設定 Amazon EC2或 Amazon 的 EMR Studio 使用者許可 EKS - Amazon EMR
建立使用者角色建立使用者許可範例使用者政策IAM Studio 使用者的 許可

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

設定 Amazon EC2或 Amazon 的 EMR Studio 使用者許可 EKS

您必須設定 Amazon EMR Studio 的使用者許可政策，才能設定精細的使用者和群組許可。如需使用者許可如何在 EMR Studio 中運作的詳細資訊，請參閱 存取控制中的 Amazon EMR Studio 運作方式。

注意

本章節涵蓋的許可不會強制執行資料存取控制。若要管理輸入資料集的存取權限，應該為 Studio 使用的叢集設定許可。如需詳細資訊，請參閱Amazon EMR 中的安全。

為 IAM Identity Center 身分驗證模式建立 EMR Studio 使用者角色

使用 IAM Identity Center 身分驗證模式時，您必須建立 EMR Studio 使用者角色。

為 EMR Studio 建立使用者角色

  1. 遵循 AWS Identity and Access Management 使用者指南中建立角色以將許可委派給 AWS 服務中的指示來建立使用者角色。

    建立角色時，請使用下列信任關係政策。

    {
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "elasticmapreduce.amazonaws.com"
      },
      "Action": [
              "sts:AssumeRole",
              "sts:SetContext"
              ]
    }
  ]
}

  2. 移除預設角色許可和政策。

  3. 將使用者和群組指派給 Studio 之前，請將 EMR Studio 工作階段政策連接至使用者角色。如需有關如何建立工作階段政策的指示，請參閱 為 EMR Studio 使用者建立許可政策。

為 EMR Studio 使用者建立許可政策

請參閱下列各節，以建立 EMR Studio 的許可政策。

注意

若要設定儲存筆記本檔案的 Amazon S3 存取許可，以及在將 Workspaces 連結至 Git 儲存庫時設定讀取秘密的 AWS Secrets Manager 存取許可，請使用 EMR Studio 服務角色。

建立許可政策

建立一或多個IAM許可政策，指定使用者可在 Studio 中採取的動作。例如，可以使用此頁面上的範例政策，為基礎、中級和進階 Studio 使用者類型建立三個獨立的政策。

如需使用者可能執行的每個 Studio 操作的明細，以及執行每個操作所需的最低IAM動作，請參閱 AWS Identity and Access Management EMR Studio 使用者的 許可。如需建立政策的步驟，請參閱IAM《 使用者指南》中的建立IAM政策。

許可政策必須包含下列陳述式。

{
            "Sid": "AllowAddingTagsOnSecretsWithEMRStudioPrefix",
            "Effect": "Allow",
            "Action": "secretsmanager:TagResource",
            "Resource": "arn:aws:secretsmanager:*:*:secret:emr-studio-*"
},
{
            "Sid": "AllowPassingServiceRoleForWorkspaceCreation",
            "Action": "iam:PassRole",
            "Resource": [
                "arn:aws:iam::*:role/your-emr-studio-service-role"
            ],
            "Effect": "Allow"
}

設定工作區協同合作的擁有權

工作區協同合作可讓多位使用者同時在相同工作區中工作，並且可以使用工作區 UI 中的協同合作面板進行設定。若要查看和使用協同合作面板，使用者必須擁有下列許可。任何具有這些許可的使用者都可以查看和使用協同合作面板。

"elasticmapreduce:UpdateEditor",
"elasticmapreduce:PutWorkspaceAccess",
"elasticmapreduce:DeleteWorkspaceAccess",
"elasticmapreduce:ListWorkspaceAccessIdentities"

若要限制存取協同合作面板，可以使用標籤型存取控制。當使用者建立工作區時，EMRStudio 會套用一個預設標籤，其索引鍵為 creatorUserId，其值為建立工作區之使用者的 ID。

注意

EMR Studio 會將creatorUserId標籤新增至 2021 年 11 月 16 日之後建立的工作區。若要限制誰可為您在此日期之前建立的工作區設定協作，建議您手動將 creatorUserId 標籤新增至您的工作區，然後在使用者許可政策中使用標籤型存取控制。

下列範例陳述式可讓使用者為具有標籤金鑰 creatorUserId 的任何工作區設定協同合作，該標籤金鑰的值與使用者 ID (由政策變數 aws:userId 表示) 進行比對。換句話說，該陳述式可讓使用者為他們所建立的工作區設定協同合作。若要進一步了解政策變數，請參閱 IAM 使用者指南中的IAM政策元素：變數和標籤。

    {
        "Sid": "UserRolePermissionsForCollaboration",
        "Action": [
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Condition": {
            "StringEquals": {
                "elasticmapreduce:ResourceTag/creatorUserId": "${aws:userid}"
            }
        }
    }

建立使用者層級 Git 密碼政策

使用使用者層級許可

EMR Studio 會在建立 Git 秘密時自動新增for-use-with-amazon-emr-managed-user-policies標籤。如果您想要在使用者層級控制對 Git 秘密的存取，請將標籤型許可新增至 EMR Studio 使用者角色政策，secretsmanager:GetSecretValue如下所示從服務層級許可轉換為使用者層級許可。

如果您在 EMR Studio 服務角色政策secretsmanager:GetSecretValue中有 的現有許可，您應該移除這些許可。

從服務層級許可轉換為使用者層級許可

注意

for-use-with-amazon-emr-managed-user-policies 標籤可確保下列步驟 1 中的許可向工作區的建立者授予對 Git 密碼的存取權限。但是，如果您在 2023 年 9 月 1 日之前連結了 Git 儲存庫，則對應的 Git 密碼將會因其未套用 for-use-with-amazon-emr-managed-user-policies 標籤而遭到拒絕存取。若要套用使用者層級許可，您必須從 重新建立舊秘密， JupyterLab 並再次連結適當的 Git 儲存庫。

如需政策變數的詳細資訊，請參閱IAM《 使用者指南》中的IAM政策元素：變數和標籤。

  1. 將下列許可新增至 EMR Studio 使用者角色政策。其會使用 for-use-with-amazon-emr-managed-user-policies 索引鍵，且值為 "${aws:userid}"。

    {
   "Sid": "AllowSecretsManagerReadOnlyActionsWithEMRTags",
    "Effect": "Allow",
    "Action": "secretsmanager:GetSecretValue",
    "Resource": "arn:aws:secretsmanager:*:*:secret:*",
    "Condition": {
        "StringEquals": {
            "secretsmanager:ResourceTag/for-use-with-amazon-emr-managed-user-policies": "${aws:userid}"
        }
    }
}

  2. 如果存在，請從 EMR Studio 服務角色政策中移除下列許可。由於服務角色政策適用於每個使用者定義的所有密碼，您只需執行此動作一次。

    {
    "Sid": "AllowSecretsManagerReadOnlyActionsWithEMRTags", 
    "Effect": "Allow", 
    "Action": [ 
        "secretsmanager:GetSecretValue" 
     ], 
    "Resource": "arn:aws:secretsmanager:*:*:secret:*", 
    "Condition": {
        "StringEquals": {
            "aws:ResourceTag/for-use-with-amazon-emr-managed-policies": "true" 
        } 
    } 
}

使用服務層級許可

自 2023 年 9 月 1 日起，EMRStudio 會自動新增使用者層級存取控制的for-use-with-amazon-emr-managed-user-policies標籤。由於這是新增的功能，因此您可以繼續使用透過 Studio 服務角色中的 GetSecretValue許可所提供的服務層級存取。 EMR

對於 2023 年 9 月 1 日之前建立的秘密，EMRStudio 不會新增for-use-with-amazon-emr-managed-user-policies標籤。若要繼續使用服務層級許可，只要保留現有的 EMR Studio 服務角色和使用者角色許可即可。不過，若要限制可以存取個別密碼的人員，建議您遵循 使用使用者層級許可 中的步驟，手動將 for-use-with-amazon-emr-managed-user-policies 標籤新增至密碼，然後在使用者許可政策中使用標籤型存取控制。

如需政策變數的詳細資訊，請參閱IAM《 使用者指南》中的IAM政策元素：變數和標籤。

將許可政策連接至IAM您的身分

下表摘要說明您連接許可政策的IAM身分，視您的 EMR Studio 身分驗證模式而定。如需如何連接政策的指示，請參閱新增和移除IAM身分許可。

如果您使用... 將政策附接至...
IAM 身分驗證 您的身分 IAM （使用者、使用者群組或角色）。例如，可以將許可政策附接至 AWS 帳戶的使用者。
IAM 與外部身分提供者聯合 (IdP)

您為外部 IdP 建立IAM的角色。例如，IAM適用於 SAML 2.0 聯合的 。

EMR Studio 會使用您附加至IAM角色的許可，以供具有 Studio 聯合存取的使用者使用 （這些許可）。
IAM 身分中心 您的 Amazon EMR Studio 使用者角色。

範例使用者政策

下列基本使用者政策允許大多數 EMR Studio 動作，但不允許使用者建立新的 Amazon EMR叢集。

重要

範例政策不包含 CreateStudioPresignedUrl許可，當您使用IAM身分驗證模式時，必須為使用者允許此許可。如需詳細資訊，請參閱將使用者或群組指派給 EMR Studio。

範例政策包含強制執行標籤型存取控制 (TBAC) 的Condition元素，讓您可以使用政策搭配 EMR Studio 的範例服務角色。如需詳細資訊，請參閱建立 EMR Studio 服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowDefaultEC2SecurityGroupsCreationInVPCWithEMRTags",
         "Effect":"Allow",
         "Action":[
            "ec2:CreateSecurityGroup"
         ],
         "Resource":[
            "arn:aws:ec2:*:*:vpc/*"
         ],
         "Condition":{
            "StringEquals":{
               "aws:ResourceTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingEMRTagsDuringDefaultSecurityGroupCreation",
         "Effect":"Allow",
         "Action":[
            "ec2:CreateTags"
         ],
         "Resource":"arn:aws:ec2:*:*:security-group/*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true",
               "ec2:CreateAction":"CreateSecurityGroup"
            }
         }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      }
   ]
}

下列中繼使用者政策允許大多數 EMR Studio 動作，並允許使用者使用EMR叢集範本建立新的 Amazon 叢集。

重要

範例政策不包含 CreateStudioPresignedUrl許可，當您使用IAM身分驗證模式時，必須為使用者允許此許可。如需詳細資訊，請參閱將使用者或群組指派給 EMR Studio。

範例政策包含強制執行標籤型存取控制 (TBAC) 的Condition元素，讓您可以使用政策搭配 EMR Studio 的範例服務角色。如需詳細資訊，請參閱建立 EMR Studio 服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowEMRBasicActions",
         "Action":[
            "elasticmapreduce:CreateEditor",
            "elasticmapreduce:DescribeEditor",
            "elasticmapreduce:ListEditors",
            "elasticmapreduce:StartEditor",
            "elasticmapreduce:StopEditor",
            "elasticmapreduce:DeleteEditor",
            "elasticmapreduce:OpenEditorInConsole",
            "elasticmapreduce:AttachEditor",
            "elasticmapreduce:DetachEditor",
            "elasticmapreduce:CreateRepository",
            "elasticmapreduce:DescribeRepository",
            "elasticmapreduce:DeleteRepository",
            "elasticmapreduce:ListRepositories",
            "elasticmapreduce:LinkRepository",
            "elasticmapreduce:UnlinkRepository",
            "elasticmapreduce:DescribeCluster",
            "elasticmapreduce:ListInstanceGroups",
            "elasticmapreduce:ListBootstrapActions",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:ListSteps",
            "elasticmapreduce:CreatePersistentAppUI",
            "elasticmapreduce:DescribePersistentAppUI",
            "elasticmapreduce:GetPersistentAppUIPresignedURL",
            "elasticmapreduce:GetOnClusterAppUIPresignedURL"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRContainersBasicActions",
         "Action":[
            "emr-containers:DescribeVirtualCluster",
            "emr-containers:ListVirtualClusters",
            "emr-containers:DescribeManagedEndpoint",
            "emr-containers:ListManagedEndpoints",
            "emr-containers:DescribeJobRun",
            "emr-containers:ListJobRuns"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
          "Sid": "AllowRetrievingManagedEndpointCredentials",
          "Effect": "Allow",
          "Action": [
              "emr-containers:GetManagedEndpointSessionCredentials"
          ],
          "Resource": [
              "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>"
          ],
          "Condition": {
              "StringEquals": {
                  "emr-containers:ExecutionRoleArn": [
                      "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>"
                  ]
              }
          }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowClusterTemplateRelatedIntermediateActions",
         "Action":[
            "servicecatalog:DescribeProduct",
            "servicecatalog:DescribeProductView",
            "servicecatalog:DescribeProvisioningParameters",
            "servicecatalog:ProvisionProduct",
            "servicecatalog:SearchProducts",
            "servicecatalog:UpdateProvisionedProduct",
            "servicecatalog:ListProvisioningArtifacts",
            "servicecatalog:ListLaunchPaths",
            "servicecatalog:DescribeRecord",
            "cloudformation:DescribeStackResources"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      },
      {
         "Sid": "AllowServerlessActions",
         "Action": [
            "emr-serverless:CreateApplication",
            "emr-serverless:UpdateApplication",
            "emr-serverless:DeleteApplication",
            "emr-serverless:ListApplications",
            "emr-serverless:GetApplication",
            "emr-serverless:StartApplication",
            "emr-serverless:StopApplication",
            "emr-serverless:StartJobRun",
            "emr-serverless:CancelJobRun",
            "emr-serverless:ListJobRuns",
            "emr-serverless:GetJobRun",
            "emr-serverless:GetDashboardForJobRun",
            "emr-serverless:AccessInteractiveEndpoints"
         ],
         "Resource": "*",
         "Effect": "Allow"
        },
        {
           "Sid": "AllowPassingRuntimeRoleForRunningServerlessJob",
           "Action": "iam:PassRole",
           "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
           "Effect": "Allow"
        }
   ]
}

下列進階使用者政策允許所有 EMR Studio 動作，並允許使用者使用EMR叢集範本或提供叢集組態來建立新的 Amazon 叢集。

重要

範例政策不包含 CreateStudioPresignedUrl許可，當您使用IAM身分驗證模式時，必須為使用者允許此許可。如需詳細資訊，請參閱將使用者或群組指派給 EMR Studio。

範例政策包含強制執行標籤型存取控制 (TBAC) 的Condition元素，讓您可以使用政策搭配 EMR Studio 的範例服務角色。如需詳細資訊，請參閱建立 EMR Studio 服務角色。

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AllowEMRBasicActions",
         "Action":[
            "elasticmapreduce:CreateEditor",
            "elasticmapreduce:DescribeEditor",
            "elasticmapreduce:ListEditors",
            "elasticmapreduce:StartEditor",
            "elasticmapreduce:StopEditor",
            "elasticmapreduce:DeleteEditor",
            "elasticmapreduce:OpenEditorInConsole",
            "elasticmapreduce:AttachEditor",
            "elasticmapreduce:DetachEditor",
            "elasticmapreduce:CreateRepository",
            "elasticmapreduce:DescribeRepository",
            "elasticmapreduce:DeleteRepository",
            "elasticmapreduce:ListRepositories",
            "elasticmapreduce:LinkRepository",
            "elasticmapreduce:UnlinkRepository",
            "elasticmapreduce:DescribeCluster",
            "elasticmapreduce:ListInstanceGroups",
            "elasticmapreduce:ListBootstrapActions",
            "elasticmapreduce:ListClusters",
            "elasticmapreduce:ListSteps",
            "elasticmapreduce:CreatePersistentAppUI",
            "elasticmapreduce:DescribePersistentAppUI",
            "elasticmapreduce:GetPersistentAppUIPresignedURL",
            "elasticmapreduce:GetOnClusterAppUIPresignedURL"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRContainersBasicActions",
         "Action":[
            "emr-containers:DescribeVirtualCluster",
            "emr-containers:ListVirtualClusters",
            "emr-containers:DescribeManagedEndpoint",
            "emr-containers:ListManagedEndpoints",
            "emr-containers:DescribeJobRun",
            "emr-containers:ListJobRuns"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
          "Sid": "AllowRetrievingManagedEndpointCredentials",
          "Effect": "Allow",
          "Action": [
              "emr-containers:GetManagedEndpointSessionCredentials"
          ],
          "Resource": [
              "arn:aws:emr-containers:<region>:<account-id>:/virtualclusters/<virtual-cluster-id>/endpoints/<managed-endpoint-id>"
          ],
          "Condition": {
              "StringEquals": {
                  "emr-containers:ExecutionRoleArn": [
                      "arn:aws:iam::<account-id>:role/<emr-on-eks-execution-role>"
                  ]
              }
          }
      },
      {
         "Sid":"AllowSecretManagerListSecrets",
         "Action":[
            "secretsmanager:ListSecrets"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowSecretCreationWithEMRTagsAndEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:CreateSecret",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*",
         "Condition":{
            "StringEquals":{
               "aws:RequestTag/for-use-with-amazon-emr-managed-policies":"true"
            }
         }
      },
      {
         "Sid":"AllowAddingTagsOnSecretsWithEMRStudioPrefix",
         "Effect":"Allow",
         "Action":"secretsmanager:TagResource",
         "Resource":"arn:aws:secretsmanager:*:*:secret:emr-studio-*"
      },
      {
         "Sid":"AllowClusterTemplateRelatedIntermediateActions",
         "Action":[
            "servicecatalog:DescribeProduct",
            "servicecatalog:DescribeProductView",
            "servicecatalog:DescribeProvisioningParameters",
            "servicecatalog:ProvisionProduct",
            "servicecatalog:SearchProducts",
            "servicecatalog:UpdateProvisionedProduct",
            "servicecatalog:ListProvisioningArtifacts",
            "servicecatalog:ListLaunchPaths",
            "servicecatalog:DescribeRecord",
            "cloudformation:DescribeStackResources"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowEMRCreateClusterAdvancedActions",
         "Action":[
            "elasticmapreduce:RunJobFlow"
         ],
         "Resource":"*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowPassingServiceRoleForWorkspaceCreation",
         "Action":"iam:PassRole",
         "Resource":[
            "arn:aws:iam::*:role/<your-emr-studio-service-role>",
            "arn:aws:iam::*:role/EMR_DefaultRole_V2",
            "arn:aws:iam::*:role/EMR_EC2_DefaultRole"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ListAndLocationPermissions",
         "Action":[
            "s3:ListAllMyBuckets",
            "s3:ListBucket",
            "s3:GetBucketLocation"
         ],
         "Resource":"arn:aws:s3:::*",
         "Effect":"Allow"
      },
      {
         "Sid":"AllowS3ReadOnlyAccessToLogs",
         "Action":[
            "s3:GetObject"
         ],
         "Resource":[
            "arn:aws:s3:::aws-logs-<aws-account-id>-<region>/elasticmapreduce/*"
         ],
         "Effect":"Allow"
      },
      {
         "Sid":"AllowConfigurationForWorkspaceCollaboration",
         "Action":[
            "elasticmapreduce:UpdateEditor",
            "elasticmapreduce:PutWorkspaceAccess",
            "elasticmapreduce:DeleteWorkspaceAccess",
            "elasticmapreduce:ListWorkspaceAccessIdentities"
         ],
         "Resource":"*",
         "Effect":"Allow",
         "Condition":{
            "StringEquals":{
               "elasticmapreduce:ResourceTag/creatorUserId":"${aws:userId}"
            }
         }
      },
      {
         "Sid" : "SageMakerDataWranglerForEMRStudio",
         "Effect" : "Allow",
         "Action" : [
            "sagemaker:CreatePresignedDomainUrl",
            "sagemaker:DescribeDomain",
            "sagemaker:ListDomains",
            "sagemaker:ListUserProfiles"
         ],
         "Resource":"*"
      },
      {
         "Sid":"DescribeNetwork",
         "Effect":"Allow",
         "Action":[
            "ec2:DescribeVpcs",
            "ec2:DescribeSubnets",
            "ec2:DescribeSecurityGroups"
         ],
         "Resource":"*"
      },
      {
         "Sid":"ListIAMRoles",
         "Effect":"Allow",
         "Action":[
            "iam:ListRoles"
         ],
         "Resource":"*"
      },
      {
         "Sid": "AllowServerlessActions",
         "Action": [
            "emr-serverless:CreateApplication",
            "emr-serverless:UpdateApplication",
            "emr-serverless:DeleteApplication",
            "emr-serverless:ListApplications",
            "emr-serverless:GetApplication",
            "emr-serverless:StartApplication",
            "emr-serverless:StopApplication",
            "emr-serverless:StartJobRun",
            "emr-serverless:CancelJobRun",
            "emr-serverless:ListJobRuns",
            "emr-serverless:GetJobRun",
            "emr-serverless:GetDashboardForJobRun",
            "emr-serverless:AccessInteractiveEndpoints"
         ],
         "Resource": "*",
         "Effect": "Allow"
      },
      {
         "Sid": "AllowPassingRuntimeRoleForRunningServerlessJob",
         "Action": "iam:PassRole",
         "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
         "Effect": "Allow"
      },
      {
         "Sid": "AllowCodeWhisperer",
         "Effect": "Allow", 
         "Action": [ "codewhisperer:GenerateRecommendations" ], 
         "Resource": "*" 
      },
      {
         "Sid": "AllowAthenaSQL",
         "Action": [
            "athena:StartQueryExecution",
            "athena:StopQueryExecution",
            "athena:GetQueryExecution",
            "athena:GetQueryRuntimeStatistics",
            "athena:GetQueryResults",
            "athena:ListQueryExecutions",
            "athena:BatchGetQueryExecution",
            "athena:GetNamedQuery",
            "athena:ListNamedQueries",
            "athena:BatchGetNamedQuery",
            "athena:UpdateNamedQuery",
            "athena:DeleteNamedQuery",
            "athena:ListDataCatalogs",
            "athena:GetDataCatalog",
            "athena:ListDatabases",
            "athena:GetDatabase",
            "athena:ListTableMetadata",
            "athena:GetTableMetadata",
            "athena:ListWorkGroups",
            "athena:GetWorkGroup",
            "athena:CreateNamedQuery",
            "athena:GetPreparedStatement",
            "glue:CreateDatabase",
            "glue:DeleteDatabase",
            "glue:GetDatabase",
            "glue:GetDatabases",
            "glue:UpdateDatabase",
            "glue:CreateTable",
            "glue:DeleteTable",
            "glue:BatchDeleteTable",
            "glue:UpdateTable",
            "glue:GetTable",
            "glue:GetTables",
            "glue:BatchCreatePartition",
            "glue:CreatePartition",
            "glue:DeletePartition",
            "glue:BatchDeletePartition",
            "glue:UpdatePartition",
            "glue:GetPartition",
            "glue:GetPartitions",
            "glue:BatchGetPartition",
            "kms:ListAliases",
            "kms:ListKeys",
            "kms:DescribeKey",
            "lakeformation:GetDataAccess",
            "s3:GetBucketLocation",
            "s3:GetBucketLocation",
            "s3:GetObject",
            "s3:ListBucket",
            "s3:ListBucketMultipartUploads",
            "s3:ListMultipartUploadParts",
            "s3:AbortMultipartUpload",
            "s3:PutObject",
            "s3:PutBucketPublicAccessBlock",
            "s3:ListAllMyBuckets"
         ],
         "Resource": "*",
         "Effect": "Allow"
      }
   ]
}

下列使用者政策包含將無EMR伺服器互動式應用程式與 EMR Studio Workspaces 搭配使用所需的最低使用者許可。

在此範例政策中， 具有使用 EMR Studio EMR 的 Serverless 互動式應用程式的使用者許可，請將 serverless-runtime-role和 的預留位置取代emr-studio-service-role為您正確的 EMR Studio 服務角色和 EMR Serverless 執行期角色。

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowServerlessActions",
            "Action": [
                "emr-serverless:CreateApplication",
                "emr-serverless:UpdateApplication",
                "emr-serverless:DeleteApplication",
                "emr-serverless:ListApplications",
                "emr-serverless:GetApplication",
                "emr-serverless:StartApplication",
                "emr-serverless:StopApplication",
                "emr-serverless:StartJobRun",
                "emr-serverless:CancelJobRun",
                "emr-serverless:ListJobRuns",
                "emr-serverless:GetJobRun",
                "emr-serverless:GetDashboardForJobRun",
                "emr-serverless:AccessInteractiveEndpoints"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowEMRBasicActions",
            "Action": [
                "elasticmapreduce:CreateEditor",
                "elasticmapreduce:DescribeEditor",
                "elasticmapreduce:ListEditors",
                "elasticmapreduce:UpdateStudio",                
                "elasticmapreduce:StartEditor",
                "elasticmapreduce:StopEditor",
                "elasticmapreduce:DeleteEditor",
                "elasticmapreduce:OpenEditorInConsole",
                "elasticmapreduce:AttachEditor",
                "elasticmapreduce:DetachEditor",
                "elasticmapreduce:CreateStudio",
                "elasticmapreduce:DescribeStudio",
                "elasticmapreduce:DeleteStudio",
                "elasticmapreduce:ListStudios",
                "elasticmapreduce:CreateStudioPresignedUrl"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowPassingRuntimeRoleForRunningEMRServerlessJob",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/serverless-runtime-role",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowPassingServiceRoleForWorkspaceCreation",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/emr-studio-service-role",
            "Effect": "Allow"
        },
        {
            "Sid": "AllowS3ListAndGetPermissions",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "s3:GetBucketLocation",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::*",
            "Effect": "Allow"
        },
        {
            "Sid":"DescribeNetwork",
            "Effect":"Allow",
            "Action":[
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource":"*"
        },
        {
            "Sid": "ListIAMRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}

AWS Identity and Access Management EMR Studio 使用者的 許可

下表包含使用者可能執行的每個 Amazon EMR Studio 操作，並列出執行該操作所需的最低IAM動作。您可以在 Studio 的IAM許可政策 （使用IAM身分驗證時） 或使用者角色工作階段政策 （使用IAM身分中心身分驗證時） 中允許這些動作EMR。

資料表也會顯示 EMR Studio 每個範例許可政策中允許的操作。如需有關範例許可政策的詳細資訊，請參閱 為 EMR Studio 使用者建立許可政策。

動作 基本 中級 Advanced (進階) 關聯動作
建立和刪除工作區 是 是 是 
"elasticmapreduce:CreateEditor", 
"elasticmapreduce:DescribeEditor",
"elasticmapreduce:ListEditors", 
"elasticmapreduce:DeleteEditor"
檢視協同合作面板，啟用工作區協同合作，以及新增協同合作者。如需詳細資訊，請參閱設定工作區協同合作的擁有權。 是 是 是 
"elasticmapreduce:UpdateEditor",
"elasticmapreduce:PutWorkspaceAccess",
"elasticmapreduce:DeleteWorkspaceAccess",
"elasticmapreduce:ListWorkspaceAccessIdentities"
建立新EMR叢集時，請參閱與 Studio 相同帳戶中的 Amazon S3 Control 儲存貯體清單，並在使用 Web UI 對應用程式進行偵錯時存取容器日誌 是 是 是 
"s3:ListAllMyBuckets",
"s3:ListBucket", 
"s3:GetBucketLocation",
"s3:GetObject"
存取工作區 是 是 是 
"elasticmapreduce:DescribeEditor", 
"elasticmapreduce:ListEditors",
"elasticmapreduce:StartEditor", 
"elasticmapreduce:StopEditor",
"elasticmapreduce:OpenEditorInConsole"
連接或分離與工作區相關聯的現有 Amazon EMR叢集 是 是 是 
"elasticmapreduce:AttachEditor",
"elasticmapreduce:DetachEditor",
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster",
"elasticmapreduce:ListInstanceGroups",
"elasticmapreduce:ListBootstrapActions"
在EKS叢集EMR上連接或分離 Amazon 是 是 是 
"elasticmapreduce:AttachEditor", 
"elasticmapreduce:DetachEditor",
"emr-containers:ListVirtualClusters", 
"emr-containers:DescribeVirtualCluster",
"emr-containers:ListManagedEndpoints",
"emr-containers:DescribeManagedEndpoint",
"emr-containers:GetManagedEndpointSessionCredentials"
連接或分離與工作區相關聯的無EMR伺服器應用程式 否 是 是 
"elasticmapreduce:AttachEditor",
"elasticmapreduce:DetachEditor",
"emr-serverless:GetApplication",
"emr-serverless:StartApplication",
"emr-serverless:ListApplications",
"emr-serverless:GetDashboardForJobRun",
"emr-serverless:AccessInteractiveEndpoints",
"iam:PassRole"

需要 PassRole許可才能傳遞 EMR Serverless 任務執行期角色。如需詳細資訊，請參閱《Amazon EMR Serverless 使用者指南》中的任務執行期角色。
在具有持久性應用程式使用者介面EC2的任務EMR上對 Amazon 進行偵錯 是 是 是 
"elasticmapreduce:CreatePersistentAppUI",
"elasticmapreduce:DescribePersistentAppUI",
"elasticmapreduce:GetPersistentAppUIPresignedURL",
"elasticmapreduce:ListClusters",
"elasticmapreduce:ListSteps",
"elasticmapreduce:DescribeCluster",
"s3:ListBucket",
"s3:GetObject"
使用叢集上應用程式使用者介面在EC2任務EMR上偵錯 Amazon 是 是 是 
"elasticmapreduce:GetOnClusterAppUIPresignedURL"
使用 Spark 歷史記錄伺服器偵錯 Amazon EMR EKS任務執行 是 是 是 
"elasticmapreduce:CreatePersistentAppUI",
"elasticmapreduce:DescribePersistentAppUI",
"elasticmapreduce:GetPersistentAppUIPresignedURL",
"emr-containers:ListVirtualClusters",
"emr-containers:DescribeVirtualCluster",
"emr-containers:ListJobRuns",
"emr-containers:DescribeJobRun",
"s3:ListBucket",
"s3:GetObject"
建立和刪除 Git 儲存庫 是 是 是 
"elasticmapreduce:CreateRepository", 
"elasticmapreduce:DeleteRepository",
"elasticmapreduce:ListRepositories",
"elasticmapreduce:DescribeRepository",
"secretsmanager:CreateSecret",
"secretsmanager:ListSecrets",
"secretsmanager:TagResource"
連結和解除連結 Git 儲存庫 是 是 是 
"elasticmapreduce:LinkRepository",
"elasticmapreduce:UnlinkRepository",
"elasticmapreduce:ListRepositories",
"elasticmapreduce:DescribeRepository"
從預先定義的叢集範本中建立新叢集 否 是 是 
"servicecatalog:SearchProducts", 
"servicecatalog:DescribeProduct",
"servicecatalog:DescribeProductView",
"servicecatalog:DescribeProvisioningParameters",
"servicecatalog:ProvisionProduct",
"servicecatalog:UpdateProvisionedProduct",
"servicecatalog:ListProvisioningArtifacts", 
"servicecatalog:DescribeRecord",
"servicecatalog:ListLaunchPaths",
"cloudformation:DescribeStackResources", 
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster"
提供叢集組態以建立新叢集。 否 否 是 
"elasticmapreduce:RunJobFlow",
"iam:PassRole",
"elasticmapreduce:ListClusters",
"elasticmapreduce:DescribeCluster"
當您使用IAM身分驗證模式時，將使用者指派給 Studio。 否 否 否 
"elasticmapreduce:CreateStudioPresignedUrl"
描述網路物件。 是 是 是 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DescribeNetwork",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource": "*"
        }
    ]
}
列出IAM角色。 是 是 是 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListIAMRoles",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles"
            ],
            "Resource": "*"
        }
    ]
}
從 Amazon SageMaker AI EMR Studio 連線至 Studio，並使用 Data Wrangler 視覺化界面。 否 否 是 
"sagemaker:CreatePresignedDomainUrl",
"sagemaker:DescribeDomain",
"sagemaker:ListDomains",
"sagemaker:ListUserProfiles"
在 EMR Studio CodeWhisperer 中使用 Amazon。 否 否 是 
"codewhisperer:GenerateRecommendations"
從 EMR Studio 存取 Amazon Athena SQL編輯器。此清單可能不包含使用所有 Athena 功能所需的所有許可。如需最多 up-to-date清單，請參閱 Athena 完整存取政策。 否 否 是 
"athena:StartQueryExecution",
"athena:StopQueryExecution",
"athena:GetQueryExecution",
"athena:GetQueryRuntimeStatistics",
"athena:GetQueryResults",
"athena:ListQueryExecutions",
"athena:BatchGetQueryExecution",
"athena:GetNamedQuery",
"athena:ListNamedQueries",
"athena:BatchGetNamedQuery",
"athena:UpdateNamedQuery",
"athena:DeleteNamedQuery",
"athena:ListDataCatalogs",
"athena:GetDataCatalog",
"athena:ListDatabases",
"athena:GetDatabase",
"athena:ListTableMetadata",
"athena:GetTableMetadata",
"athena:ListWorkGroups",
"athena:GetWorkGroup",
"athena:CreateNamedQuery",
"athena:GetPreparedStatement",
"glue:CreateDatabase",
"glue:DeleteDatabase",
"glue:GetDatabase",
"glue:GetDatabases",
"glue:UpdateDatabase",
"glue:CreateTable",
"glue:DeleteTable",
"glue:BatchDeleteTable",
"glue:UpdateTable",
"glue:GetTable",
"glue:GetTables",
"glue:BatchCreatePartition",
"glue:CreatePartition",
"glue:DeletePartition",
"glue:BatchDeletePartition",
"glue:UpdatePartition",
"glue:GetPartition",
"glue:GetPartitions",
"glue:BatchGetPartition",
"kms:ListAliases",
"kms:ListKeys",
"kms:DescribeKey",
"lakeformation:GetDataAccess",
"s3:GetBucketLocation",
"s3:GetBucketLocation",
"s3:GetObject",
"s3:ListBucket",
"s3:ListBucketMultipartUploads",
"s3:ListMultipartUploadParts",
"s3:AbortMultipartUpload",
"s3:PutObject",
"s3:PutBucketPublicAccessBlock",
"s3:ListAllMyBuckets"