E-MapReduce:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のE-MapReduce (EMR)リソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のE-MapReduce (EMR)リソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のE-MapReduce (EMR)アクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "emr:GetApiTemplate",
          "emr:GetApplicationActions",
          "emr:GetAuditLogs",
          "emr:GetBackPlanInfo",
          "emr:GetBackupInfo",
          "emr:GetBackupRuleInfo",
          "emr:GetClusterCost",
          "emr:GetCostUploadSignature",
          "emr:GetDisasterRecoveryPlan",
          "emr:GetDoctorComputeSummary",
          "emr:GetDoctorHBaseRegion",
          "emr:GetDoctorHBaseRegionServer",
          "emr:GetDoctorHBaseTable",
          "emr:GetDoctorHDFSCluster",
          "emr:GetDoctorHDFSDirectory",
          "emr:GetFlowAgentTrackStatus",
          "emr:GetFlowAuditLogs",
          "emr:GetFlowEntityRelationGraph",
          "emr:GetMetadataTypeList",
          "emr:GetOverview",
          "emr:GetPriceForCreate",
          "emr:GetPriceForCreateOnKubeCluster",
          "emr:GetReleaseVersion",
          "emr:GetSlsTempToken",
          "emr:GetSupportApplications",
          "emr:ListAdviceAction",
          "emr:ListAlertContacts",
          "emr:ListApmMetadata",
          "emr:ListApplicationConfigVersions",
          "emr:ListBackupPlans",
          "emr:ListBackupRules",
          "emr:ListBackups",
          "emr:ListClusterAttach",
          "emr:ListClusterBootstrapActions",
          "emr:ListClusterCosts",
          "emr:ListClusterForAdmin",
          "emr:ListClusterForOuter",
          "emr:ListClusterHostComponentForAdmin",
          "emr:ListClusterOperationHostTask",
          "emr:ListClusterServiceConfigHistoryForAdmin",
          "emr:ListClusterTag",
          "emr:ListClusterTagForAdmin",
          "emr:ListClusterTypes",
          "emr:ListComponentDefaultTopologies",
          "emr:ListDependApplications",
          "emr:ListDisasterRecoveryPlans",
          "emr:ListDisasterRecoveryRecords",
          "emr:ListDiskOpsEvents",
          "emr:ListDoctorComputeSummary",
          "emr:ListDoctorHBaseRegionServers",
          "emr:ListDoctorHBaseTables",
          "emr:ListDoctorJobsStats",
          "emr:ListEcsInstances",
          "emr:ListEmrAvailableConfig",
          "emr:ListEmrAvailableMetaType",
          "emr:ListEmrAvailableResource",
          "emr:ListEmrMainVersion",
          "emr:ListEmrMainVersionServiceGroup",
          "emr:ListEmrMainVersions",
          "emr:ListExecutePlanMigrateInfo",
          "emr:ListExecutionPlanInstanceTrend",
          "emr:ListFailureJobExecutionInstances",
          "emr:ListFeatures",
          "emr:ListFlowClusterAllHosts",
          "emr:ListFlowClusterK8sNamespace",
          "emr:ListFlowEntitySnapshot",
          "emr:ListFlowProjectClusterSetting",
          "emr:ListFlowProjectUser",
          "emr:ListGlobalConfigs",
          "emr:ListHealthRule",
          "emr:ListJobExecutionInstanceTrend",
          "emr:ListJobExecutionInstances",
          "emr:ListJobExecutionPlanHierarchy",
          "emr:ListJobInstanceWorkers",
          "emr:ListJobMigrateInfo",
          "emr:ListKMSKeys",
          "emr:ListKafkaReassign",
          "emr:ListKafkaReassignForAdmin",
          "emr:ListKafkaReassignTopic",
          "emr:ListKafkaTopicStatistics",
          "emr:ListKafkaTopicStatisticsForAdmin",
          "emr:ListKeyPairNames",
          "emr:ListLibraries",
          "emr:ListLibraryInstallTasks",
          "emr:ListLibraryStatus",
          "emr:ListLocalDiskComponentInfo",
          "emr:ListMetaCluster",
          "emr:ListMetaDataSourceForOuter",
          "emr:ListMetaDatabaseForOuter",
          "emr:ListMetaTableColumnForOuter",
          "emr:ListMetaTableForOuter",
          "emr:ListMetaTablePartitionForOuter",
          "emr:ListMetastoreTypes",
          "emr:ListMetricsToDisplay",
          "emr:ListNodeGroupSpecs",
          "emr:ListNotes",
          "emr:ListOperation",
          "emr:ListOperationActivity",
          "emr:ListOperationStageInstanceRelation",
          "emr:ListOperationTask",
          "emr:ListPrivateZones",
          "emr:ListRamRole",
          "emr:ListRamUsers",
          "emr:ListRdsDatabase",
          "emr:ListRdsInstance",
          "emr:ListRegions",
          "emr:ListReleaseVersions",
          "emr:ListResourcePoolForAdmin",
          "emr:ListScalingActivity",
          "emr:ListScalingActivityV2",
          "emr:ListScalingConfigItemV2",
          "emr:ListScalingGroupV2",
          "emr:ListSecurityGroups",
          "emr:ListServiceComponentTopology",
          "emr:ListSlsProject",
          "emr:ListStack",
          "emr:ListStackService",
          "emr:ListStreamingSqlQuery",
          "emr:ListSupportedServiceName",
          "emr:ListTagKeys",
          "emr:ListTagValues",
          "emr:ListUserStatistics",
          "emr:ListVpcInfo",
          "emr:ListVswitch",
          "emr:QueryGrafanaData",
          "emr:QueryInfoByToken",
          "emr:QueryLogKey",
          "emr:QueryPrice",
          "emr:QuerySlsMetricData",
          "emr:QueryTableData",
          "emr:QueryTrendData",
          "emr:QueryUserById"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "emr:AttachCluster",
          "emr:AttachClusterForNote",
          "emr:AuthRealName",
          "emr:BindPrivateZoneVpc",
          "emr:CheckAssumeRole",
          "emr:CheckDLFCatalogAuth",
          "emr:CheckProductActiveStatus",
          "emr:CheckRenewClusterForAdmin",
          "emr:CheckUserBalance",
          "emr:CheckUserRole",
          "emr:CleanupFlowEntitySnapshot",
          "emr:CommitFlowEntitySnapshot",
          "emr:CommonApiWhiteList",
          "emr:CreateAlertContact",
          "emr:CreateAlertDingDingGroup",
          "emr:CreateAlertUserGroup",
          "emr:CreateBackup",
          "emr:CreateBackupPlan",
          "emr:CreateBackupRule",
          "emr:CreateCloudNativeCluster",
          "emr:CreateClusterBootstrapAction",
          "emr:CreateClusterCost",
          "emr:CreateClusterEni",
          "emr:CreateClusterTemplate",
          "emr:CreateClusterV3",
          "emr:CreateClusterWithTemplate",
          "emr:CreateClusterWithTemplateForInternal",
          "emr:CreateDisasterRecoveryPlan",
          "emr:CreateExternalUsers",
          "emr:CreateFlowProject",
          "emr:CreateFlowProjectClusterSetting",
          "emr:CreateJob",
          "emr:CreateJobExecutionPlanFolder",
          "emr:CreateLibrary",
          "emr:CreateMetaTablePreviewTask",
          "emr:CreateMetaTablePreviewTaskForOuter",
          "emr:CreateNote",
          "emr:CreateOnKubeCluster",
          "emr:CreateParagraph",
          "emr:CreateScalingGroupV2",
          "emr:CreateUserPassword",
          "emr:CreateUserStatistics",
          "emr:CreateVerificationCode",
          "emr:DeleteAlertContacts",
          "emr:DeleteAlertDingDingGroups",
          "emr:DeleteAlertUserGroups",
          "emr:DeleteApiTemplate",
          "emr:DeleteApplication",
          "emr:DeleteClusterBootstrapAction",
          "emr:DeleteClusterScript",
          "emr:DeleteClusterTemplate",
          "emr:DeleteDiagnoseReport",
          "emr:DeleteDisasterRecoveryPlan",
          "emr:DeleteExecutionPlan",
          "emr:DeleteFlowEditLock",
          "emr:DeleteFlowProject",
          "emr:DeleteFlowProjectById",
          "emr:DeleteFlowProjectClusterSetting",
          "emr:DeleteFlowProjectUser",
          "emr:DeleteJob",
          "emr:DeleteJobExecutionPlanFolder",
          "emr:DeleteJobExecutionPlanParam",
          "emr:DeleteLibraries",
          "emr:DeleteNote",
          "emr:DeleteParagraph",
          "emr:DeleteScalingRule",
          "emr:DeleteScalingTaskGroup",
          "emr:DeleteUsers",
          "emr:DescribeAvailableInstanceType",
          "emr:DescribeClusterForInternal",
          "emr:DescribeClusterForOuter",
          "emr:DescribeClusterHealth",
          "emr:DescribeClusterOperationHostTaskLog",
          "emr:DescribeClusterResourcePoolSchedulerTypeForAdmin",
          "emr:DescribeClusterServiceConfigForAdmin",
          "emr:DescribeClusterServiceConfigTagForAdmin",
          "emr:DescribeClusterTemplate",
          "emr:DescribeDiskOpsActivity",
          "emr:DescribeEmrMainVersion",
          "emr:DescribeExecutionPlan",
          "emr:DescribeFlowAgentToken",
          "emr:DescribeFlowAgentUser",
          "emr:DescribeFlowEntitySnapshot",
          "emr:DescribeFlowNodeInstanceContainerLog",
          "emr:DescribeFlowProjectClusterSetting",
          "emr:DescribeJob",
          "emr:DescribeKafkaReassign",
          "emr:DescribeLibraryDetail",
          "emr:DescribeLibraryInstallTaskDetail",
          "emr:DescribeMetaDataSourceForOuter",
          "emr:DescribeMetaDatabaseForOuter",
          "emr:DescribeMetaTableColumnForOuter",
          "emr:DescribeMetaTablePartitionForOuter",
          "emr:DescribeMetaTablePreviewTask",
          "emr:DescribeMetaTablePreviewTaskForOuter",
          "emr:DescribeNote",
          "emr:DescribeOperationTask",
          "emr:DescribeParagraph",
          "emr:DescribeRdsInstance",
          "emr:DescribeScalingActivity",
          "emr:DescribeScalingCommonConfig",
          "emr:DescribeScalingGroupInstanceV2",
          "emr:DescribeScalingGroupV2",
          "emr:DescribeScalingMetrics",
          "emr:DescribeScalingRule",
          "emr:DescribeScalingTaskGroup",
          "emr:DescribeServiceConfigDefinition",
          "emr:DescribeServiceHealth",
          "emr:DescribeUserStatistics",
          "emr:DetachAndReleaseClusterEni",
          "emr:DetachCluster",
          "emr:DetachClusterForNote",
          "emr:DiffFlowEntitySnapshot",
          "emr:DumpMetaDataSourceForOuter",
          "emr:EnableApplication",
          "emr:ExecuteFsAction",
          "emr:ExecuteHiveSql",
          "emr:ExistsUser",
          "emr:GetApiTemplate",
          "emr:GetApplicationActions",
          "emr:GetAuditLogs",
          "emr:GetBackPlanInfo",
          "emr:GetBackupInfo",
          "emr:GetBackupRuleInfo",
          "emr:GetClusterCost",
          "emr:GetCostUploadSignature",
          "emr:GetDisasterRecoveryPlan",
          "emr:GetDoctorComputeSummary",
          "emr:GetDoctorHBaseRegion",
          "emr:GetDoctorHBaseRegionServer",
          "emr:GetDoctorHBaseTable",
          "emr:GetDoctorHDFSCluster",
          "emr:GetDoctorHDFSDirectory",
          "emr:GetFlowAgentTrackStatus",
          "emr:GetFlowAuditLogs",
          "emr:GetFlowEntityRelationGraph",
          "emr:GetMetadataTypeList",
          "emr:GetOverview",
          "emr:GetPriceForCreate",
          "emr:GetPriceForCreateOnKubeCluster",
          "emr:GetReleaseVersion",
          "emr:GetSlsTempToken",
          "emr:GetSupportApplications",
          "emr:HasRamOauthPolicy",
          "emr:IncreaseNodesDiskSize",
          "emr:InnerCheckAckInstance",
          "emr:InnerDescribeUserAccountStatus",
          "emr:InstallLibraries",
          "emr:KillExecutionJobInstance",
          "emr:KillExecutionPlanInstance",
          "emr:ListAdviceAction",
          "emr:ListAlertContacts",
          "emr:ListApmMetadata",
          "emr:ListApplicationConfigVersions",
          "emr:ListBackupPlans",
          "emr:ListBackupRules",
          "emr:ListBackups",
          "emr:ListClusterAttach",
          "emr:ListClusterBootstrapActions",
          "emr:ListClusterCosts",
          "emr:ListClusterForAdmin",
          "emr:ListClusterForOuter",
          "emr:ListClusterHostComponentForAdmin",
          "emr:ListClusterOperationHostTask",
          "emr:ListClusterServiceConfigHistoryForAdmin",
          "emr:ListClusterTag",
          "emr:ListClusterTagForAdmin",
          "emr:ListClusterTypes",
          "emr:ListComponentDefaultTopologies",
          "emr:ListDependApplications",
          "emr:ListDisasterRecoveryPlans",
          "emr:ListDisasterRecoveryRecords",
          "emr:ListDiskOpsEvents",
          "emr:ListDoctorComputeSummary",
          "emr:ListDoctorHBaseRegionServers",
          "emr:ListDoctorHBaseTables",
          "emr:ListDoctorJobsStats",
          "emr:ListEcsInstances",
          "emr:ListEmrAvailableConfig",
          "emr:ListEmrAvailableMetaType",
          "emr:ListEmrAvailableResource",
          "emr:ListEmrMainVersion",
          "emr:ListEmrMainVersionServiceGroup",
          "emr:ListEmrMainVersions",
          "emr:ListExecutePlanMigrateInfo",
          "emr:ListExecutionPlanInstanceTrend",
          "emr:ListFailureJobExecutionInstances",
          "emr:ListFeatures",
          "emr:ListFlowClusterAllHosts",
          "emr:ListFlowClusterK8sNamespace",
          "emr:ListFlowEntitySnapshot",
          "emr:ListFlowProjectClusterSetting",
          "emr:ListFlowProjectUser",
          "emr:ListGlobalConfigs",
          "emr:ListHealthRule",
          "emr:ListJobExecutionInstanceTrend",
          "emr:ListJobExecutionInstances",
          "emr:ListJobExecutionPlanHierarchy",
          "emr:ListJobInstanceWorkers",
          "emr:ListJobMigrateInfo",
          "emr:ListKMSKeys",
          "emr:ListKafkaReassign",
          "emr:ListKafkaReassignForAdmin",
          "emr:ListKafkaReassignTopic",
          "emr:ListKafkaTopicStatistics",
          "emr:ListKafkaTopicStatisticsForAdmin",
          "emr:ListKeyPairNames",
          "emr:ListLibraries",
          "emr:ListLibraryInstallTasks",
          "emr:ListLibraryStatus",
          "emr:ListLocalDiskComponentInfo",
          "emr:ListMetaCluster",
          "emr:ListMetaDataSourceForOuter",
          "emr:ListMetaDatabaseForOuter",
          "emr:ListMetaTableColumnForOuter",
          "emr:ListMetaTableForOuter",
          "emr:ListMetaTablePartitionForOuter",
          "emr:ListMetastoreTypes",
          "emr:ListMetricsToDisplay",
          "emr:ListNodeGroupSpecs",
          "emr:ListNotes",
          "emr:ListOperation",
          "emr:ListOperationActivity",
          "emr:ListOperationStageInstanceRelation",
          "emr:ListOperationTask",
          "emr:ListPrivateZones",
          "emr:ListRamRole",
          "emr:ListRamUsers",
          "emr:ListRdsDatabase",
          "emr:ListRdsInstance",
          "emr:ListRegions",
          "emr:ListReleaseVersions",
          "emr:ListResourcePoolForAdmin",
          "emr:ListScalingActivity",
          "emr:ListScalingActivityV2",
          "emr:ListScalingConfigItemV2",
          "emr:ListScalingGroupV2",
          "emr:ListSecurityGroups",
          "emr:ListServiceComponentTopology",
          "emr:ListSlsProject",
          "emr:ListStack",
          "emr:ListStackService",
          "emr:ListStreamingSqlQuery",
          "emr:ListSupportedServiceName",
          "emr:ListTagKeys",
          "emr:ListTagValues",
          "emr:ListUserStatistics",
          "emr:ListVpcInfo",
          "emr:ListVswitch",
          "emr:ManageUserPlatform",
          "emr:MetastoreCreateDatabase",
          "emr:MetastoreCreateKafkaTopic",
          "emr:MetastoreCreateTable",
          "emr:MetastoreDataPreview",
          "emr:MetastoreDeleteKafkaTopic",
          "emr:MetastoreDescribeDataSource",
          "emr:MetastoreDescribeDatabase",
          "emr:MetastoreDescribeKafkaConsumerGroup",
          "emr:MetastoreDescribeKafkaTopic",
          "emr:MetastoreDescribeTable",
          "emr:MetastoreDescribeTask",
          "emr:MetastoreDropDatabase",
          "emr:MetastoreDropTable",
          "emr:MetastoreListDataSource",
          "emr:MetastoreListDataSourceForAdmin",
          "emr:MetastoreListDatabases",
          "emr:MetastoreListKafkaConsumerGroup",
          "emr:MetastoreListKafkaTopic",
          "emr:MetastoreListKafkaTopicForAdmin",
          "emr:MetastoreListTablePartition",
          "emr:MetastoreListTables",
          "emr:MetastoreListTask",
          "emr:MetastoreRetryTask",
          "emr:MetastoreSearchTables",
          "emr:MetastoreSync",
          "emr:MetastoreUpdateKafkaTopic",
          "emr:MetastoreUpdateKafkaTopicBatch",
          "emr:MetastoreUpdateTable",
          "emr:MigrateJobs",
          "emr:ModifyAlertContact",
          "emr:ModifyAlertDingDingGroup",
          "emr:ModifyAlertUserGroup",
          "emr:ModifyClusterBootstrapAction",
          "emr:ModifyClusterTemplate",
          "emr:ModifyExecutionPlanBasicInfo",
          "emr:ModifyFlow",
          "emr:ModifyFlowProject",
          "emr:ModifyFlowProjectClusterSetting",
          "emr:ModifyFlowProjectGeneralSetting",
          "emr:ModifyFlowVariableCollection",
          "emr:ModifyHealthRuleConfig",
          "emr:ModifyJob",
          "emr:ModifyJobExecutionPlanFolder",
          "emr:ModifyJobExecutionPlanParam",
          "emr:ModifyScalingConfigItemV2",
          "emr:ModifyScalingGroupV2",
          "emr:ModifyScalingRule",
          "emr:ModifyUserChannelInfo",
          "emr:ModifyUserStatistics",
          "emr:PassRole",
          "emr:PreCheckClusterBootstrapAction",
          "emr:QueryGrafanaData",
          "emr:QueryInfoByToken",
          "emr:QueryLogKey",
          "emr:QueryPrice",
          "emr:QuerySlsMetricData",
          "emr:QueryTableData",
          "emr:QueryTrendData",
          "emr:QueryUserById",
          "emr:ReassignKafka",
          "emr:RefreshBackupList",
          "emr:RemoveBackupPlan",
          "emr:RemoveBackupRule",
          "emr:RemoveScalingConfigItemV2",
          "emr:RestoreBackup",
          "emr:RestoreFlowEntitySnapshot",
          "emr:ResumeExecutionPlanInstance",
          "emr:ResumeExecutionPlanScheduler",
          "emr:ResumeFlow",
          "emr:RetryCreateLdapUser",
          "emr:RetryCreateUserPassword",
          "emr:RetryExecutionPlan",
          "emr:RetryExecutionPlanInstance",
          "emr:RetryOperationActivity",
          "emr:RunApiTemplate",
          "emr:RunDisasterRecoveryPlan",
          "emr:RunDiskOpsActivity",
          "emr:RunExecutionPlan",
          "emr:RunNoteParagraphs",
          "emr:RunParagraph",
          "emr:RunScalingActionV2",
          "emr:SaveParagraph",
          "emr:SaveReport",
          "emr:StartFlow",
          "emr:StartKafkaPreferredReplicaElection",
          "emr:StopParagraph",
          "emr:SuspendExecutionPlanInstance",
          "emr:SuspendExecutionPlanScheduler",
          "emr:UninstallLibraries",
          "emr:UpdateClusterCost",
          "emr:UpdateClusterMetaCollect",
          "emr:UpdateDisasterRecoveryPlan",
          "emr:UpdateKafkaReassignParam",
          "emr:UpdateLibraryInstallTaskStatus",
          "emr:UpdateNodeMaintenanceStatus",
          "emr:UpgradeHistory",
          "emr:UploadCostBucket",
          "emr:describeOperationTask",
          "emr:queryTableData",
          "emr:queryTrendData"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問