AWS managed policy: AmazonDataZoneSageMakerAccess - Amazon DataZone

AWS managed policy: AmazonDataZoneSageMakerAccess

This policy gives Amazon DataZone permissions to publish Amazon SageMaker assets to the catalog. It also gives Amazon DataZone permissions to grant access or revoke access to the Amazon SageMaker published assets in the catalog.

This policy includes permissions to do the following:

  • cloudtrail – retrieve information about CloudTrail trails.

  • cloudwatch – retrieve the current CloudWatch alarms.

  • logs – retrieve the metric filters for CloudWatch logs.

  • sns – retrieve the list of subscriptions to an SNS topic.

  • config – retrieve information about configuration recorders, resources, and AWS Config rules. Also allows the service-linked role to create and delete AWS Config rules, and to run evaluations against the rules.

  • iam – get and generate credential reports for accounts.

  • organizations – retrieve account and organizational unit (OU) information for an organization.

  • securityhub – retrieve information about how the Security Hub service, standards, and controls are configured.

  • tag – retrieve information about resource tags.


{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AmazonSageMakerReadPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:DescribeFeatureGroup",
            "sagemaker:ListModelPackages",
            "sagemaker:DescribeModelPackage",
            "sagemaker:DescribeModelPackageGroup",
            "sagemaker:DescribeAlgorithm",
            "sagemaker:ListTags",
            "sagemaker:DescribeDomain",
            "sagemaker:GetModelPackageGroupPolicy",
            "sagemaker:Search"
         ],
         "Resource":"*"
      },
      {
         "Sid":"AmazonSageMakerTaggingPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:AddTags",
            "sagemaker:DeleteTags"
         ],
         "Resource":"*",
         "Condition":{
            "ForAnyValue:StringLike":{
               "aws:TagKeys":[
                  "sagemaker:shared-with:*"
               ]
            }
         }
      },
      {
         "Sid":"AmazonSageMakerModelPackageGroupPolicyPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:PutModelPackageGroupPolicy",
            "sagemaker:DeleteModelPackageGroupPolicy"
         ],
         "Resource":[
            "arn:*:sagemaker:*:*:model-package-group/*"
         ]
      },
      {
         "Sid":"AmazonSageMakerRAMPermission",
         "Effect":"Allow",
         "Action":[
            "ram:GetResourceShares",
            "ram:GetResourceShareInvitations",
            "ram:GetResourceShareAssociations"
         ],
         "Resource":"*"
      },
      {
         "Sid":"AmazonSageMakerRAMResourcePolicyPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:PutResourcePolicy",
            "sagemaker:GetResourcePolicy",
            "sagemaker:DeleteResourcePolicy"
         ],
         "Resource":[
            "arn:*:sagemaker:*:*:feature-group/*"
         ]
      },
      {
         "Sid":"AmazonSageMakerRAMTagResourceSharePermission",
         "Effect":"Allow",
         "Action":[
            "ram:TagResource"
         ],
         "Resource":"arn:*:ram:*:*:resource-share/*",
         "Condition":{
            "Null":{
               "aws:RequestTag/AwsDataZoneDomainId":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerRAMDeleteResourceSharePermission",
         "Effect":"Allow",
         "Action":[
            "ram:DeleteResourceShare"
         ],
         "Resource":"arn:*:ram:*:*:resource-share/*",
         "Condition":{
            "Null":{
               "aws:ResourceTag/AwsDataZoneDomainId":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerRAMCreateResourceSharePermission",
         "Effect":"Allow",
         "Action":[
            "ram:CreateResourceShare"
         ],
         "Resource":"*",
         "Condition":{
            "StringLikeIfExists":{
               "ram:RequestedResourceType":[
                  "sagemaker:*"
               ]
            },
            "Null":{
               "aws:RequestTag/AwsDataZoneDomainId":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerS3BucketPolicyPermission",
         "Effect":"Allow",
         "Action":[
            "s3:DeleteBucketPolicy",
            "s3:PutBucketPolicy",
            "s3:GetBucketPolicy"
         ],
         "Resource":[
            "arn:aws:s3:::sagemaker-datazone*",
            "arn:aws:s3:::SageMaker-DataZone*",
            "arn:aws:s3:::datazone-sagemaker*",
            "arn:aws:s3:::DataZone-SageMaker*",
            "arn:aws:s3:::amazon-datazone*",
            "arn:aws:s3:::amazon-sagemaker*"
         ]
      },
      {
         "Sid":"AmazonSageMakerS3Permission",
         "Effect":"Allow",
         "Action":[
            "s3:GetObject",
            "s3:ListBucket"
         ],
         "Resource":[
            "arn:aws:s3:::sagemaker-datazone*",
            "arn:aws:s3:::SageMaker-DataZone*",
            "arn:aws:s3:::datazone-sagemaker*",
            "arn:aws:s3:::DataZone-SageMaker*",
            "arn:aws:s3:::amazon-datazone*",
            "arn:aws:s3:::amazon-sagemaker*"
         ]
      },
      {
         "Sid":"AmazonSageMakerECRPermission",
         "Effect":"Allow",
         "Action":[
            "ecr:GetRepositoryPolicy",
            "ecr:SetRepositoryPolicy",
            "ecr:DeleteRepositoryPolicy"
         ],
         "Resource":"*",
         "Condition":{
            "Null":{
               "aws:ResourceTag/AmazonDataZoneEnvironment":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerKMSReadPermission",
         "Effect":"Allow",
         "Action":[
            "kms:DescribeKey"
         ],
         "Resource":"*",
         "Condition":{
            "ForAnyValue:StringEquals":{
               "aws:TagKeys":[
                  "AmazonDataZoneEnvironment"
               ]
            }
         }
      },
      {
         "Sid":"AmazonSageMakerKMSGrantPermission",
         "Effect":"Allow",
         "Action":[
            "kms:CreateGrant"
         ],
         "Resource":"*",
         "Condition":{
            "ForAnyValue:StringEquals":{
               "aws:TagKeys":[
                  "AmazonDataZoneEnvironment"
               ]
            },
            "ForAllValues:StringEquals":{
               "kms:GrantOperations":[
                  "Decrypt"
               ]
            }
         }
      }
   ]
}