IAM 系统策略

表1介绍了LakeFormation的默认系统策略。

表2介绍了lakeFormation常用操作与系统权限的授权关系，您可以参考该表选择合适的系统权限。

LakeFormation系统策略所包含的详细内容如下：

• LakeFormation FullAccess策略内容

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "lakeformation:*:*",
                  "vpc:*:get",
                  "vpc:*:list",
                  "tms:predefineTags:list",
                  "obs:bucket:ListAllMyBuckets",
                  "obs:bucket:ListBucket",
                  "obs:bucket:HeadBucket",
                  "obs:object:GetObject"
              ],
              "Effect": "Allow"
          }
      ]
  }

• LakeFormation CommonOperations策略

  {
  	"Version": "1.1",
  	"Statement": [
  		{
  			"Effect": "Allow",
  			"Action": [
  				"lakeformation:*:describe*",
  				"lakeformation:*:list*",
  				"lakeformation:policy:export",
  				"lakeformation:access:create",
  				"lakeformation:access:delete",
  				"lakeformation:accessAgency:describe",
  				"lakeformation:accessService:describe",
  				"lakeformation:accessService:grant",
  				"lakeformation:accessTenant:grant",
  				"lakeformation:agreement:cancel",
  				"lakeformation:agreement:describe",
  				"lakeformation:agreement:grant",
  				"lakeformation:catalog:alter",
  				"lakeformation:catalog:create",
  				"lakeformation:catalog:drop",
  				"lakeformation:database:alter",
  				"lakeformation:database:create",
  				"lakeformation:database:drop",
  				"lakeformation:dataset:alter",
  				"lakeformation:dataset:alterFile",
  				"lakeformation:dataset:alterFileGroup",
  				"lakeformation:dataset:create",
  				"lakeformation:dataset:createFile",
  				"lakeformation:dataset:createFileGroup",
  				"lakeformation:dataset:drop",
  				"lakeformation:dataset:dropFile",
  				"lakeformation:dataset:dropFileGroup",
  				"lakeformation:function:alter",
  				"lakeformation:function:create",
  				"lakeformation:function:drop",
  				"lakeformation:group:alter",
  				"lakeformation:instance:access",
  				"lakeformation:instance:alter",
  				"lakeformation:instanceJob:alter",
  				"lakeformation:instanceJob:create",
  				"lakeformation:instanceJob:drop",
  				"lakeformation:instanceJob:exec",
  				"lakeformation:job:alter",
  				"lakeformation:job:create",
  				"lakeformation:job:drop",
  				"lakeformation:job:exec",
  				"lakeformation:model:alter",
  				"lakeformation:model:alterFile",
  				"lakeformation:model:create",
  				"lakeformation:model:createFile",
  				"lakeformation:model:drop",
  				"lakeformation:model:dropFile",
  				"lakeformation:policy:create",
  				"lakeformation:policy:drop",
  				"lakeformation:role:alter",
  				"lakeformation:role:create",
  				"lakeformation:role:drop",
  				"lakeformation:table:alter",
  				"lakeformation:table:create",
  				"lakeformation:table:drop",
  				"lakeformation:transaction:operate",
  				"lakeformation:user:alter",
  				"vpc:*:get",
  				"vpc:*:list",
  				"tms:predefineTags:list",
  				"obs:bucket:ListAllMyBuckets",
  				"obs:bucket:ListBucket",
  				"obs:bucket:HeadBucket",
  				"obs:object:GetObject"
  			]
  		}
  	]
  }

• LakeFormation ReadOnlyAccess策略

  {
  	"Version": "1.1",
  	"Statement": [
  		{
  			"Action": [
  				"lakeformation:*:describe*",
  				"lakeformation:*:list*",
  				"lakeformation:policy:export",
                                  "lakeformation:agreement:cancel",
                                  "lakeformation:agreement:describe",
                                  "lakeformation:agreement:grant",
  				"vpc:*:get",
  				"vpc:*:list",
  				"tms:predefineTags:list",
  				"obs:bucket:ListAllMyBuckets",
  				"obs:bucket:ListBucket",
  				"obs:bucket:HeadBucket",
  				"obs:object:GetObject"
  			],
  			"Effect": "Allow"
  		}
  	]
  }