Creación de un rol de aprovisionamiento para Amazon Bedrock Studio - Amazon Bedrock
Relación de confianzaPermisos para administrar los recursos de usuario de Amazon Bedrock Studio

Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.

Creación de un rol de aprovisionamiento para Amazon Bedrock Studio

Amazon Bedrock Studio está en versión preliminar para Amazon Bedrock y está sujeta a cambios.

Para permitir que Amazon Bedrock Studio cree recursos en la cuenta de un usuario, como un componente de barreras de protección, debe crear un rol de aprovisionamiento.

Para usar un rol de aprovisionamiento para Amazon Bedrock Studio, cree un rol de IAM y asocie los siguientes permisos siguiendo los pasos que se indican en Creación de un rol para delegar permisos a un servicio de AWS.

Relación de confianza

La siguiente política permite a Amazon Bedrock asumir este rol y permitir a Amazon Bedrock Studio administrar los recursos de Bedrock Studio en la cuenta de un usuario.

  • Configure el valor aws:SourceAccount en el ID de su cuenta.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "datazone.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "account ID"
        }
      }
    }
  ]
}

Permisos para administrar los recursos de usuario de Amazon Bedrock Studio

Política predeterminada para el rol de aprovisionamiento de Amazon Bedrock Studio. Esta política permite a la entidad principal crear, actualizar y eliminar recursos de AWS en Amazon Bedrock Studio mediante Amazon DataZone y AWS CloudFormation.

Esta política consta de los siguientes conjuntos de permisos.

  • cloudformation: permite a la entidad principal crear y administrar pilas de CloudFormation para aprovisionar los recursos de Amazon Bedrock Studio como parte de los entornos de Amazon DataZone.

  • iam: permite a la entidad principal crear, administrar y transferir roles de IAM con un límite de permisos para Amazon Bedrock Studio al usar AWS CloudFormation.

  • s3: permite a la entidad principal crear y administrar buckets de Amazon S3 para Amazon Bedrock Studio al usar AWS CloudFormation.

  • aoss: permite a la entidad principal crear y administrar colecciones de Amazon OpenSearch sin servidor para Amazon Bedrock Studio al usar AWS CloudFormation.

  • bedrock: permite a la entidad principal crear y administrar agentes, bases de conocimientos, barreras de protección, peticiones y flujos de Amazon Bedrock para Amazon Bedrock Studio al usar AWS CloudFormation.

  • lambda: permite a la entidad principal crear, administrar e invocar funciones de AWS Lambda para Amazon Bedrock Studio al usar AWS CloudFormation.

  • logs: permite a la entidad principal crear y administrar grupos de registros de Amazon CloudWatch para Amazon Bedrock Studio al usar AWS CloudFormation.

  • secretsmanager: permite a la entidad principal crear y administrar secretos de AWS Secrets Manager para Amazon Bedrock Studio al usar AWS CloudFormation.

  • kms: otorga acceso a AWS KMS para cifrar los recursos aprovisionados con una clave administrada por el cliente para Amazon Bedrock al usar AWS CloudFormation.

Debido al tamaño de esta política, debe asociarla como política en línea. Para obtener instrucciones, consulte Paso 2: creación del límite de permisos, el rol de servicio y el rol de aprovisionamiento. 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack",
        "cloudformation:TagResource"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/DataZone*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:TagKeys": "AmazonDataZoneEnvironment"
        },
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "ManageStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/DataZone*"
    },
    {
      "Sid": "DenyOtherActionsNotViaCloudFormation",
      "Effect": "Deny",
      "NotAction": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:CreateStack",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack",
        "cloudformation:TagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEqualsIfExists": {
          "aws:CalledViaFirst": "cloudformation.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ListResources",
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "s3:ListAllMyBuckets",
        "aoss:ListCollections",
        "aoss:BatchGetCollection",
        "aoss:ListAccessPolicies",
        "aoss:ListSecurityPolicies",
        "aoss:ListTagsForResource",
        "bedrock:ListAgents",
        "bedrock:ListKnowledgeBases",
        "bedrock:ListGuardrails",
        "bedrock:ListPrompts",
        "bedrock:ListFlows",
        "bedrock:ListTagsForResource",
        "lambda:ListFunctions",
        "logs:DescribeLogGroups",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GetRoles",
      "Effect": "Allow",
      "Action": "iam:GetRole",
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ]
    },
    {
      "Sid": "CreateRoles",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "iam:AttachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "ManageRoles",
      "Effect": "Allow",
      "Action": [
        "iam:UpdateRole",
        "iam:DeleteRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies"
      ],
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "PassRoleToBedrockService",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "bedrock.amazonaws.com"
        }
      }
    },
    {
      "Sid": "PassRoleToLambdaService",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::*:role/BedrockStudio*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "lambda.amazonaws.com"
        }
      }
    },
    {
      "Sid": "CreateRoleForOpenSearchServerless",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "observability.aoss.amazonaws.com"
        }
      }
    },
    {
      "Sid": "GetDataZoneBlueprintCfnTemplates",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CreateAndAccessS3Buckets",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy",
        "s3:DeleteBucketPolicy",
        "s3:PutBucketTagging",
        "s3:PutBucketCORS",
        "s3:PutBucketLogging",
        "s3:PutBucketVersioning",
        "s3:PutBucketPublicAccessBlock",
        "s3:PutEncryptionConfiguration",
        "s3:PutLifecycleConfiguration",
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::br-studio-*"
    },
    {
      "Sid": "ManageOssAccessPolicies",
      "Effect": "Allow",
      "Action": [
        "aoss:GetAccessPolicy",
        "aoss:CreateAccessPolicy",
        "aoss:DeleteAccessPolicy",
        "aoss:UpdateAccessPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "StringLikeIfExists": {
          "aoss:collection": "br-studio-*",
          "aoss:index": "br-studio-*"
        }
      }
    },
    {
      "Sid": "ManageOssSecurityPolicies",
      "Effect": "Allow",
      "Action": [
        "aoss:GetSecurityPolicy",
        "aoss:CreateSecurityPolicy",
        "aoss:DeleteSecurityPolicy",
        "aoss:UpdateSecurityPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "StringLikeIfExists": {
          "aoss:collection": "br-studio-*"
        }
      }
    },
    {
      "Sid": "ManageOssCollections",
      "Effect": "Allow",
      "Action": [
        "aoss:CreateCollection",
        "aoss:UpdateCollection",
        "aoss:DeleteCollection"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "GetBedrockResources",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetAgent",
        "bedrock:GetKnowledgeBase",
        "bedrock:GetGuardrail",
        "bedrock:GetPrompt",
        "bedrock:GetFlow",
        "bedrock:GetFlowAlias"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ManageBedrockResources",
      "Effect": "Allow",
      "Action": [
        "bedrock:CreateAgent",
        "bedrock:UpdateAgent",
        "bedrock:PrepareAgent",
        "bedrock:DeleteAgent",
        "bedrock:ListAgentAliases",
        "bedrock:GetAgentAlias",
        "bedrock:CreateAgentAlias",
        "bedrock:UpdateAgentAlias",
        "bedrock:DeleteAgentAlias",
        "bedrock:ListAgentActionGroups",
        "bedrock:GetAgentActionGroup",
        "bedrock:CreateAgentActionGroup",
        "bedrock:UpdateAgentActionGroup",
        "bedrock:DeleteAgentActionGroup",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:GetAgentKnowledgeBase",
        "bedrock:AssociateAgentKnowledgeBase",
        "bedrock:DisassociateAgentKnowledgeBase",
        "bedrock:UpdateAgentKnowledgeBase",
        "bedrock:CreateKnowledgeBase",
        "bedrock:UpdateKnowledgeBase",
        "bedrock:DeleteKnowledgeBase",
        "bedrock:ListDataSources",
        "bedrock:GetDataSource",
        "bedrock:CreateDataSource",
        "bedrock:UpdateDataSource",
        "bedrock:DeleteDataSource",
        "bedrock:CreateGuardrail",
        "bedrock:UpdateGuardrail",
        "bedrock:DeleteGuardrail",
        "bedrock:CreateGuardrailVersion",
        "bedrock:CreatePrompt",
        "bedrock:UpdatePrompt",
        "bedrock:DeletePrompt",
        "bedrock:CreatePromptVersion",
        "bedrock:CreateFlow",
        "bedrock:UpdateFlow",
        "bedrock:PrepareFlow",
        "bedrock:DeleteFlow",
        "bedrock:ListFlowAliases",
        "bedrock:GetFlowAlias",
        "bedrock:CreateFlowAlias",
        "bedrock:UpdateFlowAlias",
        "bedrock:DeleteFlowAlias",
        "bedrock:ListFlowVersions",
        "bedrock:GetFlowVersion",
        "bedrock:CreateFlowVersion",
        "bedrock:DeleteFlowVersion"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "TagBedrockAgentAliases",
      "Effect": "Allow",
      "Action": "bedrock:TagResource",
      "Resource": "arn:aws:bedrock:*:*:agent-alias/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "TagBedrockFlowAliases",
      "Effect": "Allow",
      "Action": "bedrock:TagResource",
      "Resource": "arn:aws:bedrock:*:*:flow/*/alias/*",
      "Condition": {
        "Null": {
          "aws:RequestTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "CreateFunctions",
      "Effect": "Allow",
      "Action": [
        "lambda:GetFunction",
        "lambda:CreateFunction",
        "lambda:InvokeFunction",
        "lambda:DeleteFunction",
        "lambda:UpdateFunctionCode",
        "lambda:GetFunctionConfiguration",
        "lambda:UpdateFunctionConfiguration",
        "lambda:ListVersionsByFunction",
        "lambda:PublishVersion",
        "lambda:GetPolicy",
        "lambda:AddPermission",
        "lambda:RemovePermission",
        "lambda:ListTags"
      ],
      "Resource": "arn:aws:lambda:*:*:function:br-studio-*"
    },
    {
      "Sid": "ManageLogGroups",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:DeleteLogGroup",
        "logs:PutRetentionPolicy",
        "logs:DeleteRetentionPolicy",
        "logs:GetDataProtectionPolicy",
        "logs:PutDataProtectionPolicy",
        "logs:DeleteDataProtectionPolicy",
        "logs:AssociateKmsKey",
        "logs:DisassociateKmsKey",
        "logs:ListTagsLogGroup",
        "logs:ListTagsForResource"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/br-studio-*"
    },
    {
      "Sid": "GetRandomPasswordForSecret",
      "Effect": "Allow",
      "Action": "secretsmanager:GetRandomPassword",
      "Resource": "*"
    },
    {
      "Sid": "ManageSecrets",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:DeleteResourcePolicy"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:br-studio/*"
    },
    {
      "Sid": "UseCustomerManagedKmsKey",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "kms:CreateGrant",
        "kms:RetireGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/EnableBedrock": "true"
        }
      }
    },
    {
      "Sid": "TagResources",
      "Effect": "Allow",
      "Action": [
        "iam:TagRole",
        "iam:UntagRole",
        "aoss:TagResource",
        "aoss:UntagResource",
        "bedrock:TagResource",
        "bedrock:UntagResource",
        "lambda:TagResource",
        "lambda:UntagResource",
        "logs:TagLogGroup",
        "logs:UntagLogGroup",
        "logs:TagResource",
        "logs:UntagResource",
        "secretsmanager:TagResource",
        "secretsmanager:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    }
  ]
}