기계 번역으로 제공되는 번역입니다. 제공된 번역과 원본 영어의 내용이 상충하는 경우에는 영어 버전이 우선합니다.
# AmazonDataZoneRedshiftGlueProvisioningPolicy
**설명**: Amazon DataZone은 데이터를 카탈로깅, 검색, 관리, 공유, 분석할 수 있는 데이터 관리 서비스입니다. Amazon DataZone을 사용하면 계정 및 지원되는 리전 전체에 걸쳐 데이터를 공유하고 액세스할 수 있습니다. Amazon DataZone은 Amazon Redshift, Amazon Athena, AWS Glue, AWS Lake Formation을 포함하되 이에 국한되지 않는 AWS 서비스 전반의 경험을 간소화합니다.
`AmazonDataZoneRedshiftGlueProvisioningPolicy`은(는) [AWS 관리형 정책](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)입니다.
## 이 정책 사용
사용자, 그룹 및 역할에 `AmazonDataZoneRedshiftGlueProvisioningPolicy`를 연결할 수 있습니다.
## 정책 세부 정보
+ **Type**: AWS managed 정책
+ **생성 시간**: 2023년 9월 22일, 20:19 UTC
+ **편집된 시간:** 2024년 10월 23일, 18:29 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AmazonDataZoneRedshiftGlueProvisioningPolicy`
## 정책 버전
**정책 버전:** v4(기본값)
정책의 기본 버전은 정책에 대한 권한을 정의하는 버전입니다. 정책이 있는 사용자 또는 역할이 AWS 리소스에 대한 액세스를 요청하면는 정책의 기본 버전을 AWS 확인하여 요청을 허용할지 여부를 결정합니다.
## JSON 정책 문서
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "AmazonDataZonePermissionsToCreateEnvironmentRole",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole",
"iam:DetachRolePolicy",
"iam:DeleteRolePolicy",
"iam:AttachRolePolicy",
"iam:PutRolePolicy"
],
"Resource" : "arn:aws:iam::*:role/datazone*",
"Condition" : {
"StringEquals" : {
"iam:PermissionsBoundary" : "arn:aws:iam::aws:policy/AmazonDataZoneEnvironmentRolePermissionsBoundary",
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "IamPassRolePermissions",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : [
"arn:aws:iam::*:role/datazone*"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"glue.amazonaws.com",
"lakeformation.amazonaws.com"
],
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZonePermissionsToManageCreatedEnvironmentRole",
"Effect" : "Allow",
"Action" : [
"iam:DeleteRole",
"iam:GetRole"
],
"Resource" : "arn:aws:iam::*:role/datazone*",
"Condition" : {
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneCFStackCreationForEnvironments",
"Effect" : "Allow",
"Action" : [
"cloudformation:CreateStack",
"cloudformation:TagResource"
],
"Resource" : [
"arn:aws:cloudformation:*:*:stack/DataZone*"
],
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : "AmazonDataZoneEnvironment"
},
"Null" : {
"aws:ResourceTag/AmazonDataZoneEnvironment" : "false"
}
}
},
{
"Sid" : "AmazonDataZoneCFStackManagementForEnvironments",
"Effect" : "Allow",
"Action" : [
"cloudformation:DeleteStack",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents"
],
"Resource" : [
"arn:aws:cloudformation:*:*:stack/DataZone*"
]
},
{
"Sid" : "AmazonDataZoneEnvironmentParameterValidation",
"Effect" : "Allow",
"Action" : [
"lakeformation:GetDataLakeSettings",
"lakeformation:PutDataLakeSettings",
"lakeformation:RevokePermissions",
"lakeformation:ListPermissions",
"glue:CreateDatabase",
"glue:GetDatabase",
"athena:GetWorkGroup",
"logs:DescribeLogGroups",
"redshift-serverless:GetNamespace",
"redshift-serverless:GetWorkgroup",
"redshift:DescribeClusters",
"secretsmanager:ListSecrets"
],
"Resource" : "*"
},
{
"Sid" : "AmazonDataZoneEnvironmentLakeFormationPermissions",
"Effect" : "Allow",
"Action" : [
"lakeformation:RegisterResource",
"lakeformation:DeregisterResource",
"lakeformation:GrantPermissions",
"lakeformation:ListResources"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneEnvironmentGlueDeletePermissions",
"Effect" : "Allow",
"Action" : [
"glue:DeleteDatabase"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneEnvironmentAthenaDeletePermissions",
"Effect" : "Allow",
"Action" : [
"athena:DeleteWorkGroup"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneEnvironmentAthenaResourceCreation",
"Effect" : "Allow",
"Action" : [
"athena:CreateWorkGroup",
"athena:TagResource",
"iam:TagRole",
"iam:TagPolicy",
"logs:TagLogGroup"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : "AmazonDataZoneEnvironment"
},
"Null" : {
"aws:ResourceTag/AmazonDataZoneEnvironment" : "false"
},
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneEnvironmentLogGroupCreation",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:DeleteLogGroup"
],
"Resource" : "arn:aws:logs:*:*:log-group:datazone-*",
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : "AmazonDataZoneEnvironment"
},
"Null" : {
"aws:ResourceTag/AmazonDataZoneEnvironment" : "false"
},
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneEnvironmentLogGroupManagement",
"Action" : [
"logs:PutRetentionPolicy"
],
"Resource" : "arn:aws:logs:*:*:log-group:datazone-*",
"Effect" : "Allow",
"Condition" : {
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneEnvironmentIAMPolicyManagement",
"Effect" : "Allow",
"Action" : [
"iam:DeletePolicy",
"iam:CreatePolicy",
"iam:GetPolicy",
"iam:ListPolicyVersions",
"iam:DeletePolicyVersion"
],
"Resource" : [
"arn:aws:iam::*:policy/datazone*"
],
"Condition" : {
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "AmazonDataZoneEnvironmentS3ValidationPermissions",
"Effect" : "Allow",
"Action" : [
"s3:ListAllMyBuckets",
"s3:ListBucket"
],
"Resource" : "arn:aws:s3:::*"
},
{
"Sid" : "AmazonDataZoneEnvironmentKMSDecryptPermissions",
"Effect" : "Allow",
"Action" : [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AmazonDataZoneEnvironment" : "false"
}
}
},
{
"Sid" : "PermissionsToTagAmazonDataZoneEnvironmentGlueResources",
"Effect" : "Allow",
"Action" : [
"glue:TagResource"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringLike" : {
"aws:TagKeys" : "AmazonDataZoneEnvironment"
},
"Null" : {
"aws:RequestTag/AmazonDataZoneEnvironment" : "false"
}
}
},
{
"Sid" : "PermissionsToGetAmazonDataZoneEnvironmentBlueprintTemplates",
"Effect" : "Allow",
"Action" : "s3:GetObject",
"Resource" : "*",
"Condition" : {
"StringNotEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"StringEquals" : {
"aws:CalledViaFirst" : [
"cloudformation.amazonaws.com"
]
}
}
},
{
"Sid" : "RedshiftDataPermissions",
"Effect" : "Allow",
"Action" : [
"redshift-data:ListSchemas",
"redshift-data:ExecuteStatement"
],
"Resource" : [
"arn:aws:redshift-serverless:*:*:workgroup/*",
"arn:aws:redshift:*:*:cluster:*"
]
},
{
"Sid" : "DescribeStatementPermissions",
"Effect" : "Allow",
"Action" : [
"redshift-data:DescribeStatement"
],
"Resource" : "*"
},
{
"Sid" : "GetSecretValuePermissions",
"Effect" : "Allow",
"Action" : [
"secretsmanager:GetSecretValue"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"secretsmanager:ResourceTag/AmazonDataZoneDomain" : "dzd*"
}
}
}
]
}
```
## 자세히 알아보기
+ [IAM Identity Center에서 AWS 관리형 정책을 사용하여 권한 세트 생성](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [IAM 자격 증명 권한 추가 및 제거](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [IAM 정책의 버전 관리 이해](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [AWS 관리형 정책 시작하기 및 최소 권한으로 이동](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)