為 Amazon EC2 或 Amazon 配置EMR工作室用戶許可 EKS - Amazon EMR
建立使用者角色建立使用者許可範例使用者政策IAM工作室使用者的權限

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

為 Amazon EC2 或 Amazon 配置EMR工作室用戶許可 EKS

您必須設定 Amazon EMR Studio 的使用者許可政策，才能設定精細的使用者和群組許可。有關使用者權限如何在 EMR Studio 中運作的資訊，請參閱存取控制中的Amazon EMR Studio 運作方式。

注意

本章節涵蓋的許可不會強制執行資料存取控制。若要管理輸入資料集的存取權限，應該為 Studio 使用的叢集設定許可。如需詳細資訊，請參閱Amazon 的安全性 EMR。

建立IAM身分識別中心驗證模式的 EMR Studio 使用者角色

您必須在使用IAM身分識別中心驗證模式時建立 EMR Studio 使用者角色。

若要建立 EMR Studio 的使用者角色

  1. 請按照《AWS Identity and Access Management 用戶指南》中的「創建角色以將權限委派給 AWS 服務」中的說明來創建用戶角色。

    建立角色時，請使用下列信任關係政策。

    {
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "elasticmapreduce.amazonaws.com"
      },
      "Action": [
              "sts:AssumeRole",
              "sts:SetContext"
              ]
    }
  ]
}

  2. 移除預設角色許可和政策。

  3. 將使用者和群組指派給 Studio 之前，請將您的 EMR Studio 工作階段原則附加至使用者角色。如需有關如何建立工作階段政策的指示，請參閱 為 EMR Studio 使用者建立權限原則。

為 EMR Studio 使用者建立權限原則

請參閱以下各節以建立 EMR Studio 的權限原則。

注意

若要設定用於存放筆記本檔案的 Amazon S3 存取許可，以及在將工作區連結至 Git 儲存庫時設定讀取密碼的存 AWS Secrets Manager 取權限，請使用 EMR Studio 服務角色。

建立許可政策

建立一或多個IAM權限原則，以指定使用者可以在您的 Studio 中執行的動作。例如，可以使用此頁面上的範例政策，為基礎、中級和進階 Studio 使用者類型建立三個獨立的政策。

如需使用者可能執行之每個 Studio 作業的明細，以及執行每項作業所需的最小IAM動作，請參閱AWS Identity and Access Management EMR工作室使用者的權限。如需建立策略的步驟，請參閱《使用指南》中的IAM〈建立IAM策略〉。

許可政策必須包含下列陳述式。

{
            "Sid": "AllowAddingTagsOnSecretsWithEMRStudioPrefix",
            "Effect": "Allow",
            "Action": "secretsmanager:TagResource",
            "Resource": "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
},
{
            "Sid": "AllowPassingServiceRoleForWorkspaceCreation",
            "Action": "iam:PassRole",
            "Resource": [
                "arn:aws:iam::*:role/your-emr-studio-service-role"
            ],
            "Effect": "Allow"
}

設定工作區協同合作的擁有權

工作區協同合作可讓多位使用者同時在相同工作區中工作，並且可以使用工作區 UI 中的協同合作面板進行設定。若要查看和使用協同合作面板，使用者必須擁有下列許可。任何具有這些許可的使用者都可以查看和使用協同合作面板。

"elasticmapreduce:UpdateEditor",
"elasticmapreduce:PutWorkspaceAccess",
"elasticmapreduce:DeleteWorkspaceAccess",
"elasticmapreduce:ListWorkspaceAccessIdentities"

若要限制存取協同合作面板，可以使用標籤型存取控制。當使用者建立工作區時，EMRStudio 會套用預設標籤，creatorUserId其值為建立工作區的使用者 ID 的索引鍵。

注意

EMRStudio 會將標creatorUserId籤新增至 2021 年 11 月 16 日之後建立的工作區。若要限制誰可為您在此日期之前建立的工作區設定協作，建議您手動將 creatorUserId 標籤新增至您的工作區，然後在使用者許可政策中使用標籤型存取控制。

下列範例陳述式可讓使用者為具有標籤金鑰 creatorUserId 的任何工作區設定協同合作，該標籤金鑰的值與使用者 ID (由政策變數 aws:userId 表示) 進行比對。換句話說，該陳述式可讓使用者為他們所建立的工作區設定協同合作。若要進一步了解政策變數，請參閱IAM使用者指南中的IAM政策元素：變數和標籤。

    {
        "Sid": "UserRolePermissionsForCollaboration",
        "Action": [
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
            "StringEquals": {
                "elasticmapreduce:ResourceTag/creatorUserId": "${aws:userid}"
            }
        }
    }

建立使用者層級 Git 密碼政策

使用使用者層級許可

EMR工作室在創建 Git 秘密時自動添加for-use-with-amazon-emr-managed-user-policies標籤。如果您想要在使用者層級控制 Git 機密的存取權，請將標籤型權限新增至 EMR Studio 使用者角色原則，secretsmanager:GetSecretValue如下從服務層級許可轉換為使用者層級許可節所示。

如果您具有 EMR Studio 服務角色原則secretsmanager:GetSecretValue中的現有權限，則應移除這些權限。

從服務層級許可轉換為使用者層級許可

注意

for-use-with-amazon-emr-managed-user-policies 標籤可確保下列步驟 1 中的許可向工作區的建立者授予對 Git 密碼的存取權限。但是，如果您在 2023 年 9 月 1 日之前連結了 Git 儲存庫，則對應的 Git 密碼將會因其未套用 for-use-with-amazon-emr-managed-user-policies 標籤而遭到拒絕存取。若要套用使用者層級權限，您必須重新建立舊密碼，然後再次連結適當的 Git 儲存庫。 JupyterLab

如需有關策略變數的詳細資訊，請參閱《IAM使用指南》中的IAM政策元素：變數和標籤。

  1. 將下列權限新增至 EMRStudio 使用者角色原則。其會使用 for-use-with-amazon-emr-managed-user-policies 索引鍵，且值為 "${aws:userid}"。

    {
   "Sid": "AllowSecretsManagerReadOnlyActionsWithEMRTags",
    "Effect": "Allow",
    "Action": "secretsmanager:GetSecretValue",
    "Resource": "arn:aws:secretsmanager:*:*:secret:*",
    "Condition": {
        "StringEquals": {
            "secretsmanager:ResourceTag/for-use-with-amazon-emr-managed-user-policies": "${aws:userid}"
        }
    }
}

  2. 如果存在，請從 EMRStudio 服務角色原則中移除下列權限。由於服務角色政策適用於每個使用者定義的所有密碼，您只需執行此動作一次。

    {
    "Sid": "AllowSecretsManagerReadOnlyActionsWithEMRTags", 
    "Effect": "Allow", 
    "Action": [ 
        "secretsmanager:GetSecretValue" 
     ], 
    "Resource": "arn:aws:secretsmanager:*:*:secret:*", 
    "Condition": {
        "StringEquals": {
            "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" 
        } 
    } 
}

使用服務層級許可

自 2023 年 9 月 1 日起，EMRStudio 會自動為使用者層級存取控制新增for-use-with-amazon-emr-managed-user-policies標籤。因為這是一項新增功能，因此您可以繼續使用透過 EMRStudio 服務角色中的GetSecretValue權限取得的服務層級存取權。

對於 2023 年 9 月 1 日之前建立的密碼，EMRStudio 並未新增標for-use-with-amazon-emr-managed-user-policies籤。若要繼續使用服務層級權限，只要保留現有的 EMRStudio 服務角色和使用者角色權限即可。不過，若要限制可以存取個別密碼的人員，建議您遵循 使用使用者層級許可 中的步驟，手動將 for-use-with-amazon-emr-managed-user-policies 標籤新增至密碼，然後在使用者許可政策中使用標籤型存取控制。

如需有關策略變數的詳細資訊，請參閱《IAM使用指南》中的IAM政策元素：變數和標籤。

將權限原則附加至您的IAM身分

下表摘要說明您附加權限原則的IAM身分識別，視您的 EMR Studio 驗證模式而定。如需有關如何附加原則的指示，請參閱新增和移除IAM身分識別權限。

如果您使用... 將政策附接至...
IAM認證 您的IAM身分 (使用者、使用者群組或角色)。例如，可以將許可政策附接至 AWS 帳戶的使用者。
IAM與外部身分識別提供者 (IdP) 的同盟

您為外部 IdP 建立的一個或多個角色。IAM例如，IAMSAML2.0 聯合。

EMRStudio 會針對具有 Studio 聯合存取權的使用者，使用您附加到IAM角色的權限。
IAM識別中心 您的 Amazon EMR 工作室用戶角色。

範例使用者政策

下列基本使用者政策允許大部分的 EMR Studio 動作，但不允許使用者建立新的 Amazon EMR 叢集。

重要

範例原則不包含CreateStudioPresignedUrl權限，您必須在使用IAM驗證模式時允許使用者使用此權限。如需詳細資訊，請參閱將使用者或群組指派給EMR工作室。

範例原則包含強制執行以標籤為基礎的存取控制 (TBAC) 的Condition元素，以便您可以將原則與 EMR Studio 的範例服務角色搭配使用。如需詳細資訊，請參閱建立EMR工作室服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags",
         "Effect":"Allow",
         "Action":[
            "ec2:CreateSecurityGroup"
         ],
         "Resource":[
            "arn:aws:ec2:*:*:vpc/*"
         ],
         "Condition":{
            "StringEquals":{
               "aws:ResourceTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingEMRTagsDuringDefaultSecurityGroupCreation",
         "Effect":"Allow",
         "Action":[
            "ec2:CreateTags"
         ],
         "Resource":"arn:aws:ec2:*:*:security-group/*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true",
               "ec2:CreateAction":"CreateSecurityGroup"
            }
         }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      }
   ]
}

下列中繼使用者政策允許大部分的 EMR Studio 動作，並允許使用者使用EMR叢集範本建立新的 Amazon 叢集。

重要

範例原則不包含CreateStudioPresignedUrl權限，您必須在使用IAM驗證模式時允許使用者使用此權限。如需詳細資訊，請參閱將使用者或群組指派給EMR工作室。

範例原則包含強制執行以標籤為基礎的存取控制 (TBAC) 的Condition元素，以便您可以將原則與 EMR Studio 的範例服務角色搭配使用。如需詳細資訊，請參閱建立EMR工作室服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowEMRBasicActions",
         "Action":[
            "elasticmapreduce:CreateEditor",
            "elasticmapreduce:DescribeEditor",
            "elasticmapreduce:ListEditors",
            "elasticmapreduce:StartEditor",
            "elasticmapreduce:StopEditor",
            "elasticmapreduce:DeleteEditor",
            "elasticmapreduce:OpenEditorInConsole",
            "elasticmapreduce:AttachEditor",
            "elasticmapreduce:DetachEditor",
            "elasticmapreduce:CreateRepository",
            "elasticmapreduce:DescribeRepository",
            "elasticmapreduce:DeleteRepository",
            "elasticmapreduce:ListRepositories",
            "elasticmapreduce:LinkRepository",
            "elasticmapreduce:UnlinkRepository",
            "elasticmapreduce:DescribeCluster",
            "elasticmapreduce:ListInstanceGroups",
            "elasticmapreduce:ListBootstrapActions",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:ListSteps",
            "elasticmapreduce:CreatePersistentAppUI",
            "elasticmapreduce:DescribePersistentAppUI",
            "elasticmapreduce:GetPersistentAppUIPresignedURL",
            "elasticmapreduce:GetOnClusterAppUIPresignedURL"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRContainersBasicActions",
         "Action":[
            "emr-containers:DescribeVirtualCluster",
            "emr-containers:ListVirtualClusters",
            "emr-containers:DescribeManagedEndpoint",
            "emr-containers:ListManagedEndpoints",
            "emr-containers:DescribeJobRun",
            "emr-containers:ListJobRuns"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
          "Sid": "AllowRetrievingManagedEndpointCredentials",
          "Effect": "Allow",
          "Action": [
              "emr-containers:GetManagedEndpointSessionCredentials"
          ],
          "Resource": [
              "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>"
          ],
          "Condition": {
              "StringEquals": {
                  "emr-containers:ExecutionRoleArn": [
                      "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>"
                  ]
              }
          }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowClusterTemplateRelatedIntermediateActions",
         "Action":[
            "servicecatalog:DescribeProduct",
            "servicecatalog:DescribeProductView",
            "servicecatalog:DescribeProvisioningParameters",
            "servicecatalog:ProvisionProduct",
            "servicecatalog:SearchProducts",
            "servicecatalog:UpdateProvisionedProduct",
            "servicecatalog:ListProvisioningArtifacts",
            "servicecatalog:ListLaunchPaths",
            "servicecatalog:DescribeRecord",
            "cloudformation:DescribeStackResources"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      },
      {
         "Sid": "AllowServerlessActions",
         "Action": [
            "emr-serverless:CreateApplication",
            "emr-serverless:UpdateApplication",
            "emr-serverless:DeleteApplication",
            "emr-serverless:ListApplications",
            "emr-serverless:GetApplication",
            "emr-serverless:StartApplication",
            "emr-serverless:StopApplication",
            "emr-serverless:StartJobRun",
            "emr-serverless:CancelJobRun",
            "emr-serverless:ListJobRuns",
            "emr-serverless:GetJobRun",
            "emr-serverless:GetDashboardForJobRun",
            "emr-serverless:AccessInteractiveEndpoints"
         ],
         "Resource": "*",
         "Effect": "Allow"
        },
        {
           "Sid": "AllowPassingRuntimeRoleForRunningServerlessJob",
           "Action": "iam:PassRole",
           "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
           "Effect": "Allow"
        }
   ]
}

下列進階使用者政策允許所有 EMR Studio 動作，並允許使用者使用EMR叢集範本或提供叢集組態來建立新的 Amazon 叢集。

重要

範例原則不包含CreateStudioPresignedUrl權限，您必須在使用IAM驗證模式時允許使用者使用此權限。如需詳細資訊，請參閱將使用者或群組指派給EMR工作室。

範例原則包含強制執行以標籤為基礎的存取控制 (TBAC) 的Condition元素，以便您可以將原則與 EMR Studio 的範例服務角色搭配使用。如需詳細資訊，請參閱建立EMR工作室服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowEMRBasicActions",
         "Action":[
            "elasticmapreduce:CreateEditor",
            "elasticmapreduce:DescribeEditor",
            "elasticmapreduce:ListEditors",
            "elasticmapreduce:StartEditor",
            "elasticmapreduce:StopEditor",
            "elasticmapreduce:DeleteEditor",
            "elasticmapreduce:OpenEditorInConsole",
            "elasticmapreduce:AttachEditor",
            "elasticmapreduce:DetachEditor",
            "elasticmapreduce:CreateRepository",
            "elasticmapreduce:DescribeRepository",
            "elasticmapreduce:DeleteRepository",
            "elasticmapreduce:ListRepositories",
            "elasticmapreduce:LinkRepository",
            "elasticmapreduce:UnlinkRepository",
            "elasticmapreduce:DescribeCluster",
            "elasticmapreduce:ListInstanceGroups",
            "elasticmapreduce:ListBootstrapActions",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:ListSteps",
            "elasticmapreduce:CreatePersistentAppUI",
            "elasticmapreduce:DescribePersistentAppUI",
            "elasticmapreduce:GetPersistentAppUIPresignedURL",
            "elasticmapreduce:GetOnClusterAppUIPresignedURL"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRContainersBasicActions",
         "Action":[
            "emr-containers:DescribeVirtualCluster",
            "emr-containers:ListVirtualClusters",
            "emr-containers:DescribeManagedEndpoint",
            "emr-containers:ListManagedEndpoints",
            "emr-containers:DescribeJobRun",
            "emr-containers:ListJobRuns"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
          "Sid": "AllowRetrievingManagedEndpointCredentials",
          "Effect": "Allow",
          "Action": [
              "emr-containers:GetManagedEndpointSessionCredentials"
          ],
          "Resource": [
              "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>"
          ],
          "Condition": {
              "StringEquals": {
                  "emr-containers:ExecutionRoleArn": [
                      "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>"
                  ]
              }
          }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowClusterTemplateRelatedIntermediateActions",
         "Action":[
            "servicecatalog:DescribeProduct",
            "servicecatalog:DescribeProductView",
            "servicecatalog:DescribeProvisioningParameters",
            "servicecatalog:ProvisionProduct",
            "servicecatalog:SearchProducts",
            "servicecatalog:UpdateProvisionedProduct",
            "servicecatalog:ListProvisioningArtifacts",
            "servicecatalog:ListLaunchPaths",
            "servicecatalog:DescribeRecord",
            "cloudformation:DescribeStackResources"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRCreateClusterAdvancedActions",
         "Action":[
            "elasticmapreduce:RunJobFlow"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>",
            "arn:aws:iam::*:role/EMR_DefaultRole_V2",
            "arn:aws:iam::*:role/EMR_EC2_DefaultRole"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid" : "SageMakerDataWranglerForEMRStudio",
         "Effect" : "Allow",
         "Action" : [
            "sagemaker:CreatePresignedDomainUrl",
            "sagemaker:DescribeDomain",
            "sagemaker:ListDomains",
            "sagemaker:ListUserProfiles"
         ],
         "Resource":"*"
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      },
      {
         "Sid": "AllowServerlessActions",
         "Action": [
            "emr-serverless:CreateApplication",
            "emr-serverless:UpdateApplication",
            "emr-serverless:DeleteApplication",
            "emr-serverless:ListApplications",
            "emr-serverless:GetApplication",
            "emr-serverless:StartApplication",
            "emr-serverless:StopApplication",
            "emr-serverless:StartJobRun",
            "emr-serverless:CancelJobRun",
            "emr-serverless:ListJobRuns",
            "emr-serverless:GetJobRun",
            "emr-serverless:GetDashboardForJobRun",
            "emr-serverless:AccessInteractiveEndpoints"
         ],
         "Resource": "*",
         "Effect": "Allow"
      },
      {
         "Sid": "AllowPassingRuntimeRoleForRunningServerlessJob",
         "Action": "iam:PassRole",
         "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
         "Effect": "Allow"
      },
      {
         "Sid": "AllowCodeWhisperer",
         "Effect": "Allow", 
         "Action": [ "codewhisperer:GenerateRecommendations" ], 
         "Resource": "*" 
      },
      {
         "Sid": "AllowAthenaSQL",
         "Action": [
            "athena:StartQueryExecution",
            "athena:StopQueryExecution",
            "athena:GetQueryExecution",
            "athena:GetQueryRuntimeStatistics",
            "athena:GetQueryResults",
            "athena:ListQueryExecutions",
            "athena:BatchGetQueryExecution",
            "athena:GetNamedQuery",
            "athena:ListNamedQueries",
            "athena:BatchGetNamedQuery",
            "athena:UpdateNamedQuery",
            "athena:DeleteNamedQuery",
            "athena:ListDataCatalogs",
            "athena:GetDataCatalog",
            "athena:ListDatabases",
            "athena:GetDatabase",
            "athena:ListTableMetadata",
            "athena:GetTableMetadata",
            "athena:ListWorkGroups",
            "athena:GetWorkGroup",
            "athena:CreateNamedQuery",
            "athena:GetPreparedStatement",
            "glue:CreateDatabase",
            "glue:DeleteDatabase",
            "glue:GetDatabase",
            "glue:GetDatabases",
            "glue:UpdateDatabase",
            "glue:CreateTable",
            "glue:DeleteTable",
            "glue:BatchDeleteTable",
            "glue:UpdateTable",
            "glue:GetTable",
            "glue:GetTables",
            "glue:BatchCreatePartition",
            "glue:CreatePartition",
            "glue:DeletePartition",
            "glue:BatchDeletePartition",
            "glue:UpdatePartition",
            "glue:GetPartition",
            "glue:GetPartitions",
            "glue:BatchGetPartition",
            "kms:ListAliases",
            "kms:ListKeys",
            "kms:DescribeKey",
            "lakeformation:GetDataAccess",
            "s3:GetBucketLocation",
            "s3:GetBucketLocation",
            "s3:GetObject",
            "s3:ListBucket",
            "s3:ListBucketMultipartUploads",
            "s3:ListMultipartUploadParts",
            "s3:AbortMultipartUpload",
            "s3:PutObject",
            "s3:PutBucketPublicAccessBlock",
            "s3:ListAllMyBuckets"
         ],
         "Resource": "*",
         "Effect": "Allow"
      }
   ]
}

下列使用者原則包含將EMR無伺服器互動式應用程式與 EMR Studio Workspace 搭配使用所需的最低使用者權限。

在具有使用 EMR Studio 之EMR無伺服器互動式應用程式之使用者權限的此範例原則中，取代的預留位置 serverless-runtime-role 以及 emr-studio-service-role 使用正確的 EMRStudio 服務角色和EMR無伺服器執行階段角色。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowServerlessActions",
            "Action": [
                "emr-serverless:CreateApplication",
                "emr-serverless:UpdateApplication",
                "emr-serverless:DeleteApplication",
                "emr-serverless:ListApplications",
                "emr-serverless:GetApplication",
                "emr-serverless:StartApplication",
                "emr-serverless:StopApplication",
                "emr-serverless:StartJobRun",
                "emr-serverless:CancelJobRun",
                "emr-serverless:ListJobRuns",
                "emr-serverless:GetJobRun",
                "emr-serverless:GetDashboardForJobRun",
                "emr-serverless:AccessInteractiveEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowEMRBasicActions",
            "Action": [
                "elasticmapreduce:CreateEditor",
                "elasticmapreduce:DescribeEditor",
                "elasticmapreduce:ListEditors",
                "elasticmapreduce:UpdateStudio",                
                "elasticmapreduce:StartEditor",
                "elasticmapreduce:StopEditor",
                "elasticmapreduce:DeleteEditor",
                "elasticmapreduce:OpenEditorInConsole",
                "elasticmapreduce:AttachEditor",
                "elasticmapreduce:DetachEditor",
                "elasticmapreduce:CreateStudio",
                "elasticmapreduce:DescribeStudio",
                "elasticmapreduce:DeleteStudio",
                "elasticmapreduce:ListStudios",
                "elasticmapreduce:CreateStudioPresignedUrl"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowPassingRuntimeRoleForRunningEMRServerlessJob",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowPassingServiceRoleForWorkspaceCreation",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/emr-studio-service-role",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowS3ListAndGetPermissions",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::*",
            "Effect": "Allow"
        },
        {
            "Sid":"DescribeNetwork",
            "Effect":"Allow",
            "Action":[
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource":"*"
        },
        {
            "Sid": "ListIAMRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

AWS Identity and Access Management EMR工作室使用者的權限

下表包含使用者可能執行的每個 Amazon EMR Studio 作業，並列出執行該作業所需的最低IAM動作。您可以在 Studio 的IAM權限原則 (當您使用IAM驗證時) 或使用者角色工作階段原則 (當您使用 IAM Identity Center 驗證時) 中允許這些動EMR作。

此資料表也會顯示 EMR Studio 的每個範例權限原則中允許的作業。如需有關範例許可政策的詳細資訊，請參閱 為 EMR Studio 使用者建立權限原則。

動作 基本 中級 Advanced (進階) 關聯動作
建立和刪除工作區 是 是 是 
"elasticmapreduce:CreateEditor", 
"elasticmapreduce:DescribeEditor",
"elasticmapreduce:ListEditors", 
"elasticmapreduce:DeleteEditor"
檢視協同合作面板，啟用工作區協同合作，以及新增協同合作者。如需詳細資訊，請參閱設定工作區協同合作的擁有權。 是 是 是 
"elasticmapreduce:UpdateEditor",
"elasticmapreduce:PutWorkspaceAccess",
"elasticmapreduce:DeleteWorkspaceAccess",
"elasticmapreduce:ListWorkspaceAccessIdentities"
建立新EMR叢集時，請參閱與 Studio 相同帳戶中的 Amazon S3 Control 儲存貯體清單，並在使用 Web UI 偵錯應用程式時存取容器記錄 是 是 是 
"s3:ListAllMyBuckets",
"s3:ListBucket", 
"s3:GetBucketLocation",
"s3:GetObject"
存取工作區 是 是 是 
"elasticmapreduce:DescribeEditor", 
"elasticmapreduce:ListEditors",
"elasticmapreduce:StartEditor", 
"elasticmapreduce:StopEditor",
"elasticmapreduce:OpenEditorInConsole"
附加或分離與工作區相關聯的現有 Amazon EMR 叢集 是 是 是 
"elasticmapreduce:AttachEditor",
"elasticmapreduce:DetachEditor",
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:ListInstanceGroups",
"elasticmapreduce:ListBootstrapActions"
EMR在EKS叢集上連接或分離 Amazon 是 是 是 
"elasticmapreduce:AttachEditor", 
"elasticmapreduce:DetachEditor",
"emr-containers:ListVirtualClusters", 
"emr-containers:DescribeVirtualCluster",
"emr-containers:ListManagedEndpoints",
"emr-containers:DescribeManagedEndpoint",
"emr-containers:GetManagedEndpointSessionCredentials"
附加或卸離與工作區相關聯的EMR無伺服器應用程式 否 是 是 
"elasticmapreduce:AttachEditor",
"elasticmapreduce:DetachEditor",
"emr-serverless:GetApplication",
"emr-serverless:StartApplication",
"emr-serverless:ListApplications",
"emr-serverless:GetDashboardForJobRun",
"emr-serverless:AccessInteractiveEndpoints",
"iam:PassRole"

需要PassRole權限才能傳遞EMR無伺服器工作執行階段角色。如需詳細資訊，請參閱 Amazon EMR 無伺服器使用者指南中的任務執行階段角色。
使用持久應用程式使用者界面EMR在EC2任務上對 Amazon 是 是 是 
"elasticmapreduce:CreatePersistentAppUI",
"elasticmapreduce:DescribePersistentAppUI",
"elasticmapreduce:GetPersistentAppUIPresignedURL",
"elasticmapreduce:ListClusters",
"elasticmapreduce:ListSteps",
"elasticmapreduce:DescribeCluster",
"s3:ListBucket",
"s3:GetObject"
使用叢集EMR上的應用程式使用者界面在EC2任務上對 Amazon 是 是 是 
"elasticmapreduce:GetOnClusterAppUIPresignedURL"
使用 Spark 歷史記錄伺服器EMR在EKS任務執行時對 Amazon 是 是 是 
"elasticmapreduce:CreatePersistentAppUI",
"elasticmapreduce:DescribePersistentAppUI",
"elasticmapreduce:GetPersistentAppUIPresignedURL",
"emr-containers:ListVirtualClusters",
"emr-containers:DescribeVirtualCluster",
"emr-containers:ListJobRuns",
"emr-containers:DescribeJobRun",
"s3:ListBucket",
"s3:GetObject"
建立和刪除 Git 儲存庫 是 是 是 
"elasticmapreduce:CreateRepository", 
"elasticmapreduce:DeleteRepository",
"elasticmapreduce:ListRepositories",
"elasticmapreduce:DescribeRepository",
"secretsmanager:CreateSecret",
"secretsmanager:ListSecrets",
"secretsmanager:TagResource"
連結和解除連結 Git 儲存庫 是 是 是 
"elasticmapreduce:LinkRepository",
"elasticmapreduce:UnlinkRepository",
"elasticmapreduce:ListRepositories",
"elasticmapreduce:DescribeRepository"
從預先定義的叢集範本中建立新叢集 否 是 是 
"servicecatalog:SearchProducts", 
"servicecatalog:DescribeProduct",
"servicecatalog:DescribeProductView",
"servicecatalog:DescribeProvisioningParameters",
"servicecatalog:ProvisionProduct",
"servicecatalog:UpdateProvisionedProduct",
"servicecatalog:ListProvisioningArtifacts", 
"servicecatalog:DescribeRecord",
"servicecatalog:ListLaunchPaths",
"cloudformation:DescribeStackResources", 
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster"
提供叢集組態以建立新叢集。 否 否 是 
"elasticmapreduce:RunJobFlow",
"iam:PassRole",
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster"
使用IAM驗證模式時，將使用者指派給 Studio。 否 否 否 
"elasticmapreduce:CreateStudioPresignedUrl"
描述網路物件。 是 是 是 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DescribeNetwork",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource": "*"
        }
    ]
}
列出IAM角色。 是 是 是 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListIAMRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}
從 Amazon EMR 工作室 Connect 到 SageMaker 工作室，並使用資料牧馬人視覺化介面。 否 否 是 
"sagemaker:CreatePresignedDomainUrl",
"sagemaker:DescribeDomain",
"sagemaker:ListDomains",
"sagemaker:ListUserProfiles"
CodeWhisperer 在您的EMR工作室中使用 Amazon。 否 否 是 
"codewhisperer:GenerateRecommendations"
從您的EMR工作室訪問 Amazon Athena SQL 編輯。此清單可能不包含使用所有 Athena 功能所需的所有許可。如需最多 up-to-date 清單，請參閱 A thena 完整存取政策。 否 否 是 
"athena:StartQueryExecution",
"athena:StopQueryExecution",
"athena:GetQueryExecution",
"athena:GetQueryRuntimeStatistics",
"athena:GetQueryResults",
"athena:ListQueryExecutions",
"athena:BatchGetQueryExecution",
"athena:GetNamedQuery",
"athena:ListNamedQueries",
"athena:BatchGetNamedQuery",
"athena:UpdateNamedQuery",
"athena:DeleteNamedQuery",
"athena:ListDataCatalogs",
"athena:GetDataCatalog",
"athena:ListDatabases",
"athena:GetDatabase",
"athena:ListTableMetadata",
"athena:GetTableMetadata",
"athena:ListWorkGroups",
"athena:GetWorkGroup",
"athena:CreateNamedQuery",
"athena:GetPreparedStatement",
"glue:CreateDatabase",
"glue:DeleteDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:CreateTable",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:DeletePartition",
"glue:BatchDeletePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"kms:ListAliases",
"kms:ListKeys",
"kms:DescribeKey",
"lakeformation:GetDataAccess",
"s3:GetBucketLocation",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:PutObject",
"s3:PutBucketPublicAccessBlock",
"s3:ListAllMyBuckets"