Amazon 的 IAM 政策示例 QuickSight - 亚马逊 QuickSight
基于身份的策略
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

重要：我们已经重新设计了 Amazon QuickSight 分析工作空间。您可能会遇到无法反映 QuickSight 控制台新外观的屏幕截图或程序化文本。我们正在更新屏幕截图和过程文本。

要查找特征或项目，请使用快速搜索栏。

有关新外观 QuickSight的更多信息，请参阅在 Amazon 上引入全新的分析体验 QuickSight。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

Amazon 的 IAM 政策示例 QuickSight

本节提供了您可以在 Amazon 上使用的 IAM 政策的示例 QuickSight。

适用于亚马逊的 IAM 基于身份的政策 QuickSight

本节显示了适用于Amazon的基于身份的政策的示例。 QuickSight

用于 IAM 控制台管理的 QuickSight IAM 基于身份的策略

以下示例显示了 IAM 控制台管理操作所需 QuickSight 的 IAM 权限。

{
   "Statement": [
       {
           "Sid": "Statement1",
           "Effect": "Allow",
           "Action": [
               "quicksight:*",
               "iam:AttachRolePolicy",
               "iam:DetachRolePolicy",
               "iam:ListAttachedRolePolicies",
               "iam:GetPolicy",
               "iam:CreatePolicyVersion",
               "iam:DeletePolicyVersion",
               "iam:GetPolicyVersion",
               "iam:ListPolicyVersions",
               "iam:DeleteRole",
               "iam:CreateRole",
               "iam:GetRole",
               "iam:ListRoles",
               "iam:CreatePolicy",
               "iam:ListEntitiesForPolicy",
               "iam:listPolicies",
               "s3:ListAllMyBuckets",
               "athena:ListDataCatalogs",
               "athena:GetDataCatalog"
           ],
           "Resource": [
               "*"
           ]
       }
}

适用于 Ama QuickSight zon 的 IAM 基于身份的政策：控制面板

下面是一个 IAM policy 示例，它为特定控制面板允许控制面板共享和嵌入。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "quicksight:RegisterUser",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "quicksight:GetDashboardEmbedUrl",
            "Resource": "arn:aws:quicksight:us-west-2:111122223333:dashboard/1a1ac2b2-3fc3-4b44-5e5d-c6db6778df89",
            "Effect": "Allow"
        }
    ]
}

适用于 Ama QuickSight zon 的 IAM 基于身份的政策：命名空间

以下示例显示了允许 QuickSight 管理员创建或删除命名空间的 IAM 策略。

创建命名空间

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "ds:DescribeDirectories",
                "quicksight:CreateNamespace"
            ],
            "Resource": "*"
        }
    ]
}

删除命名空间

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:UnauthorizeApplication",
                "ds:DeleteDirectory",
                "ds:DescribeDirectories",
                "quicksight:DeleteNamespace"
            ],
            "Resource": "*"
        }
    ]
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：自定义权限

以下示例显示了允许 QuickSight 管理员或开发人员管理自定义权限的 IAM 策略。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:*CustomPermissions"
            ],
            "Resource": "*"
        }
    ]
}

以下示例显示了另一种授予与上一个示例中所示相同权限的方法。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:CreateCustomPermissions",
                "quicksight:DescribeCustomPermissions",
                "quicksight:ListCustomPermissions",
                "quicksight:UpdateCustomPermissions",
                "quicksight:DeleteCustomPermissions"
 
            ],
            "Resource": "*"
        }
    ]
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：自定义电子邮件报告模板

以下示例显示了一项策略，该策略允许在中查看、更新和创建电子邮件报告模板 QuickSight，以及获取 Amazon Simple Email Service 身份的验证属性。此策略允许 QuickSight 管理员创建和更新自定义电子邮件报告模板，并确认他们想要发送电子邮件报告的任何自定义电子邮件地址都是 SES 中经过验证的身份。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight: DescribeAccountCustomization",
                "quicksight: CreateAccountCustomization",
                "quicksight: UpdateAccountCustomization",
                "quicksight: DescribeEmailCustomizationTemplate",
                "quicksight: CreateEmailCustomizationTemplate",
                "quicksight: UpdateEmailCustomizationTemplate",
                "ses: GetIdentityVerificationAttributes"
            ],
            "Resource": "*"
        }
    ]
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：创建用户

以下示例显示了仅允许创建 Amazon QuickSight 用户的策略。对于 quicksight:CreateReader、quicksight:CreateUser 和 quicksight:CreateAdmin，您可以限制 "Resource": "arn:aws:quicksight::<YOUR_AWS_ACCOUNTID>:user/${aws:userid}" 权限。有关本指南中所述的所有其他权限，请使用 "Resource": "*"。您指定的资源将权限范围限制为指定的资源。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "quicksight:CreateUser"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:quicksight::<YOUR_AWS_ACCOUNTID>:user/${aws:userid}"
        }
    ]
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：创建和管理群组

以下示例显示了一个允许 QuickSight 管理员和开发人员创建和管理群组的策略。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "quicksight:ListGroups",
                "quicksight:CreateGroup",
                "quicksight:SearchGroups",
                "quicksight:ListGroupMemberships",
                "quicksight:CreateGroupMembership",
                "quicksight:DeleteGroupMembership",
                "quicksight:DescribeGroupMembership",
                "quicksight:ListUsers"
            ],
            "Resource": "*"
        }
    ]
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：标准版的所有访问权限

以下 Amazon QuickSight 标准版示例显示了允许订阅和创建作者和读者的策略。此示例明确拒绝亚马逊 QuickSight取消订阅的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:CheckAlias",
                "ds:CreateAlias",
                "ds:DescribeDirectories",
                "ds:DescribeTrusts",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "iam:ListAccountAliases",
                "quicksight:CreateUser",
                "quicksight:Subscribe"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": 
                "quicksight:Unsubscribe",
            "Resource": "*"
        }
    ]
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：带有 IAM 身份中心的企业版的所有访问权限

以下 Amazon E QuickSight nterprise 版示例显示了一项策略，该策略允许在与 IAM 身份中心集成的 QuickSight 账户中订阅、创建用户和管理 Active Directory。此示例明确拒绝亚马逊 QuickSight取消订阅的权限。

{
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "quicksight:*",
                "iam:AttachRolePolicy",
                "iam:DetachRolePolicy",
                "iam:ListAttachedRolePolicies",
                "iam:GetPolicy",
                "iam:CreatePolicyVersion",
                "iam:DeletePolicyVersion",
                "iam:GetPolicyVersion",
                "iam:ListPolicyVersions",
                "iam:DeleteRole",
                "iam:CreateRole",
                "iam:GetRole",
                "iam:ListRoles",
                "iam:CreatePolicy",
                "iam:ListEntitiesForPolicy",
                "iam:listPolicies",
                "s3:ListAllMyBuckets",
                "athena:ListDataCatalogs",
                "athena:GetDataCatalog",
                "sso:GetManagedApplicationInstance" ,
                "sso:CreateManagedApplicationInstance",
                "sso:GetManagedApplicationInstance",
                "sso:DeleteManagedApplicationInstance",
                "sso:GetManagedApplicationInstance",
                "sso:DescribeGroup",
                "sso:SearchGroups",
                "sso:GetProfile",
                "sso:AssociateProfile", 
                "sso:DisassociateProfile", 
                "sso:ListProfiles", 
                "sso:ListDirectoryAssociations", 
                "sso:DescribeRegisteredRegions" 
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

适用于亚马逊的 IAM 基于身份的政策 QuickSight：带活动目录的企业版的所有访问权限

以下 Amazon E QuickSight nterprise 版示例显示了一项策略，该策略允许在使用 Active Directory 进行身份管理的 QuickSight 账户中订阅、创建用户和管理活动目录。此示例明确拒绝亚马逊 QuickSight取消订阅的权限。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ds:AuthorizeApplication",
                "ds:UnauthorizeApplication",
                "ds:CheckAlias",
                "ds:CreateAlias",
                "ds:DescribeDirectories",
                "ds:DescribeTrusts",
                "ds:DeleteDirectory",
                "ds:CreateIdentityPoolDirectory",
                "iam:ListAccountAliases",
                "quicksight:CreateAdmin",
                "quicksight:Subscribe",
                "quicksight:GetGroupMapping",
                "quicksight:SearchDirectoryGroups",
                "quicksight:SetGroupMapping"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "quicksight:Unsubscribe",
            "Resource": "*"
        }
    ]
}

适用于亚马逊的 IAM 基于身份的政策 QuickSight：活动目录组

以下示例显示了一个 IAM 策略，该策略允许对亚马逊 QuickSight 企业版账户进行活动目录群组管理。

{
    "Statement": [
        {
            "Action": [
                "ds:DescribeTrusts",
                "quicksight:GetGroupMapping",
                "quicksight:SearchDirectoryGroups",
                "quicksight:SetGroupMapping"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：使用管理员资产管理控制台

以下示例显示了允许访问管理员资产管理控制台的 IAM policy。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [          
                "quicksight:SearchGroups",
                "quicksight:SearchUsers",              
                "quicksight:ListNamespaces",            
                "quicksight:DescribeAnalysisPermissions",
                "quicksight:DescribeDashboardPermissions",
                "quicksight:DescribeDataSetPermissions",
                "quicksight:DescribeDataSourcePermissions",
                "quicksight:DescribeFolderPermissions",
                "quicksight:ListAnalyses",
                "quicksight:ListDashboards",
                "quicksight:ListDataSets",
                "quicksight:ListDataSources",
                "quicksight:ListFolders",
                "quicksight:SearchAnalyses",
                "quicksight:SearchDashboards",
                "quicksight:SearchFolders",
                "quicksight:SearchDatasets",
                "quicksight:SearchDatasources",               
                "quicksight:UpdateAnalysisPermissions",
                "quicksight:UpdateDashboardPermissions",
                "quicksight:UpdateDataSetPermissions",
                "quicksight:UpdateDataSourcePermissions",
                "quicksight:UpdateFolderPermissions"
            ],
            "Resource": "*"
        }
    ]
}

适用于 Amazon 的 IAM 基于身份的政策 QuickSight：使用管理员密钥管理控制台

以下示例显示了允许访问管理员密钥管理控制台的 IAM policy。

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "kms:CreateGrant",
              "kms:ListAliases",
              "kms:ListKeys",
              "quicksight:ListCustomerManagedKeys",
              "quicksight:ListKMSKeysForUser",
              "quicksight:RegisterCustomerManagedKey"
              "quicksight:RemoveCustomerManagedKey",
          ],
          "Resource": "*"
      }
  ]

Amazon 资源 Amazon QuickSight：企业版中的范围界定政策

以下 Amazon E QuickSight nterprise 版示例显示了一个策略，该策略允许设置 Amazon 资源默认访问权限和 Amazon 资源权限范围策略。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "quicksight:*IAMPolicyAssignment*",
                "quicksight:AccountConfigurations"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}