguration *
GetSecurityConfigurations (get_security_configurations) glue:GetSecurityConfigurations *
GetTable (get_table) glue:GetTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTables (get_tables) glue:GetTables
arn:aws:glue:region:account-id:table/database-name/table-names arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTableVersion (get_table_version) glue:GetTableVersion
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTableVersions (get_table_versions) glue:GetTableVersions
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetTags (get_tags) glue:GetTags *
GetTrigger (get_trigger) glue:GetTrigger arn:aws:glue:region:account-id:trigger/trigger-name

或者

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
GetTriggers (get_triggers) glue:GetTriggers *
GetUserDefinedFunction (get_user_defined_function) glue:GetUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
GetUserDefinedFunctions (get_user_defined_functions) glue:GetUserDefinedFunctions
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-names arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
ImportCatalogToGlue (import_catalog_to_glue) glue:ImportCatalogToGlue
arn:aws:glue:region:account-id:catalog
ListCrawlers (list_crawlers) glue:ListCrawlers *
ListDevEndpoints (list_dev_endpoints) glue:ListDevEndpoints *
ListJobs (list_jobs) glue:ListJobs *
ListTriggers (list_triggers) glue:ListTriggers *
PutResourcePolicy (put_resource_policy) glue:PutResourcePolicy *
PutDataCatalogEncryptionSettings (put_data_catalog_encryption_settings) glue:PutDataCatalogEncryptionSettings *
ResetJobBookmark (reset_job_bookmark) glue:ResetJobBookmark *
StartCrawler (start_crawler) glue:StartCrawler arn:aws:glue:region:account-id:crawler/crawler-name

或者

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
StartCrawlerSchedule (start_crawler_schedule) glue:StartCrawlerSchedule *
StartJobRun (start_job_run) glue:StartJobRun *
StartTrigger (start_trigger) glue:StartTrigger arn:aws:glue:region:account-id:trigger/trigger-name

或者

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
StopCrawler (stop_crawler) glue:StopCrawler arn:aws:glue:region:account-id:crawler/crawler-name

或者

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
StopCrawlerSchedule (stop_crawler_schedule) glue:StopCrawlerSchedule *
StopTrigger (stop_trigger) glue:StopTrigger arn:aws:glue:region:account-id:trigger/trigger-name

或者

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
TagResource (tag_resource) glue:TagResource * aws:RequestTag
UntagResource (untag_resource) glue:UntagResource * aws:TagKeys
UpdateClassifier (update_classifier) glue:UpdateClassifier *
UpdateConnection (update_connection) glue:UpdateConnection
arn:aws:glue:region:account-id:connection/connection-name arn:aws:glue:region:account-id:catalog
UpdateCrawler (update_crawler) glue:UpdateCrawler arn:aws:glue:region:account-id:crawler/crawler-name

或者

arn:aws:glue:region:account-id:crawler/*
glue:resourceTag
UpdateCrawlerSchedule (update_crawler_schedule) glue:UpdateCrawlerSchedule *
UpdateDatabase (update_database) glue:UpdateDatabase
arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateDevEndpoint (update_dev_endpoint) glue:UpdateDevEndpoint arn:aws:glue:region:account-id:devEndpoint/development-endpoint-name

或者

arn:aws:glue:region:account-id:devEndpoint/*
glue:resourceTag
UpdateJob (update_job) glue:UpdateJob arn:aws:glue:region:account-id:job/job-name

或者

arn:aws:glue:region:account-id:job/*
glue:resourceTag
UpdatePartition (update_partition) glue:UpdatePartition
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateTable (update_table) glue:UpdateTable
arn:aws:glue:region:account-id:table/database-name/table-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog
UpdateTrigger (update_trigger) glue:UpdateTrigger arn:aws:glue:region:account-id:trigger/trigger-name

或者

arn:aws:glue:region:account-id:trigger/*
glue:resourceTag
UpdateUserDefinedFunction (update_user_defined_function) glue:UpdateUserDefinedFunction
arn:aws:glue:region:account-id:userDefinedFunction/database-name/user-defined-function-name arn:aws:glue:region:account-id:database/database-name arn:aws:glue:region:account-id:catalog