AnalyticDB:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のAnalyticDB for MySQLリソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のAnalyticDB for MySQLリソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のAnalyticDB for MySQLアクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "adb:CheckApsTableAvailable",
          "adb:CheckFormationSchemaExists",
          "adb:CheckServiceLinkedRole",
          "adb:DescribeApsDatasource",
          "adb:DescribeApsDatasources",
          "adb:DescribeApsJobDetail",
          "adb:DescribeApsJobs",
          "adb:DescribeApsKafkaJsonLevels",
          "adb:DescribeApsKafkaSchemas",
          "adb:DescribeApsMigrationWorkloads",
          "adb:DescribeApsPartitionFormatters",
          "adb:DescribeApsPolarDBInstances",
          "adb:DescribeApsResourceGroups",
          "adb:DescribeApsSLSLatestLogs",
          "adb:DescribeApsSLSPartitionFormatters",
          "adb:DescribeApsSLSSchemas",
          "adb:DescribeApsWorkload",
          "adb:DescribeApsWorkloads",
          "adb:DescribeAutoRenewalAttribute",
          "adb:DescribeAvailableResource",
          "adb:DescribeClusterAccessWhiteList",
          "adb:DescribeComputeResource",
          "adb:DescribeDBClusterShardNumber",
          "adb:DescribeEIURange",
          "adb:DescribeFormationDatabricksMigrationObjects",
          "adb:DescribeHistoryEvents",
          "adb:DescribeHistoryTasks",
          "adb:DescribeHistoryTasksStat",
          "adb:DescribeKmsKeys",
          "adb:DescribeLLMAnswer",
          "adb:DescribeLLMSimilarQuestions",
          "adb:DescribeLogStoreKeys",
          "adb:DescribeLoghubDetail",
          "adb:DescribeMaintenanceAction",
          "adb:DescribeMsgClusterIds",
          "adb:DescribeMsgTopics",
          "adb:DescribePolarDBAiEngines",
          "adb:DescribePolarDBXToADBInstances",
          "adb:DescribeResourceGroupSpec",
          "adb:DescribeResultExportConfig",
          "adb:DescribeRunningBackupJob",
          "adb:DescribeSLSLogStores",
          "adb:DescribeSLSProjects",
          "adb:DescribeSLSRegions",
          "adb:DescribeSparkCodeLog",
          "adb:DescribeSparkCodeWebUi",
          "adb:GetActiveSparkSession",
          "adb:GetDmsDefaultWorkspace",
          "adb:GetFormationCrawler",
          "adb:GetLakeStorage",
          "adb:GetPipelineJob",
          "adb:GetSparkAppAttemptLog",
          "adb:GetSparkLogAnalyzeTask",
          "adb:GetSparkWarehouseBatchSQL",
          "adb:ListAfsBuckets",
          "adb:ListApsWebhook",
          "adb:ListBackupJobs",
          "adb:ListLakeStorageBuckets",
          "adb:ListLakeStorages",
          "adb:ListResultExportJobHistory",
          "adb:ListSparkLogAnalyzeTasks",
          "adb:ListSparkTemplateFileIds",
          "adb:ListSparkWarehouseBatchSQL",
          "adb:SubmitResultExportJob"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "adb:CancelActiveOperationTasks",
          "adb:CancelSparkWarehouseBatchSQL",
          "adb:CheckApsTableAvailable",
          "adb:CheckFormationSchemaExists",
          "adb:CheckServiceLinkedRole",
          "adb:ConfigureResultExport",
          "adb:CreateAPSJob",
          "adb:CreateAfsAccessKey",
          "adb:CreateAfsBucket",
          "adb:CreateAiMultimodalJob",
          "adb:CreateApsDatasoure",
          "adb:CreateApsKafkaADBJob",
          "adb:CreateApsKafkaHudiJob",
          "adb:CreateApsSlsADBJob",
          "adb:CreateApsSlsHudiJob",
          "adb:CreateBackup",
          "adb:CreateFormationCrawler",
          "adb:CreateLakeStorage",
          "adb:CreateLakeStorageAuthorizations",
          "adb:CreateLakeStorageBucket",
          "adb:CreateMaterializedViewRecommend",
          "adb:CreatePipelineJob",
          "adb:CreateServiceLinkedRole",
          "adb:DeleteApsDatasoure",
          "adb:DeleteApsWorkload",
          "adb:DeleteBackups",
          "adb:DeleteFormationCrawler",
          "adb:DeleteLakeStorage",
          "adb:DeleteLakeStorageAuthorizations",
          "adb:DeleteMaterializedView",
          "adb:DeleteMaterializedViewRecommend",
          "adb:DeletePipelineJob",
          "adb:DeleteSqlTemplate",
          "adb:DeleteSqlTemplateGroup",
          "adb:DescribeApsDatasource",
          "adb:DescribeApsDatasources",
          "adb:DescribeApsJobDetail",
          "adb:DescribeApsJobs",
          "adb:DescribeApsKafkaJsonLevels",
          "adb:DescribeApsKafkaSchemas",
          "adb:DescribeApsMigrationWorkloads",
          "adb:DescribeApsPartitionFormatters",
          "adb:DescribeApsPolarDBInstances",
          "adb:DescribeApsResourceGroups",
          "adb:DescribeApsSLSLatestLogs",
          "adb:DescribeApsSLSPartitionFormatters",
          "adb:DescribeApsSLSSchemas",
          "adb:DescribeApsWorkload",
          "adb:DescribeApsWorkloads",
          "adb:DescribeAutoRenewalAttribute",
          "adb:DescribeAvailableResource",
          "adb:DescribeClusterAccessWhiteList",
          "adb:DescribeComputeResource",
          "adb:DescribeDBClusterShardNumber",
          "adb:DescribeEIURange",
          "adb:DescribeFormationDatabricksMigrationObjects",
          "adb:DescribeHistoryEvents",
          "adb:DescribeHistoryTasks",
          "adb:DescribeHistoryTasksStat",
          "adb:DescribeKmsKeys",
          "adb:DescribeLLMAnswer",
          "adb:DescribeLLMSimilarQuestions",
          "adb:DescribeLogStoreKeys",
          "adb:DescribeLoghubDetail",
          "adb:DescribeMaintenanceAction",
          "adb:DescribeMsgClusterIds",
          "adb:DescribeMsgTopics",
          "adb:DescribePolarDBAiEngines",
          "adb:DescribePolarDBXToADBInstances",
          "adb:DescribeResourceGroupSpec",
          "adb:DescribeResultExportConfig",
          "adb:DescribeRunningBackupJob",
          "adb:DescribeSLSLogStores",
          "adb:DescribeSLSProjects",
          "adb:DescribeSLSRegions",
          "adb:DescribeSparkCodeLog",
          "adb:DescribeSparkCodeWebUi",
          "adb:ExecuteService",
          "adb:GetActiveSparkSession",
          "adb:GetDmsDefaultWorkspace",
          "adb:GetFormationCrawler",
          "adb:GetLakeStorage",
          "adb:GetPipelineJob",
          "adb:GetSparkAppAttemptLog",
          "adb:GetSparkLogAnalyzeTask",
          "adb:GetSparkWarehouseBatchSQL",
          "adb:GrantLakeStoragePermission",
          "adb:KillSparkEngine",
          "adb:KillSparkLogAnalyzeTask",
          "adb:ListAfsBuckets",
          "adb:ListApsWebhook",
          "adb:ListBackupJobs",
          "adb:ListLakeStorageBuckets",
          "adb:ListLakeStorages",
          "adb:ListResultExportJobHistory",
          "adb:ListSparkLogAnalyzeTasks",
          "adb:ListSparkTemplateFileIds",
          "adb:ListSparkWarehouseBatchSQL",
          "adb:ModifyActiveOperationMaintainConf",
          "adb:ModifyActiveOperationTasks",
          "adb:ModifyApsDatasoure",
          "adb:ModifyApsJob",
          "adb:ModifyApsKafkaADBJob",
          "adb:ModifyApsSlsADBJob",
          "adb:ModifyApsWorkload",
          "adb:ModifyApsWorkloadName",
          "adb:ModifyAutoRenewalAttribute",
          "adb:ModifyDBClusterShardNumber",
          "adb:ModifyDmsDefaultWorkspace",
          "adb:ModifyMaintenanceAction",
          "adb:ModifyMaterializedView",
          "adb:ModifyMaterializedViewRecommend",
          "adb:ModifySqlTemplateGroup",
          "adb:ModifySqlTemplatePosition",
          "adb:PauseApsWorkload",
          "adb:QueryFormationInstsByTaskID",
          "adb:QueryFormationTaskByID",
          "adb:QueryFormationTasksByType",
          "adb:QueryService",
          "adb:QueryTaskInfoByID",
          "adb:RevokeLakeStoragePermission",
          "adb:RunMaterializedViewRecommend",
          "adb:StartApsJob",
          "adb:StartApsWorkload",
          "adb:StartFormationCrawler",
          "adb:StartPipelineJob",
          "adb:StartSparkEngine",
          "adb:StopAiMultimodalJob",
          "adb:StopPipelineJob",
          "adb:SubmitResultExportJob",
          "adb:SuspendApsJob",
          "adb:UpdateFormationCrawler",
          "adb:UpdateFormationCrawlerScheduleState",
          "adb:UpdateLakeStorage",
          "adb:createCatalog",
          "adb:dropCatalog",
          "adb:getCatalogObjects",
          "adb:null"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問