設定 Amazon EC2 或 Amazon EKS 的 EMR Studio 使用者許可 - Amazon EMR
建立使用者角色建立使用者許可範例使用者政策Studio 使用者的 IAM 許可

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

設定 Amazon EC2 或 Amazon EKS 的 EMR Studio 使用者許可

必須為 Amazon EMR Studio 設定使用者許可政策，才能設定精細的使用者和群組許可。有關使用者許可如何在 EMR Studio 中運作的資訊，請參閱 Amazon EMR Studio 運作方式 中的 存取控制。

注意

本章節涵蓋的許可不會強制執行資料存取控制。若要管理輸入資料集的存取權限，應該為 Studio 使用的叢集設定許可。如需詳細資訊，請參閱Amazon EMR 中的安全。

為 IAM Identity Center 身分驗證模式建立 EMR Studio 使用者角色

使用 IAM Identity Center 身分驗證模式時，必須建立 EMR Studio 使用者角色。

若要建立 EMR Studio 的使用者角色

  1. 遵循 AWS Identity and Access Management 使用者指南中建立角色以將許可委派給 AWS 服務中的指示來建立使用者角色。

    建立角色時，請使用下列信任關係政策。

    {
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "elasticmapreduce.amazonaws.com"
      },
      "Action": [
              "sts:AssumeRole",
              "sts:SetContext"
              ]
    }
  ]
}

  2. 移除預設角色許可和政策。

  3. 將使用者和群組指派給 Studio 之前，請將 EMR Studio 工作階段政策連接至使用者角色。如需有關如何建立工作階段政策的指示，請參閱 建立 EMR Studio 使用者的許可政策。

建立 EMR Studio 使用者的許可政策

如需為 EMR Studio 建立許可政策，請參閱下列各節。

注意

若要設定用於存放筆記本檔案的 Amazon S3 存取許可，以及設定在將工作區連結至 Git 儲存庫時讀取密碼所需的 AWS Secrets Manager 存取許可，請使用 EMR Studio 服務角色。

建立許可政策

建立一個或多個 IAM 許可政策，指定使用者可以在您的 Studio 中執行的動作。例如，可以使用此頁面上的範例政策，為基礎、中級和進階 Studio 使用者類型建立三個獨立的政策。

如需有關使用者可能執行的每個 Studio 操作的詳細資訊，以及執行每個操作所需的最少 IAM 動作，請參閱 AWS Identity and Access Management EMR Studio 使用者的許可。如需了解建立政策的步驟，請參閱《IAM 使用者指南》中的建立 IAM 政策。

許可政策必須包含下列陳述式。

{
            "Sid": "AllowAddingTagsOnSecretsWithEMRStudioPrefix",
            "Effect": "Allow",
            "Action": "secretsmanager:TagResource",
            "Resource": "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
},
{
            "Sid": "AllowPassingServiceRoleForWorkspaceCreation",
            "Action": "iam:PassRole",
            "Resource": [
                "arn:aws:iam::*:role/your-emr-studio-service-role"
            ],
            "Effect": "Allow"
}

設定工作區協同合作的擁有權

工作區協同合作可讓多位使用者同時在相同工作區中工作，並且可以使用工作區 UI 中的協同合作面板進行設定。若要查看和使用協同合作面板，使用者必須擁有下列許可。任何具有這些許可的使用者都可以查看和使用協同合作面板。

"elasticmapreduce:UpdateEditor",
"elasticmapreduce:PutWorkspaceAccess",
"elasticmapreduce:DeleteWorkspaceAccess",
"elasticmapreduce:ListWorkspaceAccessIdentities"

若要限制存取協同合作面板，可以使用標籤型存取控制。當使用者建立工作區時，EMR Studio 會套用具有 creatorUserId 金鑰的預設標籤，其值為建立工作區之使用者的 ID。

注意

EMR Studio 將 creatorUserId 標籤新增至 2021 年 11 月 16 日之後建立的工作區。若要限制誰可為您在此日期之前建立的工作區設定協作，建議您手動將 creatorUserId 標籤新增至您的工作區，然後在使用者許可政策中使用標籤型存取控制。

下列範例陳述式可讓使用者為具有標籤金鑰 creatorUserId 的任何工作區設定協同合作，該標籤金鑰的值與使用者 ID (由政策變數 aws:userId 表示) 進行比對。換句話說，該陳述式可讓使用者為他們所建立的工作區設定協同合作。若要進一步了解政策變數，請參閱《IAM 使用者指南》中的 IAM 政策元素：變數和標籤。

    {
        "Sid": "UserRolePermissionsForCollaboration",
        "Action": [
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
            "StringEquals": {
                "elasticmapreduce:ResourceTag/creatorUserId": "${aws:userid}"
            }
        }
    }

建立使用者層級 Git 密碼政策

使用使用者層級許可

EMR Studio 會在建立 Git 密碼時自動新增 for-use-with-amazon-emr-managed-user-policies 標籤。如果您想要在使用者層級控制 Git 密碼的存取，請使用 secretsmanager:GetSecretValue 將標籤型許可新增至 EMR Studio 使用者角色政策，如下方 從服務層級許可轉換為使用者層級許可 一節中所示。

如果您在 EMR Studio 服務角色政策中擁有 secretsmanager:GetSecretValue 的現有許可，則應移除這些許可。

從服務層級許可轉換為使用者層級許可

注意

for-use-with-amazon-emr-managed-user-policies 標籤可確保下列步驟 1 中的許可向工作區的建立者授予對 Git 密碼的存取權限。但是，如果您在 2023 年 9 月 1 日之前連結了 Git 儲存庫，則對應的 Git 密碼將會因其未套用 for-use-with-amazon-emr-managed-user-policies 標籤而遭到拒絕存取。若要套用使用者層級許可，您必須從 JupyterLab 重新建立舊密碼，然後再次連結適當的 Git 儲存庫。

如需有關政策變數的詳細資訊，請參閱《IAM 使用者指南》中的 IAM 政策元素：變數和標籤。

  1. 將下列許可新增至 EMR Studio 使用者角色政策。其會使用 for-use-with-amazon-emr-managed-user-policies 索引鍵，且值為 "${aws:userid}"。

    {
   "Sid": "AllowSecretsManagerReadOnlyActionsWithEMRTags",
    "Effect": "Allow",
    "Action": "secretsmanager:GetSecretValue",
    "Resource": "arn:aws:secretsmanager:*:*:secret:*",
    "Condition": {
        "StringEquals": {
            "secretsmanager:ResourceTag/for-use-with-amazon-emr-managed-user-policies": "${aws:userid}"
        }
    }
}

  2. 如果存在，請從 EMR Studio 服務角色政策中移除下列許可。由於服務角色政策適用於每個使用者定義的所有密碼，您只需執行此動作一次。

    {
    "Sid": "AllowSecretsManagerReadOnlyActionsWithEMRTags", 
    "Effect": "Allow", 
    "Action": [ 
        "secretsmanager:GetSecretValue" 
     ], 
    "Resource": "arn:aws:secretsmanager:*:*:secret:*", 
    "Condition": {
        "StringEquals": {
            "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" 
        } 
    } 
}

使用服務層級許可

自 2023 年 9 月 1 日起，EMR Studio 會自動新增用於使用者層級存取控制的 for-use-with-amazon-emr-managed-user-policies 標籤。因為這是一項新增功能，您可以繼續使用透過 EMR Studio 服務角色中的 GetSecretValue 許可所取得的服務層級存取權限。

對於 2023 年 9 月 1 日之前建立的密碼，EMR Studio 未新增 for-use-with-amazon-emr-managed-user-policies 標籤。若要繼續使用服務層級許可，只要保留現有的 EMR Studio 服務角色和使用者角色許可即可。不過，若要限制可以存取個別密碼的人員，建議您遵循 使用使用者層級許可 中的步驟，手動將 for-use-with-amazon-emr-managed-user-policies 標籤新增至密碼，然後在使用者許可政策中使用標籤型存取控制。

如需有關政策變數的詳細資訊，請參閱《IAM 使用者指南》中的 IAM 政策元素：變數和標籤。

將許可政策連接至 IAM 身分

下表概述了您將許可政策附接至哪個 IAM 身分，具體取決於 EMR Studio 身分驗證模式。如需有關如何附接政策的指示，請參閱新增和移除 IAM 身分許可。

如果您使用... 將政策附接至...
IAM 身分驗證 您的 IAM 身分 (使用者、使用者群組或角色)。例如，可以將許可政策附接至 AWS 帳戶的使用者。
與外部身分提供者 (IdP) 的 IAM 聯合

為外部 IdP 建立的 IAM 角色。例如，適用於 SAML 2.0 聯合的 IAM。

對於可聯合存取 Studio 的使用者，EMR Studio 會使用附接至 IAM 角色的許可。
IAM Identity Center Amazon EMR Studio 使用者角色。

範例使用者政策

下列基本使用者政策允許大部分 EMR Studio 動作，但不允許使用者建立新的 Amazon EMR 叢集。

重要

範例政策不包含 CreateStudioPresignedUrl 許可，在使用 IAM 身分驗證模式時，必須針對使用者允許該許可。如需詳細資訊，請參閱將使用者或群組指派給 EMR Studio。

範例政策包含 Condition 元素以強制執行標籤型存取控制 (TBAC)，以便您可以搭配使用該政策與 EMR Studio 的範例服務角色。如需詳細資訊，請參閱建立 EMR Studio 服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags",
         "Effect":"Allow",
         "Action":[
            "ec2:CreateSecurityGroup"
         ],
         "Resource":[
            "arn:aws:ec2:*:*:vpc/*"
         ],
         "Condition":{
            "StringEquals":{
               "aws:ResourceTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingEMRTagsDuringDefaultSecurityGroupCreation",
         "Effect":"Allow",
         "Action":[
            "ec2:CreateTags"
         ],
         "Resource":"arn:aws:ec2:*:*:security-group/*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true",
               "ec2:CreateAction":"CreateSecurityGroup"
            }
         }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      }
   ]
}

下列中級使用者政策允許大多數 EMR Studio 動作，並可讓使用者使用叢集範本建立新的 Amazon EMR 叢集。

重要

範例政策不包含 CreateStudioPresignedUrl 許可，在使用 IAM 身分驗證模式時，必須針對使用者允許該許可。如需詳細資訊，請參閱將使用者或群組指派給 EMR Studio。

範例政策包含 Condition 元素以強制執行標籤型存取控制 (TBAC)，以便您可以搭配使用該政策與 EMR Studio 的範例服務角色。如需詳細資訊，請參閱建立 EMR Studio 服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowEMRBasicActions",
         "Action":[
            "elasticmapreduce:CreateEditor",
            "elasticmapreduce:DescribeEditor",
            "elasticmapreduce:ListEditors",
            "elasticmapreduce:StartEditor",
            "elasticmapreduce:StopEditor",
            "elasticmapreduce:DeleteEditor",
            "elasticmapreduce:OpenEditorInConsole",
            "elasticmapreduce:AttachEditor",
            "elasticmapreduce:DetachEditor",
            "elasticmapreduce:CreateRepository",
            "elasticmapreduce:DescribeRepository",
            "elasticmapreduce:DeleteRepository",
            "elasticmapreduce:ListRepositories",
            "elasticmapreduce:LinkRepository",
            "elasticmapreduce:UnlinkRepository",
            "elasticmapreduce:DescribeCluster",
            "elasticmapreduce:ListInstanceGroups",
            "elasticmapreduce:ListBootstrapActions",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:ListSteps",
            "elasticmapreduce:CreatePersistentAppUI",
            "elasticmapreduce:DescribePersistentAppUI",
            "elasticmapreduce:GetPersistentAppUIPresignedURL",
            "elasticmapreduce:GetOnClusterAppUIPresignedURL"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRContainersBasicActions",
         "Action":[
            "emr-containers:DescribeVirtualCluster",
            "emr-containers:ListVirtualClusters",
            "emr-containers:DescribeManagedEndpoint",
            "emr-containers:ListManagedEndpoints",
            "emr-containers:DescribeJobRun",
            "emr-containers:ListJobRuns"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
          "Sid": "AllowRetrievingManagedEndpointCredentials",
          "Effect": "Allow",
          "Action": [
              "emr-containers:GetManagedEndpointSessionCredentials"
          ],
          "Resource": [
              "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>"
          ],
          "Condition": {
              "StringEquals": {
                  "emr-containers:ExecutionRoleArn": [
                      "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>"
                  ]
              }
          }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowClusterTemplateRelatedIntermediateActions",
         "Action":[
            "servicecatalog:DescribeProduct",
            "servicecatalog:DescribeProductView",
            "servicecatalog:DescribeProvisioningParameters",
            "servicecatalog:ProvisionProduct",
            "servicecatalog:SearchProducts",
            "servicecatalog:UpdateProvisionedProduct",
            "servicecatalog:ListProvisioningArtifacts",
            "servicecatalog:ListLaunchPaths",
            "servicecatalog:DescribeRecord",
            "cloudformation:DescribeStackResources"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      },
      {
         "Sid": "AllowServerlessActions",
         "Action": [
            "emr-serverless:CreateApplication",
            "emr-serverless:UpdateApplication",
            "emr-serverless:DeleteApplication",
            "emr-serverless:ListApplications",
            "emr-serverless:GetApplication",
            "emr-serverless:StartApplication",
            "emr-serverless:StopApplication",
            "emr-serverless:StartJobRun",
            "emr-serverless:CancelJobRun",
            "emr-serverless:ListJobRuns",
            "emr-serverless:GetJobRun",
            "emr-serverless:GetDashboardForJobRun",
            "emr-serverless:AccessInteractiveEndpoints"
         ],
         "Resource": "*",
         "Effect": "Allow"
        },
        {
           "Sid": "AllowPassingRuntimeRoleForRunningServerlessJob",
           "Action": "iam:PassRole",
           "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
           "Effect": "Allow"
        }
   ]
}

下列進階使用者政策允許所有 EMR Studio 動作，並允許使用者使用叢集範本或透過提供叢集組態來建立新的 Amazon EMR 叢集。

重要

範例政策不包含 CreateStudioPresignedUrl 許可，在使用 IAM 身分驗證模式時，必須針對使用者允許該許可。如需詳細資訊，請參閱將使用者或群組指派給 EMR Studio。

範例政策包含 Condition 元素以強制執行標籤型存取控制 (TBAC)，以便您可以搭配使用該政策與 EMR Studio 的範例服務角色。如需詳細資訊，請參閱建立 EMR Studio 服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowEMRBasicActions",
         "Action":[
            "elasticmapreduce:CreateEditor",
            "elasticmapreduce:DescribeEditor",
            "elasticmapreduce:ListEditors",
            "elasticmapreduce:StartEditor",
            "elasticmapreduce:StopEditor",
            "elasticmapreduce:DeleteEditor",
            "elasticmapreduce:OpenEditorInConsole",
            "elasticmapreduce:AttachEditor",
            "elasticmapreduce:DetachEditor",
            "elasticmapreduce:CreateRepository",
            "elasticmapreduce:DescribeRepository",
            "elasticmapreduce:DeleteRepository",
            "elasticmapreduce:ListRepositories",
            "elasticmapreduce:LinkRepository",
            "elasticmapreduce:UnlinkRepository",
            "elasticmapreduce:DescribeCluster",
            "elasticmapreduce:ListInstanceGroups",
            "elasticmapreduce:ListBootstrapActions",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:ListSteps",
            "elasticmapreduce:CreatePersistentAppUI",
            "elasticmapreduce:DescribePersistentAppUI",
            "elasticmapreduce:GetPersistentAppUIPresignedURL",
            "elasticmapreduce:GetOnClusterAppUIPresignedURL"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRContainersBasicActions",
         "Action":[
            "emr-containers:DescribeVirtualCluster",
            "emr-containers:ListVirtualClusters",
            "emr-containers:DescribeManagedEndpoint",
            "emr-containers:ListManagedEndpoints",
            "emr-containers:DescribeJobRun",
            "emr-containers:ListJobRuns"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
          "Sid": "AllowRetrievingManagedEndpointCredentials",
          "Effect": "Allow",
          "Action": [
              "emr-containers:GetManagedEndpointSessionCredentials"
          ],
          "Resource": [
              "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>"
          ],
          "Condition": {
              "StringEquals": {
                  "emr-containers:ExecutionRoleArn": [
                      "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>"
                  ]
              }
          }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowClusterTemplateRelatedIntermediateActions",
         "Action":[
            "servicecatalog:DescribeProduct",
            "servicecatalog:DescribeProductView",
            "servicecatalog:DescribeProvisioningParameters",
            "servicecatalog:ProvisionProduct",
            "servicecatalog:SearchProducts",
            "servicecatalog:UpdateProvisionedProduct",
            "servicecatalog:ListProvisioningArtifacts",
            "servicecatalog:ListLaunchPaths",
            "servicecatalog:DescribeRecord",
            "cloudformation:DescribeStackResources"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRCreateClusterAdvancedActions",
         "Action":[
            "elasticmapreduce:RunJobFlow"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>",
            "arn:aws:iam::*:role/EMR_DefaultRole_V2",
            "arn:aws:iam::*:role/EMR_EC2_DefaultRole"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid" : "SageMakerDataWranglerForEMRStudio",
         "Effect" : "Allow",
         "Action" : [
            "sagemaker:CreatePresignedDomainUrl",
            "sagemaker:DescribeDomain",
            "sagemaker:ListDomains",
            "sagemaker:ListUserProfiles"
         ],
         "Resource":"*"
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      },
      {
         "Sid": "AllowServerlessActions",
         "Action": [
            "emr-serverless:CreateApplication",
            "emr-serverless:UpdateApplication",
            "emr-serverless:DeleteApplication",
            "emr-serverless:ListApplications",
            "emr-serverless:GetApplication",
            "emr-serverless:StartApplication",
            "emr-serverless:StopApplication",
            "emr-serverless:StartJobRun",
            "emr-serverless:CancelJobRun",
            "emr-serverless:ListJobRuns",
            "emr-serverless:GetJobRun",
            "emr-serverless:GetDashboardForJobRun",
            "emr-serverless:AccessInteractiveEndpoints"
         ],
         "Resource": "*",
         "Effect": "Allow"
      },
      {
         "Sid": "AllowPassingRuntimeRoleForRunningServerlessJob",
         "Action": "iam:PassRole",
         "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
         "Effect": "Allow"
      },
      {
         "Sid": "AllowCodeWhisperer",
         "Effect": "Allow", 
         "Action": [ "codewhisperer:GenerateRecommendations" ], 
         "Resource": "*" 
      },
      {
         "Sid": "AllowAthenaSQL",
         "Action": [
            "athena:StartQueryExecution",
            "athena:StopQueryExecution",
            "athena:GetQueryExecution",
            "athena:GetQueryRuntimeStatistics",
            "athena:GetQueryResults",
            "athena:ListQueryExecutions",
            "athena:BatchGetQueryExecution",
            "athena:GetNamedQuery",
            "athena:ListNamedQueries",
            "athena:BatchGetNamedQuery",
            "athena:UpdateNamedQuery",
            "athena:DeleteNamedQuery",
            "athena:ListDataCatalogs",
            "athena:GetDataCatalog",
            "athena:ListDatabases",
            "athena:GetDatabase",
            "athena:ListTableMetadata",
            "athena:GetTableMetadata",
            "athena:ListWorkGroups",
            "athena:GetWorkGroup",
            "athena:CreateNamedQuery",
            "athena:GetPreparedStatement",
            "glue:CreateDatabase",
            "glue:DeleteDatabase",
            "glue:GetDatabase",
            "glue:GetDatabases",
            "glue:UpdateDatabase",
            "glue:CreateTable",
            "glue:DeleteTable",
            "glue:BatchDeleteTable",
            "glue:UpdateTable",
            "glue:GetTable",
            "glue:GetTables",
            "glue:BatchCreatePartition",
            "glue:CreatePartition",
            "glue:DeletePartition",
            "glue:BatchDeletePartition",
            "glue:UpdatePartition",
            "glue:GetPartition",
            "glue:GetPartitions",
            "glue:BatchGetPartition",
            "kms:ListAliases",
            "kms:ListKeys",
            "kms:DescribeKey",
            "lakeformation:GetDataAccess",
            "s3:GetBucketLocation",
            "s3:GetBucketLocation",
            "s3:GetObject",
            "s3:ListBucket",
            "s3:ListBucketMultipartUploads",
            "s3:ListMultipartUploadParts",
            "s3:AbortMultipartUpload",
            "s3:PutObject",
            "s3:PutBucketPublicAccessBlock",
            "s3:ListAllMyBuckets"
         ],
         "Resource": "*",
         "Effect": "Allow"
      }
   ]
}

下列使用者政策包含搭配使用 EMR Serverless 互動式應用程式與 EMR Studio 工作區所需的最低使用者許可。

在此範例政策中具有 EMR Studio 之 EMR Serverless 互動式應用程式的使用者許可，請將 serverless-runtime-role 和 emr-studio-service-role 取代為正確的 EMR Studio 服務角色和 EMR Serverless 執行期角色。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowServerlessActions",
            "Action": [
                "emr-serverless:CreateApplication",
                "emr-serverless:UpdateApplication",
                "emr-serverless:DeleteApplication",
                "emr-serverless:ListApplications",
                "emr-serverless:GetApplication",
                "emr-serverless:StartApplication",
                "emr-serverless:StopApplication",
                "emr-serverless:StartJobRun",
                "emr-serverless:CancelJobRun",
                "emr-serverless:ListJobRuns",
                "emr-serverless:GetJobRun",
                "emr-serverless:GetDashboardForJobRun",
                "emr-serverless:AccessInteractiveEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowEMRBasicActions",
            "Action": [
                "elasticmapreduce:CreateEditor",
                "elasticmapreduce:DescribeEditor",
                "elasticmapreduce:ListEditors",
                "elasticmapreduce:UpdateStudio",                
                "elasticmapreduce:StartEditor",
                "elasticmapreduce:StopEditor",
                "elasticmapreduce:DeleteEditor",
                "elasticmapreduce:OpenEditorInConsole",
                "elasticmapreduce:AttachEditor",
                "elasticmapreduce:DetachEditor",
                "elasticmapreduce:CreateStudio",
                "elasticmapreduce:DescribeStudio",
                "elasticmapreduce:DeleteStudio",
                "elasticmapreduce:ListStudios",
                "elasticmapreduce:CreateStudioPresignedUrl"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowPassingRuntimeRoleForRunningEMRServerlessJob",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowPassingServiceRoleForWorkspaceCreation",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/emr-studio-service-role",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowS3ListAndGetPermissions",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::*",
            "Effect": "Allow"
        },
        {
            "Sid":"DescribeNetwork",
            "Effect":"Allow",
            "Action":[
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource":"*"
        },
        {
            "Sid": "ListIAMRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

AWS Identity and Access Management EMR Studio 使用者的許可

下表會細分使用者可能執行的每個 Amazon EMR Studio 操作，並列出執行該操作所需的最低 IAM 動作。在 EMR Studio 的 IAM 許可政策 (當您使用 IAM 身分驗證時) 或您的使用者角色工作階段政策 (當您使用 IAM Identity Center 身分驗證時) 中允許這些動作。

此資料表也會顯示 EMR Studio 的每個範例許可政策中允許的操作。如需有關範例許可政策的詳細資訊，請參閱 建立 EMR Studio 使用者的許可政策。

動作 基本 中級 Advanced (進階) 關聯動作
建立和刪除工作區 是 是 是 
"elasticmapreduce:CreateEditor", 
"elasticmapreduce:DescribeEditor",
"elasticmapreduce:ListEditors", 
"elasticmapreduce:DeleteEditor"
檢視協同合作面板，啟用工作區協同合作，以及新增協同合作者。如需詳細資訊，請參閱設定工作區協同合作的擁有權。 是 是 是 
"elasticmapreduce:UpdateEditor",
"elasticmapreduce:PutWorkspaceAccess",
"elasticmapreduce:DeleteWorkspaceAccess",
"elasticmapreduce:ListWorkspaceAccessIdentities"
建立新的 EMR 叢集時，請參閱與 Studio 相同帳戶中的 Amazon S3 Control 儲存貯體清單，並在使用 Web UI 偵錯應用程式時存取容器日誌 是 是 是 
"s3:ListAllMyBuckets",
"s3:ListBucket", 
"s3:GetBucketLocation",
"s3:GetObject"
存取工作區 是 是 是 
"elasticmapreduce:DescribeEditor", 
"elasticmapreduce:ListEditors",
"elasticmapreduce:StartEditor", 
"elasticmapreduce:StopEditor",
"elasticmapreduce:OpenEditorInConsole"
附接或分離與工作區相關聯的現有 Amazon EMR 叢集 是 是 是 
"elasticmapreduce:AttachEditor",
"elasticmapreduce:DetachEditor",
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:ListInstanceGroups",
"elasticmapreduce:ListBootstrapActions"
附接或分離 Amazon EMR on EKS 叢集 是 是 是 
"elasticmapreduce:AttachEditor", 
"elasticmapreduce:DetachEditor",
"emr-containers:ListVirtualClusters", 
"emr-containers:DescribeVirtualCluster",
"emr-containers:ListManagedEndpoints",
"emr-containers:DescribeManagedEndpoint",
"emr-containers:GetManagedEndpointSessionCredentials"
附接或分離與工作區相關聯的 EMR Serverless 應用程式 否 是 是 
"elasticmapreduce:AttachEditor",
"elasticmapreduce:DetachEditor",
"emr-serverless:GetApplication",
"emr-serverless:StartApplication",
"emr-serverless:ListApplications",
"emr-serverless:GetDashboardForJobRun",
"emr-serverless:AccessInteractiveEndpoints",
"iam:PassRole"

需要 PassRole 許可才能傳遞 EMR Serverless 作業執行期角色。如需詳細資訊，請參閱《Amazon EMR Serverless 使用者指南》中的作業執行期角色。
使用持久性應用程式使用者介面對 EC2 上的 Amazon EMR 作業進行偵錯 是 是 是 
"elasticmapreduce:CreatePersistentAppUI",
"elasticmapreduce:DescribePersistentAppUI",
"elasticmapreduce:GetPersistentAppUIPresignedURL",
"elasticmapreduce:ListClusters",
"elasticmapreduce:ListSteps",
"elasticmapreduce:DescribeCluster",
"s3:ListBucket",
"s3:GetObject"
使用叢集上的應用程式使用者介面對 EC2 上的 Amazon EMR 作業進行偵錯 是 是 是 
"elasticmapreduce:GetOnClusterAppUIPresignedURL"
使用 Spark 歷史記錄伺服器，對 Amazon EMR on EKS 作業執行進行偵錯 是 是 是 
"elasticmapreduce:CreatePersistentAppUI",
"elasticmapreduce:DescribePersistentAppUI",
"elasticmapreduce:GetPersistentAppUIPresignedURL",
"emr-containers:ListVirtualClusters",
"emr-containers:DescribeVirtualCluster",
"emr-containers:ListJobRuns",
"emr-containers:DescribeJobRun",
"s3:ListBucket",
"s3:GetObject"
建立和刪除 Git 儲存庫 是 是 是 
"elasticmapreduce:CreateRepository", 
"elasticmapreduce:DeleteRepository",
"elasticmapreduce:ListRepositories",
"elasticmapreduce:DescribeRepository",
"secretsmanager:CreateSecret",
"secretsmanager:ListSecrets",
"secretsmanager:TagResource"
連結和解除連結 Git 儲存庫 是 是 是 
"elasticmapreduce:LinkRepository",
"elasticmapreduce:UnlinkRepository",
"elasticmapreduce:ListRepositories",
"elasticmapreduce:DescribeRepository"
從預先定義的叢集範本中建立新叢集 否 是 是 
"servicecatalog:SearchProducts", 
"servicecatalog:DescribeProduct",
"servicecatalog:DescribeProductView",
"servicecatalog:DescribeProvisioningParameters",
"servicecatalog:ProvisionProduct",
"servicecatalog:UpdateProvisionedProduct",
"servicecatalog:ListProvisioningArtifacts", 
"servicecatalog:DescribeRecord",
"servicecatalog:ListLaunchPaths",
"cloudformation:DescribeStackResources", 
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster"
提供叢集組態以建立新叢集。 否 否 是 
"elasticmapreduce:RunJobFlow",
"iam:PassRole",
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster"
使用 IAM 身分驗證模式時，將使用者指派給 Studio。 否 否 否 
"elasticmapreduce:CreateStudioPresignedUrl"
描述網路物件。 是 是 是 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DescribeNetwork",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource": "*"
        }
    ]
}
列出 IAM 角色。 是 是 是 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListIAMRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}
從 Amazon SageMaker AI Studio 連線至 EMR Studio，並使用 Data Wrangler 視覺化界面。 否 否 是 
"sagemaker:CreatePresignedDomainUrl",
"sagemaker:DescribeDomain",
"sagemaker:ListDomains",
"sagemaker:ListUserProfiles"
在 EMR Studio 中使用 Amazon CodeWhisperer。 否 否 是 
"codewhisperer:GenerateRecommendations"
從 EMR Studio 存取 Amazon Athena SQL 編輯器。此清單可能不包含使用所有 Athena 功能所需的所有許可。如需最新清單，請參閱 Athena 完整存取政策。 否 否 是 
"athena:StartQueryExecution",
"athena:StopQueryExecution",
"athena:GetQueryExecution",
"athena:GetQueryRuntimeStatistics",
"athena:GetQueryResults",
"athena:ListQueryExecutions",
"athena:BatchGetQueryExecution",
"athena:GetNamedQuery",
"athena:ListNamedQueries",
"athena:BatchGetNamedQuery",
"athena:UpdateNamedQuery",
"athena:DeleteNamedQuery",
"athena:ListDataCatalogs",
"athena:GetDataCatalog",
"athena:ListDatabases",
"athena:GetDatabase",
"athena:ListTableMetadata",
"athena:GetTableMetadata",
"athena:ListWorkGroups",
"athena:GetWorkGroup",
"athena:CreateNamedQuery",
"athena:GetPreparedStatement",
"glue:CreateDatabase",
"glue:DeleteDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:CreateTable",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:DeletePartition",
"glue:BatchDeletePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"kms:ListAliases",
"kms:ListKeys",
"kms:DescribeKey",
"lakeformation:GetDataAccess",
"s3:GetBucketLocation",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:PutObject",
"s3:PutBucketPublicAccessBlock",
"s3:ListAllMyBuckets"