Membuat peran penyediaan untuk Amazon Bedrock Studio - Amazon Bedrock
Hubungan kepercayaanIzin untuk mengelola sumber daya pengguna Amazon Bedrock Studio

Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.

Membuat peran penyediaan untuk Amazon Bedrock Studio

Amazon Bedrock Studio sedang dalam rilis pratinjau untuk Amazon Bedrock dan dapat berubah sewaktu-waktu.

Untuk mengizinkan Amazon Bedrock Studio membuat sumber daya di akun pengguna, seperti komponen pagar pembatas, Anda perlu membuat peran penyediaan.

Untuk menggunakan peran penyediaan Amazon Bedrock Studio, buat IAM peran dan lampirkan izin berikut dengan mengikuti langkah-langkah di Membuat peran untuk mendelegasikan izin ke layanan. AWS

Hubungan kepercayaan

Kebijakan berikut memungkinkan Amazon Bedrock untuk mengambil peran ini dan memungkinkan Amazon Bedrock Studio mengelola sumber daya Bedrock Studio di akun pengguna.

  • Tetapkan aws:SourceAccount nilainya ke ID akun Anda.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "datazone.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "account ID"
        }
      }
    }
  ]
}

Izin untuk mengelola sumber daya pengguna Amazon Bedrock Studio

Kebijakan default untuk peran penyediaan Amazon Bedrock Studio. Kebijakan ini memungkinkan prinsipal untuk membuat, memperbarui, dan menghapus AWS sumber daya di Amazon Bedrock Studio menggunakan Amazon DataZone dan AWS CloudFormation.

Kebijakan ini terdiri dari kumpulan izin berikut.

  • cloudformation — Memungkinkan prinsipal untuk membuat dan mengelola CloudFormation tumpukan untuk menyediakan sumber daya Amazon Bedrock Studio sebagai bagian dari lingkungan Amazon. DataZone

  • iam — Memungkinkan prinsipal untuk membuat, mengelola, dan meneruskan IAM peran dengan batas izin untuk Amazon Bedrock Studio menggunakan. AWS CloudFormation

  • s3 - Memungkinkan prinsipal untuk membuat dan mengelola bucket Amazon S3 untuk Amazon Bedrock Studio menggunakan. AWS CloudFormation

  • aoss - Memungkinkan prinsipal untuk membuat dan mengelola koleksi Amazon OpenSearch Tanpa Server untuk Amazon Bedrock Studio menggunakan. AWS CloudFormation

  • batuan dasar - Memungkinkan kepala sekolah untuk membuat dan mengelola agen Amazon Bedrock, basis pengetahuan, pagar pembatas, petunjuk, dan aliran untuk Amazon Bedrock Studio menggunakan. AWS CloudFormation

  • lambda - Memungkinkan prinsipal untuk membuat, mengelola, dan memanggil AWS Lambda fungsi untuk Amazon Bedrock Studio menggunakan. AWS CloudFormation

  • log - Memungkinkan prinsipal untuk membuat dan mengelola grup CloudWatch log Amazon untuk Amazon Bedrock Studio menggunakan AWS CloudFormation.

  • secretsmanager — Memungkinkan kepala sekolah untuk membuat dan mengelola AWS Secrets Manager rahasia untuk Amazon Bedrock Studio menggunakan. AWS CloudFormation

  • kms — Memberikan akses AWS KMS untuk mengenkripsi sumber daya yang disediakan dengan kunci yang dikelola pelanggan yang ditujukan untuk Amazon Bedrock menggunakan. AWS CloudFormation

Karena ukuran kebijakan ini, Anda harus melampirkan kebijakan sebagai kebijakan inline. Untuk instruksi, lihat Langkah 2: Buat batas izin, peran layanan, dan peran penyediaan. 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack",
        "cloudformation:TagResource"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/DataZone*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:TagKeys": "AmazonDataZoneEnvironment"
        },
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "ManageStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/DataZone*"
    },
    {
      "Sid": "DenyOtherActionsNotViaCloudFormation",
      "Effect": "Deny",
      "NotAction": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:CreateStack",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack",
        "cloudformation:TagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEqualsIfExists": {
          "aws:CalledViaFirst": "cloudformation.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ListResources",
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "s3:ListAllMyBuckets",
        "aoss:ListCollections",
        "aoss:BatchGetCollection",
        "aoss:ListAccessPolicies",
        "aoss:ListSecurityPolicies",
        "aoss:ListTagsForResource",
        "bedrock:ListAgents",
        "bedrock:ListKnowledgeBases",
        "bedrock:ListGuardrails",
        "bedrock:ListPrompts",
        "bedrock:ListFlows",
        "bedrock:ListTagsForResource",
        "lambda:ListFunctions",
        "logs:DescribeLogGroups",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GetRoles",
      "Effect": "Allow",
      "Action": "iam:GetRole",
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ]
    },
    {
      "Sid": "CreateRoles",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "iam:AttachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "ManageRoles",
      "Effect": "Allow",
      "Action": [
        "iam:UpdateRole",
        "iam:DeleteRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies"
      ],
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "PassRoleToBedrockService",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "bedrock.amazonaws.com"
        }
      }
    },
    {
      "Sid": "PassRoleToLambdaService",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::*:role/BedrockStudio*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "lambda.amazonaws.com"
        }
      }
    },
    {
      "Sid": "CreateRoleForOpenSearchServerless",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "observability.aoss.amazonaws.com"
        }
      }
    },
    {
      "Sid": "GetDataZoneBlueprintCfnTemplates",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CreateAndAccessS3Buckets",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy",
        "s3:DeleteBucketPolicy",
        "s3:PutBucketTagging",
        "s3:PutBucketCORS",
        "s3:PutBucketLogging",
        "s3:PutBucketVersioning",
        "s3:PutBucketPublicAccessBlock",
        "s3:PutEncryptionConfiguration",
        "s3:PutLifecycleConfiguration",
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::br-studio-*"
    },
    {
      "Sid": "ManageOssAccessPolicies",
      "Effect": "Allow",
      "Action": [
        "aoss:GetAccessPolicy",
        "aoss:CreateAccessPolicy",
        "aoss:DeleteAccessPolicy",
        "aoss:UpdateAccessPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "StringLikeIfExists": {
          "aoss:collection": "br-studio-*",
          "aoss:index": "br-studio-*"
        }
      }
    },
    {
      "Sid": "ManageOssSecurityPolicies",
      "Effect": "Allow",
      "Action": [
        "aoss:GetSecurityPolicy",
        "aoss:CreateSecurityPolicy",
        "aoss:DeleteSecurityPolicy",
        "aoss:UpdateSecurityPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "StringLikeIfExists": {
          "aoss:collection": "br-studio-*"
        }
      }
    },
    {
      "Sid": "ManageOssCollections",
      "Effect": "Allow",
      "Action": [
        "aoss:CreateCollection",
        "aoss:UpdateCollection",
        "aoss:DeleteCollection"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "GetBedrockResources",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetAgent",
        "bedrock:GetKnowledgeBase",
        "bedrock:GetGuardrail",
        "bedrock:GetPrompt",
        "bedrock:GetFlow",
        "bedrock:GetFlowAlias"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ManageBedrockResources",
      "Effect": "Allow",
      "Action": [
        "bedrock:CreateAgent",
        "bedrock:UpdateAgent",
        "bedrock:PrepareAgent",
        "bedrock:DeleteAgent",
        "bedrock:ListAgentAliases",
        "bedrock:GetAgentAlias",
        "bedrock:CreateAgentAlias",
        "bedrock:UpdateAgentAlias",
        "bedrock:DeleteAgentAlias",
        "bedrock:ListAgentActionGroups",
        "bedrock:GetAgentActionGroup",
        "bedrock:CreateAgentActionGroup",
        "bedrock:UpdateAgentActionGroup",
        "bedrock:DeleteAgentActionGroup",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:GetAgentKnowledgeBase",
        "bedrock:AssociateAgentKnowledgeBase",
        "bedrock:DisassociateAgentKnowledgeBase",
        "bedrock:UpdateAgentKnowledgeBase",
        "bedrock:CreateKnowledgeBase",
        "bedrock:UpdateKnowledgeBase",
        "bedrock:DeleteKnowledgeBase",
        "bedrock:ListDataSources",
        "bedrock:GetDataSource",
        "bedrock:CreateDataSource",
        "bedrock:UpdateDataSource",
        "bedrock:DeleteDataSource",
        "bedrock:CreateGuardrail",
        "bedrock:UpdateGuardrail",
        "bedrock:DeleteGuardrail",
        "bedrock:CreateGuardrailVersion",
        "bedrock:CreatePrompt",
        "bedrock:UpdatePrompt",
        "bedrock:DeletePrompt",
        "bedrock:CreatePromptVersion",
        "bedrock:CreateFlow",
        "bedrock:UpdateFlow",
        "bedrock:PrepareFlow",
        "bedrock:DeleteFlow",
        "bedrock:ListFlowAliases",
        "bedrock:GetFlowAlias",
        "bedrock:CreateFlowAlias",
        "bedrock:UpdateFlowAlias",
        "bedrock:DeleteFlowAlias",
        "bedrock:ListFlowVersions",
        "bedrock:GetFlowVersion",
        "bedrock:CreateFlowVersion",
        "bedrock:DeleteFlowVersion"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "TagBedrockAgentAliases",
      "Effect": "Allow",
      "Action": "bedrock:TagResource",
      "Resource": "arn:aws:bedrock:*:*:agent-alias/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "TagBedrockFlowAliases",
      "Effect": "Allow",
      "Action": "bedrock:TagResource",
      "Resource": "arn:aws:bedrock:*:*:flow/*/alias/*",
      "Condition": {
        "Null": {
          "aws:RequestTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "CreateFunctions",
      "Effect": "Allow",
      "Action": [
        "lambda:GetFunction",
        "lambda:CreateFunction",
        "lambda:InvokeFunction",
        "lambda:DeleteFunction",
        "lambda:UpdateFunctionCode",
        "lambda:GetFunctionConfiguration",
        "lambda:UpdateFunctionConfiguration",
        "lambda:ListVersionsByFunction",
        "lambda:PublishVersion",
        "lambda:GetPolicy",
        "lambda:AddPermission",
        "lambda:RemovePermission",
        "lambda:ListTags"
      ],
      "Resource": "arn:aws:lambda:*:*:function:br-studio-*"
    },
    {
      "Sid": "ManageLogGroups",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:DeleteLogGroup",
        "logs:PutRetentionPolicy",
        "logs:DeleteRetentionPolicy",
        "logs:GetDataProtectionPolicy",
        "logs:PutDataProtectionPolicy",
        "logs:DeleteDataProtectionPolicy",
        "logs:AssociateKmsKey",
        "logs:DisassociateKmsKey",
        "logs:ListTagsLogGroup",
        "logs:ListTagsForResource"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/br-studio-*"
    },
    {
      "Sid": "GetRandomPasswordForSecret",
      "Effect": "Allow",
      "Action": "secretsmanager:GetRandomPassword",
      "Resource": "*"
    },
    {
      "Sid": "ManageSecrets",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:DeleteResourcePolicy"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:br-studio/*"
    },
    {
      "Sid": "UseCustomerManagedKmsKey",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "kms:CreateGrant",
        "kms:RetireGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/EnableBedrock": "true"
        }
      }
    },
    {
      "Sid": "TagResources",
      "Effect": "Allow",
      "Action": [
        "iam:TagRole",
        "iam:UntagRole",
        "aoss:TagResource",
        "aoss:UntagResource",
        "bedrock:TagResource",
        "bedrock:UntagResource",
        "lambda:TagResource",
        "lambda:UntagResource",
        "logs:TagLogGroup",
        "logs:UntagLogGroup",
        "logs:TagResource",
        "logs:UntagResource",
        "secretsmanager:TagResource",
        "secretsmanager:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    }
  ]
}