Realtime Compute for Apache Flink:リソースグループによるきめ細かなアクセス制御

仕組み

リソースグループは、プロジェクトや環境ごとにリソースを整理します。リソースをグループ化したら、そのグループにのみ権限を限定する RAM ポリシーをアイデンティティ (RAM ユーザー、ユーザーグループ、ロールなど) にアタッチできます。詳細については、「リソースのグループ化と権限付与」をご参照ください。

このアプローチには、主に 2 つのメリットがあります。

• きめ細かなアクセス制御：アカウント全体の権限を付与する代わりに、アイデンティティのアクセスを特定のグループ内のリソースのみに制限できます。これにより、プロジェクト固有のワークロードを分離し、意図しないアクセスのリスクを軽減できます。

• 管理の簡素化：新しいリソースがリソースグループに追加されると、そのグループに限定された権限を持つ RAM アイデンティティは自動的にアクセスできます。新しいリソースが作成されるたびに RAM ポリシーを更新する必要はありません。

RAM ユーザーへのリソースグループレベルの権限付与

このセクションでは、特定のリソースグループ内のRealtime Compute for Apache Flinkリソースにのみアクセス権限を RAM ユーザーに付与する方法について説明します。

サポート対象リソース

以下のRealtime Compute for Apache Flinkリソースは、リソースグループレベルの権限付与をサポートしています。

サポート対象外アクション

以下のRealtime Compute for Apache Flinkアクションは、リソースグループレベルの権限付与をサポートしていません。

上記のアクションについては、 [Resource Scope] を [Account] に設定し、カスタムポリシーを作成する必要があります。

以下のポリシー例は、必要に応じてカスタマイズ可能です。

• 読み取り専用アクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "stream:CheckNamespaceName",
          "stream:CheckOssBucket",
          "stream:CheckUserVSwitch",
          "stream:CheckUserVpc",
          "stream:DescribeFlussInstances",
          "stream:DescribeLxCommodity",
          "stream:GetAppliedScheduledPlan",
          "stream:GetArtifactMetadataV1",
          "stream:GetCatalogs",
          "stream:GetCatalogsSnapshot",
          "stream:GetClusterQuantityByRegion",
          "stream:GetCommodityCode",
          "stream:GetCustomFlinkArtifactsSnapshot",
          "stream:GetDatabases",
          "stream:GetDeployDeploymentDraftResult",
          "stream:GetDeployment",
          "stream:GetDeploymentDefaultsV1",
          "stream:GetDeploymentDraft",
          "stream:GetDeploymentDraftByIdV1",
          "stream:GetDeploymentDraftByNameV1",
          "stream:GetDeploymentDraftLock",
          "stream:GetDeploymentDraftResourcePlanV1",
          "stream:GetDeploymentDraftResourcePlanWithBestEffortV1",
          "stream:GetDeploymentV1",
          "stream:GetDeploymentsByIp",
          "stream:GetDeploymentsByLabel",
          "stream:GetDeploymentsByName",
          "stream:GetEvents",
          "stream:GetFolder",
          "stream:GetFolderByIdV1",
          "stream:GetGenerateResourcePlanResult",
          "stream:GetGlobalDeploymentDefaultsV1",
          "stream:GetHotUpdateJobResult",
          "stream:GetJob",
          "stream:GetJobDiagnosis",
          "stream:GetLatestJobStartLog",
          "stream:GetLineageInfo",
          "stream:GetMember",
          "stream:GetPreSignedUrlForPutObject",
          "stream:GetResourcePlanV1",
          "stream:GetRootFolderByTypeV1",
          "stream:GetSavepoint",
          "stream:GetSessionCluster",
          "stream:GetSpecifications",
          "stream:GetSqlFile",
          "stream:GetTables",
          "stream:GetUdfArtifacts",
          "stream:GetValidateDeploymentDraftResult",
          "stream:HasStreamDefaultRole",
          "stream:ListArtifactsV1",
          "stream:ListConnectorsV1",
          "stream:ListCustomConnectors",
          "stream:ListDeploymentDrafts",
          "stream:ListDeploymentTargets",
          "stream:ListDeploymentTargetsV1",
          "stream:ListDeployments",
          "stream:ListDeploymentsV1",
          "stream:ListEngineVersionMetadata",
          "stream:ListFlinkVersionsV1",
          "stream:ListFormatsV1",
          "stream:ListJobs",
          "stream:ListJobsV1",
          "stream:ListMembers",
          "stream:ListNamespacesV1",
          "stream:ListOssInfo",
          "stream:ListRegionWithClusterQuantity",
          "stream:ListSavepoints",
          "stream:ListSavepointsV1",
          "stream:ListScheduledPlan",
          "stream:ListScheduledPlanExecutedHistory",
          "stream:ListSecretValuesV1",
          "stream:ListSessionClusters",
          "stream:ListSessionClustersV1",
          "stream:ListTablesV1",
          "stream:ListTagKeys",
          "stream:ListTagResources",
          "stream:ListTagValues",
          "stream:ListUserVswitch",
          "stream:ListVariables",
          "stream:QueryCloneNamespace",
          "stream:QueryCreateLxCommodityPrice",
          "stream:QueryCreateVvpInstancePrice",
          "stream:QueryTagVvpResources",
          "stream:SearchFoldersByKeywordV1",
          "stream:SearchOrderStatistics"
        ],
        "Resource": "*"
      }
    ]
  }
  

• フルアクセスの許可

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "stream:ActOnBehalfOfAnotherUser",
          "stream:ApplyScheduledPlan",
          "stream:CancelSqlPreview",
          "stream:CheckNamespaceName",
          "stream:CheckOssBucket",
          "stream:CheckUserVSwitch",
          "stream:CheckUserVpc",
          "stream:CreateDeployment",
          "stream:CreateDeploymentDraft",
          "stream:CreateDeploymentDraftV1",
          "stream:CreateDeploymentTarget",
          "stream:CreateDeploymentTargetV2",
          "stream:CreateDeploymentV1",
          "stream:CreateFolder",
          "stream:CreateFolderV1",
          "stream:CreateInstance",
          "stream:CreateLxCommodity",
          "stream:CreateMember",
          "stream:CreateSavepoint",
          "stream:CreateScheduledPlan",
          "stream:CreateSessionCluster",
          "stream:CreateSqlFile",
          "stream:CreateUdfArtifact",
          "stream:CreateVariable",
          "stream:DeleteConnectorV1",
          "stream:DeleteCustomConnector",
          "stream:DeleteDeployment",
          "stream:DeleteDeploymentByName",
          "stream:DeleteDeploymentDraft",
          "stream:DeleteDeploymentDraftV1",
          "stream:DeleteDeploymentTarget",
          "stream:DeleteDeploymentV1",
          "stream:DeleteFolder",
          "stream:DeleteFormatV1",
          "stream:DeleteJob",
          "stream:DeleteMember",
          "stream:DeleteMemberV1",
          "stream:DeleteSavepoint",
          "stream:DeleteScheduledPlan",
          "stream:DeleteSecretValueV1",
          "stream:DeleteSessionCluster",
          "stream:DeleteSqlFile",
          "stream:DeleteUdfArtifact",
          "stream:DeleteUdfFunction",
          "stream:DeleteVariable",
          "stream:DeployDeploymentDraftAsync",
          "stream:DeployDeploymentDraftV1",
          "stream:DescribeFlussInstances",
          "stream:DescribeLxCommodity",
          "stream:ExecuteSqlScriptV1",
          "stream:ExecuteSqlStatement",
          "stream:FetchSqlExecutionResult",
          "stream:FetchSqlPreviewResults",
          "stream:FlinkApiProxy",
          "stream:ForcefullyCreateLockV1",
          "stream:GenerateResourcePlanV1",
          "stream:GenerateResourcePlanWithFlinkConfAsync",
          "stream:GetAppliedScheduledPlan",
          "stream:GetArtifactMetadataV1",
          "stream:GetCatalogs",
          "stream:GetCatalogsSnapshot",
          "stream:GetClusterQuantityByRegion",
          "stream:GetCommodityCode",
          "stream:GetCustomFlinkArtifactsSnapshot",
          "stream:GetDatabases",
          "stream:GetDeployDeploymentDraftResult",
          "stream:GetDeployment",
          "stream:GetDeploymentDefaultsV1",
          "stream:GetDeploymentDraft",
          "stream:GetDeploymentDraftByIdV1",
          "stream:GetDeploymentDraftByNameV1",
          "stream:GetDeploymentDraftLock",
          "stream:GetDeploymentDraftResourcePlanV1",
          "stream:GetDeploymentDraftResourcePlanWithBestEffortV1",
          "stream:GetDeploymentV1",
          "stream:GetDeploymentsByIp",
          "stream:GetDeploymentsByLabel",
          "stream:GetDeploymentsByName",
          "stream:GetEvents",
          "stream:GetFolder",
          "stream:GetFolderByIdV1",
          "stream:GetGenerateResourcePlanResult",
          "stream:GetGlobalDeploymentDefaultsV1",
          "stream:GetHotUpdateJobResult",
          "stream:GetJob",
          "stream:GetJobDiagnosis",
          "stream:GetLatestJobStartLog",
          "stream:GetLineageInfo",
          "stream:GetMember",
          "stream:GetPreSignedUrlForPutObject",
          "stream:GetResourcePlanV1",
          "stream:GetRootFolderByTypeV1",
          "stream:GetSavepoint",
          "stream:GetSessionCluster",
          "stream:GetSpecifications",
          "stream:GetSqlFile",
          "stream:GetTables",
          "stream:GetUdfArtifacts",
          "stream:GetValidateDeploymentDraftResult",
          "stream:HandleCatalogChanges",
          "stream:HasStreamDefaultRole",
          "stream:HotUpdateJob",
          "stream:ListArtifactsV1",
          "stream:ListConnectorsV1",
          "stream:ListCustomConnectors",
          "stream:ListDeploymentDrafts",
          "stream:ListDeploymentTargets",
          "stream:ListDeploymentTargetsV1",
          "stream:ListDeployments",
          "stream:ListDeploymentsV1",
          "stream:ListEngineVersionMetadata",
          "stream:ListFlinkVersionsV1",
          "stream:ListFormatsV1",
          "stream:ListJobs",
          "stream:ListJobsV1",
          "stream:ListMembers",
          "stream:ListNamespacesV1",
          "stream:ListOssInfo",
          "stream:ListRegionWithClusterQuantity",
          "stream:ListSavepoints",
          "stream:ListSavepointsV1",
          "stream:ListScheduledPlan",
          "stream:ListScheduledPlanExecutedHistory",
          "stream:ListSecretValuesV1",
          "stream:ListSessionClusters",
          "stream:ListSessionClustersV1",
          "stream:ListTablesV1",
          "stream:ListTagKeys",
          "stream:ListTagResources",
          "stream:ListTagValues",
          "stream:ListUserVswitch",
          "stream:ListVariables",
          "stream:ModifyDns",
          "stream:ModifyInstanceMetadata",
          "stream:ModifyInstanceVswitch",
          "stream:QueryCloneNamespace",
          "stream:QueryCreateLxCommodityPrice",
          "stream:QueryCreateVvpInstancePrice",
          "stream:QueryTagVvpResources",
          "stream:RegisterCustomConnector",
          "stream:RegisterUdfFunction",
          "stream:ReplaceDeploymentV1",
          "stream:SaveDeploymentDraftResourcePlanV1",
          "stream:SearchFoldersByKeywordV1",
          "stream:SearchOrderStatistics",
          "stream:SetDeploymentResourceModeV1",
          "stream:StartJob",
          "stream:StartJobWithParams",
          "stream:StartOrGetNonTerminalSqlExecution",
          "stream:StartSessionCluster",
          "stream:StartSqlExecution",
          "stream:StopApplyScheduledPlan",
          "stream:StopJob",
          "stream:StopSessionCluster",
          "stream:StopSqlExecution",
          "stream:SubmitSqlPreview",
          "stream:TagVvpResources",
          "stream:UnTagVvpResources",
          "stream:UpdateDeployment",
          "stream:UpdateDeploymentByName",
          "stream:UpdateDeploymentDesiredStateV1",
          "stream:UpdateDeploymentDraft",
          "stream:UpdateDeploymentDraftV1",
          "stream:UpdateDeploymentTarget",
          "stream:UpdateDeploymentTargetV2",
          "stream:UpdateDeploymentV1",
          "stream:UpdateFolder",
          "stream:UpdateInstanceMonitorType",
          "stream:UpdateMember",
          "stream:UpdateMemberV1",
          "stream:UpdateScheduledPlan",
          "stream:UpdateSessionCluster",
          "stream:UpdateSqlFile",
          "stream:UpdateUdfArtifact",
          "stream:UpdateVariable",
          "stream:ValidateDeploymentDraftAsync",
          "stream:ValidateSqlScriptV1",
          "stream:ValidateSqlStatement",
          "stream:WorkflowCallbackQueryNodeStatus",
          "stream:WorkflowCallbackStartNode",
          "stream:WorkflowCallbackStopNode"
        ],
        "Resource": "*"
      }
    ]
  }
  

よくある質問