AmazonSageMakerCanvasDataPrepFullAccess
Description: Provides full access to Amazon SageMaker resources and operations for data preparation in Canvas. The policy also provides select access to related services (e.g., S3, IAM, KMS, RDS, CloudWatch Logs, Redshift, Athena, Glue, EventBridge, Secrets Manager). This policy should be attached to the Amazon SageMaker Domain/User Profile execution role.
AmazonSageMakerCanvasDataPrepFullAccess is an AWS managed policy.
Using this policy
You can attach AmazonSageMakerCanvasDataPrepFullAccess to your users, groups, and roles.
Policy details
-
Type: AWS managed policy
-
Creation time: October 27, 2023, 22:56 UTC
-
Edited time: August 16, 2024, 18:11 UTC
-
ARN:
arn:aws:iam::aws:policy/AmazonSageMakerCanvasDataPrepFullAccess
Policy version
Policy version: v4 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
JSON policy document
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "SageMakerListFeatureGroupOperation", "Effect" : "Allow", "Action" : "sagemaker:ListFeatureGroups", "Resource" : "*" }, { "Sid" : "SageMakerFeatureGroupOperations", "Effect" : "Allow", "Action" : [ "sagemaker:CreateFeatureGroup", "sagemaker:DescribeFeatureGroup" ], "Resource" : "arn:aws:sagemaker:*:*:feature-group/*" }, { "Sid" : "SageMakerProcessingJobOperations", "Effect" : "Allow", "Action" : [ "sagemaker:CreateProcessingJob", "sagemaker:DescribeProcessingJob", "sagemaker:AddTags" ], "Resource" : "arn:aws:sagemaker:*:*:processing-job/*canvas-data-prep*" }, { "Sid" : "SageMakerProcessingJobListOperation", "Effect" : "Allow", "Action" : "sagemaker:ListProcessingJobs", "Resource" : "*" }, { "Sid" : "SageMakerPipelineOperations", "Effect" : "Allow", "Action" : [ "sagemaker:DescribePipeline", "sagemaker:CreatePipeline", "sagemaker:UpdatePipeline", "sagemaker:DeletePipeline", "sagemaker:StartPipelineExecution", "sagemaker:ListPipelineExecutionSteps", "sagemaker:DescribePipelineExecution" ], "Resource" : "arn:aws:sagemaker:*:*:pipeline/*canvas-data-prep*" }, { "Sid" : "KMSListOperations", "Effect" : "Allow", "Action" : "kms:ListAliases", "Resource" : "*" }, { "Sid" : "KMSOperations", "Effect" : "Allow", "Action" : "kms:DescribeKey", "Resource" : "arn:aws:kms:*:*:key/*" }, { "Sid" : "S3Operations", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:AbortMultipartUpload" ], "Resource" : [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "S3GetObjectOperation", "Effect" : "Allow", "Action" : "s3:GetObject", "Resource" : "arn:aws:s3:::*", "Condition" : { "StringEqualsIgnoreCase" : { "s3:ExistingObjectTag/SageMaker" : "true" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "S3ListOperations", "Effect" : "Allow", "Action" : [ "s3:ListBucket", "s3:ListAllMyBuckets" ], "Resource" : "*" }, { "Sid" : "IAMListOperations", "Effect" : "Allow", "Action" : "iam:ListRoles", "Resource" : "*" }, { "Sid" : "IAMGetOperations", "Effect" : "Allow", "Action" : "iam:GetRole", "Resource" : "arn:aws:iam::*:role/*" }, { "Sid" : "IAMPassOperation", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : "arn:aws:iam::*:role/*", "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "sagemaker.amazonaws.com", "events.amazonaws.com" ] } } }, { "Sid" : "EventBridgePutOperation", "Effect" : "Allow", "Action" : [ "events:PutRule" ], "Resource" : "arn:aws:events:*:*:rule/*", "Condition" : { "StringEquals" : { "aws:RequestTag/sagemaker:is-canvas-data-prep-job" : "true" } } }, { "Sid" : "EventBridgeOperations", "Effect" : "Allow", "Action" : [ "events:DescribeRule", "events:PutTargets" ], "Resource" : "arn:aws:events:*:*:rule/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/sagemaker:is-canvas-data-prep-job" : "true" } } }, { "Sid" : "EventBridgeTagBasedOperations", "Effect" : "Allow", "Action" : [ "events:TagResource" ], "Resource" : "arn:aws:events:*:*:rule/*", "Condition" : { "StringEquals" : { "aws:RequestTag/sagemaker:is-canvas-data-prep-job" : "true", "aws:ResourceTag/sagemaker:is-canvas-data-prep-job" : "true" } } }, { "Sid" : "EventBridgeListTagOperation", "Effect" : "Allow", "Action" : "events:ListTagsForResource", "Resource" : "*" }, { "Sid" : "GlueOperations", "Effect" : "Allow", "Action" : [ "glue:GetDatabases", "glue:GetTable", "glue:GetTables", "glue:SearchTables" ], "Resource" : [ "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/*" ] }, { "Sid" : "EMROperations", "Effect" : "Allow", "Action" : [ "elasticmapreduce:DescribeCluster", "elasticmapreduce:ListInstanceGroups" ], "Resource" : "arn:aws:elasticmapreduce:*:*:cluster/*" }, { "Sid" : "EMRListOperation", "Effect" : "Allow", "Action" : "elasticmapreduce:ListClusters", "Resource" : "*" }, { "Sid" : "AthenaListDataCatalogOperation", "Effect" : "Allow", "Action" : "athena:ListDataCatalogs", "Resource" : "*" }, { "Sid" : "AthenaQueryExecutionOperations", "Effect" : "Allow", "Action" : [ "athena:GetQueryExecution", "athena:GetQueryResults", "athena:StartQueryExecution", "athena:StopQueryExecution" ], "Resource" : "arn:aws:athena:*:*:workgroup/*" }, { "Sid" : "AthenaDataCatalogOperations", "Effect" : "Allow", "Action" : [ "athena:ListDatabases", "athena:ListTableMetadata" ], "Resource" : "arn:aws:athena:*:*:datacatalog/*" }, { "Sid" : "RedshiftOperations", "Effect" : "Allow", "Action" : [ "redshift-data:DescribeStatement", "redshift-data:CancelStatement", "redshift-data:GetStatementResult" ], "Resource" : "*" }, { "Sid" : "RedshiftArnBasedOperations", "Effect" : "Allow", "Action" : [ "redshift-data:ExecuteStatement", "redshift-data:ListSchemas", "redshift-data:ListTables" ], "Resource" : "arn:aws:redshift:*:*:cluster:*" }, { "Sid" : "RedshiftGetCredentialsOperation", "Effect" : "Allow", "Action" : "redshift:GetClusterCredentials", "Resource" : [ "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", "arn:aws:redshift:*:*:dbname:*" ] }, { "Sid" : "SecretsManagerARNBasedOperation", "Effect" : "Allow", "Action" : "secretsmanager:CreateSecret", "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" }, { "Sid" : "SecretManagerTagBasedOperation", "Effect" : "Allow", "Action" : [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource" : "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*", "Condition" : { "StringEquals" : { "aws:ResourceTag/SageMaker" : "true", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "RDSOperation", "Effect" : "Allow", "Action" : "rds:DescribeDBInstances", "Resource" : "*" }, { "Sid" : "LoggingOperation", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource" : "arn:aws:logs:*:*:log-group:/aws/sagemaker/studio:*" }, { "Sid" : "EMRServerlessCreateApplicationOperation", "Effect" : "Allow", "Action" : "emr-serverless:CreateApplication", "Resource" : "arn:aws:emr-serverless:*:*:/*", "Condition" : { "StringEquals" : { "aws:RequestTag/sagemaker:is-canvas-resource" : "True", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "EMRServerlessListApplicationOperation", "Effect" : "Allow", "Action" : "emr-serverless:ListApplications", "Resource" : "arn:aws:emr-serverless:*:*:/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "EMRServerlessApplicationOperations", "Effect" : "Allow", "Action" : [ "emr-serverless:UpdateApplication", "emr-serverless:GetApplication" ], "Resource" : "arn:aws:emr-serverless:*:*:/applications/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/sagemaker:is-canvas-resource" : "True", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "EMRServerlessStartJobRunOperation", "Effect" : "Allow", "Action" : "emr-serverless:StartJobRun", "Resource" : "arn:aws:emr-serverless:*:*:/applications/*", "Condition" : { "StringEquals" : { "aws:RequestTag/sagemaker:is-canvas-resource" : "True", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "EMRServerlessListJobRunOperation", "Effect" : "Allow", "Action" : "emr-serverless:ListJobRuns", "Resource" : "arn:aws:emr-serverless:*:*:/applications/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/sagemaker:is-canvas-resource" : "True", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "EMRServerlessJobRunOperations", "Effect" : "Allow", "Action" : [ "emr-serverless:GetJobRun", "emr-serverless:CancelJobRun" ], "Resource" : "arn:aws:emr-serverless:*:*:/applications/*/jobruns/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/sagemaker:is-canvas-resource" : "True", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "EMRServerlessTagResourceOperation", "Effect" : "Allow", "Action" : "emr-serverless:TagResource", "Resource" : "arn:aws:emr-serverless:*:*:/*", "Condition" : { "StringEquals" : { "aws:RequestTag/sagemaker:is-canvas-resource" : "True", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "IAMPassOperationForEMRServerless", "Effect" : "Allow", "Action" : "iam:PassRole", "Resource" : [ "arn:aws:iam::*:role/service-role/AmazonSageMakerCanvasEMRSExecutionAccess-*", "arn:aws:iam::*:role/AmazonSageMakerCanvasEMRSExecutionAccess-*" ], "Condition" : { "StringEquals" : { "iam:PassedToService" : "emr-serverless.amazonaws.com", "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } } ] }
Learn more
