创建和管理 EMR Studio 的管理员权限

为 EMR Studio 创建具有管理员权限的策略

1. 按照创建IAM策略中的说明使用以下示例之一创建策略。您需要的权限取决于您的 EMRStudio 身份验证模式。

   为这些项插入您自己的值：

   • Replace（替换） <your-resource->ARN 为您的用例指定声明涵盖的一个或多个对象的 Amazon 资源名称 (ARN)。

   • Replace（替换） <region> 附上你计划在 AWS 区域 哪里创建 Studio 的代码。

   • Replace（替换） <aws-account_id> 使用工作室 AWS 账户的 ID。

   • Replace（替换） <EMRStudio-Service-Role> 以及 <EMRStudio-User-Role> 包含您的 EMRStudio 服务角色和 EMR St udio 用户角色的名称。

   例 策略示例：使用IAM身份验证模式时的管理员权限

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Resource": "arn:aws:elasticmapreduce:<region>:<aws-account-id>:studio/*",
               "Action": [
                   "elasticmapreduce:CreateStudio",
                   "elasticmapreduce:DescribeStudio",
                   "elasticmapreduce:DeleteStudio"
               ]
           },
           {
               "Effect": "Allow",
               "Resource": "<your-resource-ARN>",
               "Action": [
                   "elasticmapreduce:ListStudios"
               ]
           },
           {
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:iam::<aws-account-id>:role/<EMRStudio-Service-Role>"
               ],
               "Action": "iam:PassRole"
           }
       ]
   }

   例 策略示例：使用IAM身份中心身份验证模式时的管理员权限

   注意

   Identity Center 和 Identity Center 目录APIs不支持ARN在IAM策略声明的资源元素中指定。为了允许访问IAM身份中心和IAM身份中心目录，以下权限为IAM身份中心操作指定了所有资源，即 “资源”: “*”。有关更多信息，请参阅 Identity C enter Director IAM y 的操作、资源和条件键。

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Resource": "arn:aws:elasticmapreduce:<region>:<aws-account-id>:studio/*",
               "Action": [
                   "elasticmapreduce:CreateStudio",
                   "elasticmapreduce:DescribeStudio",
                   "elasticmapreduce:DeleteStudio",
                   "elasticmapreduce:CreateStudioSessionMapping",
                   "elasticmapreduce:GetStudioSessionMapping",
                   "elasticmapreduce:UpdateStudioSessionMapping",
                   "elasticmapreduce:DeleteStudioSessionMapping"
               ]
           },
           {
               "Effect": "Allow",
               "Resource": "<your-resource-ARN>",
               "Action": [
                   "elasticmapreduce:ListStudios",
                   "elasticmapreduce:ListStudioSessionMappings"
               ]
           },
           {
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:iam::<aws-account-id>:role/<EMRStudio-Service-Role>",
                   "arn:aws:iam::<aws-account-id>:role/<EMRStudio-User-Role>"
               ],
               "Action": "iam:PassRole"
           },
           {
               "Effect": "Allow",
               "Resource": "*",
               "Action": [
                   "sso:CreateApplication", 
                   "sso:PutApplicationAuthenticationMethod", 
                   "sso:PutApplicationGrant", 
                   "sso:PutApplicationAccessScope",
                   "sso:PutApplicationAssignmentConfiguration",
                   "sso:DescribeApplication", 
                   "sso:DeleteApplication", 
                   "sso:DeleteApplicationAuthenticationMethod", 
                   "sso:DeleteApplicationAccessScope", 
                   "sso:DeleteApplicationGrant", 
                   "sso:ListInstances", 
                   "sso:CreateApplicationAssignment", 
                   "sso:DeleteApplicationAssignment",
                   "sso:ListApplicationAssignments", 
                   "sso:DescribeInstance",
                   "sso:AssociateProfile",
                   "sso:DisassociateProfile",
                   "sso:GetProfile",
                   "sso:ListDirectoryAssociations",
                   "sso:ListProfiles",
                   "sso-directory:SearchUsers",
                   "sso-directory:SearchGroups",
                   "sso-directory:DescribeUser",
                   "sso-directory:DescribeGroup",
                   "organizations:DescribeOrganization",
                   "organizations:ListDelegatedAdministrators",
                   "sso:CreateInstance",
                   "sso:DescribeRegisteredRegions",
                   "sso:GetSharedSsoConfiguration",
                   "iam:ListPolicies"
               ]
           }
       ]
   }

2. 将策略附加到您的IAM身份（用户、角色或群组）。有关说明，请参阅添加和删除IAM身份权限。