翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。 # AmazonRedshiftServiceLinkedRolePolicy **説明**: Amazon Redshift がユーザーに代わって AWS サービスを呼び出すことを許可する `AmazonRedshiftServiceLinkedRolePolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。 ## このポリシーを使用すると このポリシーは、ユーザーに代わってサービスがアクションを実行することを許可する、サービスリンクロールにアタッチされます。ユーザー、グループおよびロールにこのポリシーはアタッチできません。 ## ポリシーの詳細 + **タイプ**: サービスリンクロールポリシー + **作成日時**: 2017 年 9 月 18 日 19:19 UTC + **編集日時:** 2025 年 2 月 19 日 17:22 UTC + **ARN**: `arn:aws:iam::aws:policy/aws-service-role/AmazonRedshiftServiceLinkedRolePolicy` ## ポリシーのバージョン **ポリシーのバージョン:** v15 (デフォルト) ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。 ## JSON ポリシードキュメント ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "Ec2VpcPermissions", "Effect" : "Allow", "Action" : [ "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces", "ec2:DescribeAddresses", "ec2:AssociateAddress", "ec2:DisassociateAddress", "ec2:CreateNetworkInterface", "ec2:DeleteNetworkInterface", "ec2:ModifyNetworkInterfaceAttribute", "ec2:CreateVpcEndpoint", "ec2:DeleteVpcEndpoints", "ec2:DescribeVpcEndpoints", "ec2:ModifyVpcEndpoint" ], "Resource" : "*" }, { "Sid" : "PublicAccessCreateEip", "Effect" : "Allow", "Action" : [ "ec2:AllocateAddress" ], "Resource" : [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/Redshift" : "true" } } }, { "Sid" : "PublicAccessReleaseEip", "Effect" : "Allow", "Action" : [ "ec2:ReleaseAddress" ], "Resource" : [ "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/Redshift" : "true" } } }, { "Sid" : "EnableCreationAndManagementOfRedshiftCloudwatchLogGroups", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/redshift/*" ] }, { "Sid" : "EnableCreationAndManagementOfRedshiftCloudwatchLogStreams", "Effect" : "Allow", "Action" : [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/redshift/*:log-stream:*" ] }, { "Sid" : "CreateSecurityGroupWithTags", "Effect" : "Allow", "Action" : [ "ec2:CreateSecurityGroup" ], "Resource" : [ "arn:aws:ec2:*:*:security-group/*" ], "Condition" : { "StringEquals" : { "aws:RequestTag/Redshift" : "true" } } }, { "Sid" : "SecurityGroupPermissions", "Effect" : "Allow", "Action" : [ "ec2:AuthorizeSecurityGroupEgress", "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupEgress", "ec2:RevokeSecurityGroupIngress", "ec2:ModifySecurityGroupRules", "ec2:DeleteSecurityGroup" ], "Resource" : [ "arn:aws:ec2:*:*:security-group/*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/Redshift" : "true" } } }, { "Sid" : "CreateSecurityGroup", "Effect" : "Allow", "Action" : [ "ec2:CreateSecurityGroup" ], "Resource" : [ "arn:aws:ec2:*:*:vpc/*" ] }, { "Sid" : "CreateTagsOnResources", "Effect" : "Allow", "Action" : "ec2:CreateTags", "Resource" : [ "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:route-table/*", "arn:aws:ec2:*:*:security-group/*", "arn:aws:ec2:*:*:vpc/*", "arn:aws:ec2:*:*:internet-gateway/*", "arn:aws:ec2:*:*:elastic-ip/*" ], "Condition" : { "StringEquals" : { "ec2:CreateAction" : [ "CreateVpc", "CreateSecurityGroup", "CreateSubnet", "CreateInternetGateway", "CreateRouteTable", "AllocateAddress" ] } } }, { "Sid" : "VPCPermissions", "Effect" : "Allow", "Action" : [ "ec2:DescribeVpcAttribute", "ec2:DescribeSecurityGroups", "ec2:DescribeInternetGateways", "ec2:DescribeSecurityGroupRules", "ec2:DescribeAvailabilityZones", "ec2:DescribeNetworkAcls", "ec2:DescribeRouteTables" ], "Resource" : "*" }, { "Sid" : "CloudWatch", "Effect" : "Allow", "Action" : [ "cloudwatch:PutMetricData" ], "Resource" : "*", "Condition" : { "StringEquals" : { "cloudwatch:namespace" : [ "AWS/Redshift-Serverless", "AWS/Redshift" ] } } }, { "Sid" : "SecretManager", "Effect" : "Allow", "Action" : [ "secretsmanager:DescribeSecret", "secretsmanager:DeleteSecret", "secretsmanager:PutSecretValue", "secretsmanager:UpdateSecret", "secretsmanager:UpdateSecretVersionStage", "secretsmanager:RotateSecret" ], "Resource" : [ "arn:aws:secretsmanager:*:*:secret:redshift!*" ], "Condition" : { "StringEquals" : { "secretsmanager:ResourceTag/aws:secretsmanager:owningService" : "redshift", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "SecretsManagerRandomPassword", "Effect" : "Allow", "Action" : [ "secretsmanager:GetRandomPassword" ], "Resource" : "*" }, { "Sid" : "IPV6Permissions", "Effect" : "Allow", "Action" : [ "ec2:AssignIpv6Addresses", "ec2:UnassignIpv6Addresses" ], "Resource" : [ "arn:aws:ec2:*:*:network-interface/*" ] }, { "Sid" : "ServiceQuotasToCheckCustomerLimits", "Effect" : "Allow", "Action" : [ "servicequotas:GetServiceQuota" ], "Resource" : [ "arn:aws:servicequotas:*:*:ec2/L-0263D0A3", "arn:aws:servicequotas:*:*:vpc/L-29B6F2EB" ] }, { "Sid" : "DiscoverRedshiftCatalogs", "Effect" : "Allow", "Action" : [ "glue:GetCatalog", "glue:GetCatalogs" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ], "Condition" : { "Bool" : { "glue:EnabledForRedshiftAutoDiscovery" : "true" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "LakeFormationGetMetadataAccessForFederatedCatalogs", "Effect" : "Allow", "Action" : [ "lakeformation:GetDataAccess" ], "Resource" : [ "*" ], "Condition" : { "Bool" : { "lakeformation:EnabledOnlyForMetaDataAccess" : "true" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ForAnyValue:StringEquals" : { "aws:CalledVia" : "glue.amazonaws.com" } } } ] } ``` ## 詳細情報 + [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [AWS 管理ポリシーの使用を開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)