Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅
中国的 Amazon Web Services 服务入门
(PDF)。
本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
亚马逊 Athena 的 IAM 政策
以下示例模板展示了如何根据状态机定义中的资源 Amazon Step Functions 生成 IAM 策略。有关更多信息，请参阅 集成服务的 IAM 策略 和 服务集成模式。
StartQueryExecution
静态资源
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:stopQueryExecution",
"athena:getQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
- Request Response
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/[[workGroup]]",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
动态资源
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:stopQueryExecution",
"athena:getQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
- Request Response
-
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:startQueryExecution",
"athena:getDataCatalog"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*",
"arn:aws:athena:{{region}}:{{accountId}}:datacatalog/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:CreateBucket",
"s3:PutObject"
],
"Resource": [
"arn:aws:s3:::*"
]
},
{
"Effect": "Allow",
"Action": [
"glue:CreateDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:DeleteDatabase",
"glue:CreateTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"glue:DeletePartition",
"glue:BatchDeletePartition"
],
"Resource": [
"arn:aws:glue:{{region}}:{{accountId}}:catalog",
"arn:aws:glue:{{region}}:{{accountId}}:database/*",
"arn:aws:glue:{{region}}:{{accountId}}:table/*",
"arn:aws:glue:{{region}}:{{accountId}}:userDefinedFunction/*"
]
},
{
"Effect": "Allow",
"Action": [
"lakeformation:GetDataAccess"
],
"Resource": [
"*"
]
}
]
}
StopQueryExecution
资源
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:stopQueryExecution"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
}
]
}
GetQueryExecution
资源
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:getQueryExecution"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
}
]
}
GetQueryResults
资源
{
"Version": "2012-10-17",
"Statement":[
{
"Effect": "Allow",
"Action": [
"athena:getQueryResults"
],
"Resource": [
"arn:aws:athena:{{region}}:{{accountId}}:workgroup/*"
]
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::*"
]
}
]
}