AWS managed policies for AWS DeepRacer

An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.

Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.

You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.

For more information, see AWS managed policies in the IAM User Guide.

The following AWS-managed policies are specific to using AWS DeepRacer multi-user mode to sponsor multiple participants under your AWS account.

AWSDeepRacerAccountAdminAccess managed policy for AWS DeepRacer administrators

To enable multiple profiles to use your AWS account ID and billing information with AWS DeepRacer, attach the AWSDeepRacerAccountAdminAccess policy.

You can attach the AWSDeepRacerAccountAdminAccess policy to the IAM identity you want to use for sponsoring other racers.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DeepRacerAdminAccessStatement",
            "Effect": "Allow",
            "Action": [
                "deepracer:*"
            ],
            "Resource": [
                "*"
            ],
            "Condition": 
            {
                "Null": {
                    "deepracer:UserToken": "true"
                }
            }
        }
    ]
}

AWSDeepRacerDefaultMultiUserAccess managed policy for AWS DeepRacer multi-user racers

The policy, AWSDeepRacerDefaultMultiUserAccess, gives AWS DeepRacer racers access to all AWS DeepRacer actions except multi-user account admin actions.

You can attach the AWSDeepRacerDefaultMultiUserAccess policy to the IAM identities of participants you want to sponsor under your account.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"deepracer:Add*",
				"deepracer:Remove*",
				"deepracer:Create*",
				"deepracer:Perform*",
				"deepracer:Clone*",
				"deepracer:Get*",
				"deepracer:List*",
				"deepracer:Edit*",
				"deepracer:Start*",
				"deepracer:Set*",
				"deepracer:Update*",
				"deepracer:Delete*",
				"deepracer:Stop*",
				"deepracer:Import*",
				"deepracer:Tag*",
				"deepracer:Untag*"
			],
			"Resource": [
				"*"
			],
			"Condition": {
				"Null": {
					"deepracer:UserToken": "false"
				},
				"Bool": {
					"deepracer:MultiUser": "true"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"deepracer:GetAccountConfig",
				"deepracer:GetTrack",
				"deepracer:ListTracks",
				"deepracer:TestRewardFunction"
			],
			"Resource": [
				"*"
			]
		},
		{
			"Effect": "Deny",
			"Action": [
				"deepracer:Admin*"
			],
			"Resource": [
				"*"
			]
		}
	]
}

AWS DeepRacer updates to AWS managed policies

View details about updates to AWS managed policies for AWS DeepRacer since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the AWS DeepRacer Document history page.