DataWorks:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のDataWorksリソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のDataWorksリソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のDataWorksアクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dataworks:ListAlarmResource",
          "dataworks:ListContacts",
          "dataworks:ListResourceGroup",
          "dataworks:ListUserResources",
          "dataworks:ShowResourceGroupDetail"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "dataworks:AddDpProjectSubUser",
          "dataworks:AddDpProjectUserRole",
          "dataworks:AddDpTenantSubUser",
          "dataworks:AddEntityIntoMetaCollection",
          "dataworks:AddRecognizeRule",
          "dataworks:AddTenantMemberToRole",
          "dataworks:BatchUpdateTasks",
          "dataworks:BindDpSubUserAk",
          "dataworks:BindDpUserAk",
          "dataworks:CheckAbTestFeatures",
          "dataworks:CheckCallback",
          "dataworks:CheckProjectIdentifier",
          "dataworks:CheckRamPermissions",
          "dataworks:CloneDataSource",
          "dataworks:CreateBusiness",
          "dataworks:CreateComponent",
          "dataworks:CreateComputeResource",
          "dataworks:CreateDIJob",
          "dataworks:CreateDataAssetTag",
          "dataworks:CreateDataQualityAlertRule",
          "dataworks:CreateDataQualityScan",
          "dataworks:CreateDataQualityScanRun",
          "dataworks:CreateDataQualityTemplate",
          "dataworks:CreateDataSource",
          "dataworks:CreateDataSourceSharedRule",
          "dataworks:CreateDataWorksPayAsYouGoService",
          "dataworks:CreateDataset",
          "dataworks:CreateDatasetVersion",
          "dataworks:CreateDpProject",
          "dataworks:CreateDpSubUser",
          "dataworks:CreateFile",
          "dataworks:CreateFolder",
          "dataworks:CreateIdentifyCredential",
          "dataworks:CreateLineageRelationship",
          "dataworks:CreateMetaCollection",
          "dataworks:CreateProjectRole",
          "dataworks:CreateResourceFile",
          "dataworks:CreateRoute",
          "dataworks:CreateTask",
          "dataworks:CreateTenantRole",
          "dataworks:CreateUdfFile",
          "dataworks:CreateWorkflow",
          "dataworks:CreateWorkflowInstances",
          "dataworks:DataWorksMember",
          "dataworks:DeleteBusiness",
          "dataworks:DeleteCertificate",
          "dataworks:DeleteComponent",
          "dataworks:DeleteComputeResource",
          "dataworks:DeleteDataAssetTag",
          "dataworks:DeleteDataQualityAlertRule",
          "dataworks:DeleteDataQualityScan",
          "dataworks:DeleteDataQualityTemplate",
          "dataworks:DeleteDataSource",
          "dataworks:DeleteDataSourceSharedRule",
          "dataworks:DeleteDataset",
          "dataworks:DeleteDatasetVersion",
          "dataworks:DeleteDpProject",
          "dataworks:DeleteDpProjectSubUser",
          "dataworks:DeleteDpTenantSubUser",
          "dataworks:DeleteFile",
          "dataworks:DeleteFolder",
          "dataworks:DeleteLineageRelationship",
          "dataworks:DeleteMetaCollection",
          "dataworks:DeleteNetwork",
          "dataworks:DeleteProjectRole",
          "dataworks:DeleteRecognizeRule",
          "dataworks:DeleteTask",
          "dataworks:DeleteTenantRole",
          "dataworks:DeleteWorkflow",
          "dataworks:DeployFile",
          "dataworks:DsgDesensPlanAddOrUpdate",
          "dataworks:DsgDesensPlanDelete",
          "dataworks:DsgDesensPlanQueryList",
          "dataworks:DsgDesensPlanUpdateStatus",
          "dataworks:DsgPlatformQueryProjectsAndSchemaFromMeta",
          "dataworks:DsgQueryDesensStatusList",
          "dataworks:DsgQuerySensResult",
          "dataworks:DsgSceneAddOrUpdateScene",
          "dataworks:DsgSceneQuerySceneListByName",
          "dataworks:DsgScenedDeleteScene",
          "dataworks:DsgStopSensIdentify",
          "dataworks:DsgUpdateDesensStatusList",
          "dataworks:DsgUserGroupAddOrUpdate",
          "dataworks:DsgUserGroupDelete",
          "dataworks:DsgUserGroupGetOdpsRoleGroups",
          "dataworks:DsgUserGroupQueryList",
          "dataworks:DsgUserGroupQueryUserList",
          "dataworks:DsgWhiteListAddOrUpdate",
          "dataworks:DsgWhiteListDeleteList",
          "dataworks:DsgWhiteListQueryList",
          "dataworks:EditRecognizeRule",
          "dataworks:EstablishRelationTableToBusiness",
          "dataworks:ExecuteAdhocWorkflowInstance",
          "dataworks:GetBusiness",
          "dataworks:GetCatalog",
          "dataworks:GetCertificate",
          "dataworks:GetColumn",
          "dataworks:GetComponent",
          "dataworks:GetComputeResource",
          "dataworks:GetConfig",
          "dataworks:GetCreateWorkflowInstancesResult",
          "dataworks:GetDataQualityAlertRule",
          "dataworks:GetDataQualityScan",
          "dataworks:GetDataQualityScanRun",
          "dataworks:GetDataQualityScanRunLog",
          "dataworks:GetDataQualityTemplate",
          "dataworks:GetDataSource",
          "dataworks:GetDatabase",
          "dataworks:GetDataset",
          "dataworks:GetDatasetVersion",
          "dataworks:GetDeploymentPackage",
          "dataworks:GetDpProjectCreationInfo",
          "dataworks:GetFile",
          "dataworks:GetFileVersion",
          "dataworks:GetFolder",
          "dataworks:GetIDEEventDetail",
          "dataworks:GetJobStatus",
          "dataworks:GetLineageRelationship",
          "dataworks:GetMetaCollection",
          "dataworks:GetNetwork",
          "dataworks:GetPartition",
          "dataworks:GetRerunWorkflowInstancesResult",
          "dataworks:GetSchema",
          "dataworks:GetTable",
          "dataworks:GetTask",
          "dataworks:GetTaskInstance",
          "dataworks:GetTaskInstanceLog",
          "dataworks:GetTenantRole",
          "dataworks:GetUser",
          "dataworks:GetWorkflow",
          "dataworks:GetWorkflowInstance",
          "dataworks:ImportCertificate",
          "dataworks:ListAlarmResource",
          "dataworks:ListBusiness",
          "dataworks:ListCatalogs",
          "dataworks:ListCertificates",
          "dataworks:ListColumns",
          "dataworks:ListComponents",
          "dataworks:ListComputeResources",
          "dataworks:ListContacts",
          "dataworks:ListCrawlerTypes",
          "dataworks:ListDataAssetTags",
          "dataworks:ListDataAssets",
          "dataworks:ListDataQualityAlertRules",
          "dataworks:ListDataQualityScanRuns",
          "dataworks:ListDataQualityScans",
          "dataworks:ListDataQualityTemplates",
          "dataworks:ListDataSourceSharedRules",
          "dataworks:ListDataSources",
          "dataworks:ListDataWorksPayAsYouGoServices",
          "dataworks:ListDatabases",
          "dataworks:ListDatasetVersions",
          "dataworks:ListDatasets",
          "dataworks:ListDeploymentPackages",
          "dataworks:ListDownstreamTaskInstances",
          "dataworks:ListDownstreamTasks",
          "dataworks:ListDpProject",
          "dataworks:ListDpProjectUser",
          "dataworks:ListDpTenantUser",
          "dataworks:ListEntitiesInMetaCollection",
          "dataworks:ListFileVersions",
          "dataworks:ListFiles",
          "dataworks:ListFolders",
          "dataworks:ListLineageRelationships",
          "dataworks:ListLineages",
          "dataworks:ListMeasureData",
          "dataworks:ListMeasuresGroupByModule",
          "dataworks:ListMetaCollections",
          "dataworks:ListPartitions",
          "dataworks:ListPermissions",
          "dataworks:ListProjectIds",
          "dataworks:ListProjectModules",
          "dataworks:ListProjectProcesses",
          "dataworks:ListRegions",
          "dataworks:ListResourceGroup",
          "dataworks:ListSchemas",
          "dataworks:ListTables",
          "dataworks:ListTaskInstanceOperationLogs",
          "dataworks:ListTaskInstances",
          "dataworks:ListTaskOperationLogs",
          "dataworks:ListTasks",
          "dataworks:ListTenantMembers",
          "dataworks:ListTenantRoles",
          "dataworks:ListUpstreamTaskInstances",
          "dataworks:ListUpstreamTasks",
          "dataworks:ListUserResources",
          "dataworks:ListWorkflowInstances",
          "dataworks:ListWorkflows",
          "dataworks:MetaListDpOuterResource",
          "dataworks:MetaListDpTable",
          "dataworks:ModifyContacts",
          "dataworks:ModifyResourceGroup",
          "dataworks:MoveComponent",
          "dataworks:OpenDataWorksStandardService",
          "dataworks:PreviewDatasetVersion",
          "dataworks:QueryDefaultTemplate",
          "dataworks:QueryDefaultTemplates",
          "dataworks:QueryRecognizeDataByRuleType",
          "dataworks:QueryRecognizeRuleDetail",
          "dataworks:QueryRecognizeRulesType",
          "dataworks:QuerySensClassification",
          "dataworks:QuerySensLevel",
          "dataworks:QuerySensNodeInfo",
          "dataworks:RemoveEntityFromMetaCollection",
          "dataworks:RemoveProjectMembers",
          "dataworks:RemoveTaskInstanceDependencies",
          "dataworks:RemoveTenantMemberFromRole",
          "dataworks:RerunTaskInstances",
          "dataworks:RerunWorkflowInstances",
          "dataworks:ResumeTaskInstances",
          "dataworks:RunIdentifyOpenapi",
          "dataworks:SetConfig",
          "dataworks:SetSuccessTaskInstances",
          "dataworks:ShowResourceGroupDetail",
          "dataworks:StartWorkflowInstances",
          "dataworks:StopTaskInstances",
          "dataworks:StopWorkflowInstances",
          "dataworks:SubmitFile",
          "dataworks:SuspendTaskInstances",
          "dataworks:SyncRAMContactInfo",
          "dataworks:TagDataAssets",
          "dataworks:TerminateDISyncInstance",
          "dataworks:TestDataSourceConnectivity",
          "dataworks:TriggerSchedulerTaskInstance",
          "dataworks:UnTagDataAssets",
          "dataworks:UpdateBusiness",
          "dataworks:UpdateColumnBusinessMetadata",
          "dataworks:UpdateComponent",
          "dataworks:UpdateComputeResource",
          "dataworks:UpdateContactInfo",
          "dataworks:UpdateDataAssetTag",
          "dataworks:UpdateDataQualityAlertRule",
          "dataworks:UpdateDataQualityEvaluationTask",
          "dataworks:UpdateDataQualityScan",
          "dataworks:UpdateDataQualityTemplate",
          "dataworks:UpdateDataSource",
          "dataworks:UpdateDataset",
          "dataworks:UpdateDatasetVersion",
          "dataworks:UpdateFile",
          "dataworks:UpdateFolder",
          "dataworks:UpdateIDEEventResult",
          "dataworks:UpdateMetaCollection",
          "dataworks:UpdateProjectRole",
          "dataworks:UpdateTableBusinessMetadata",
          "dataworks:UpdateTask",
          "dataworks:UpdateTaskInstances",
          "dataworks:UpdateTenantRole",
          "dataworks:UpdateUdfFile",
          "dataworks:UpdateWorkflow",
          "dataworks:createIdentifyCredential"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問