AWS IAM角色访问Redshift:DescribeData
AWS IAM角色访问Redshift:DescribeData
提问于 2022-04-28 10:06:39
我对尝试从aws函数(更确切地说是“Redshift-data:DescribeStatement”)访问redshift-data感到绝望。我可以发送BatchStatements，但我不能接收它们，我认为这是条件的关键，我不知道它是如何工作的。
以下是我的IAM角色策略：
{
...
{
"Action": [
"redshift-data:BatchExecuteStatement"
],
"Resource": "arn:aws:redshift:eu-central-1:____________:cluster:a-cluster-name",
"Effect": "Allow",
"Sid": "RedshiftExecutionAccess"
},
{
"Condition": {
"StringLike": {
"redshift-data:statement-owner-iam-userid": [
"*"
]
}
},
"Action": [
"redshift-data:DescribeStatement"
],
"Resource": "arn:aws:redshift:eu-central-1:____________:cluster:a-cluster-name",
"Effect": "Allow",
"Sid": "RedshiftResultAccess"
}
}由以下无服务器语句生成：
...
- Sid: 'RedshiftExecutionAccess'
Effect: 'Allow'
Action: 'redshift-data:BatchExecuteStatement'
Resource: 'arn:aws:redshift:eu-central-1:____________:cluster:a-cluster-name'
- Sid: 'RedshiftResultAccess'
Effect: 'Allow'
Action: 'redshift-data:DescribeStatement'
Resource: 'arn:aws:redshift:eu-central-1:____________:cluster:a-cluster-name'
Condition:
StringLike:
redshift-data:statement-owner-iam-userid:
- '*'如前所述，BatchExecuteStatement通过了，但是DescribeStatement失败了，我不确定条件设置是否是问题所在。例外情况：
com.amazonaws.services.redshiftdataapi.model.AWSRedshiftDataAPIException: User: arn:aws:sts::____________:assumed-role/redshift-access-role/TrialUserImporter-dev-importer is not authorized to perform: redshift-data:DescribeStatement because no identity-based policy allows the redshift-data:DescribeStatement action (Service: AWSRedshiftDataAPI; Status Code: 400; Error Code: AccessDeniedException; Request ID: 20a9533e-e4a1-4d0b-870b-ac15431e554f; Proxy: null)有人知道我怎么解决这个问题吗？提前感谢
回答 1
Stack Overflow用户
发布于 2022-06-30 08:20:18
我使用资源作为"*“，它起作用了参见
{
"Sid": "DataAPIIAMSessionPermissionsRestriction",
"Action": [
"redshift-data:GetStatementResult",
"redshift-data:CancelStatement",
"redshift-data:DescribeStatement",
"redshift-data:ListStatements"
],
"Effect": "Allow",
"Resource": "*",
"Condition": {
"StringEquals": {
"redshift-data:statement-owner-iam-userid": "${aws:userid}"
}
}
}来自https://docs.aws.amazon.com/redshift/latest/mgmt/redshift-iam-access-control-identity-based.html
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/72041801
复制相关文章
相似问题
腾讯云开发者
