Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Prasyarat
Multi-turn RL menggunakan SageMaker AI CreateJob API, yang memerlukan izin tambahan di atas prasyarat penyesuaian model yang ada. Tabel di bawah ini merangkum apa yang baru versus yang sudah dibahas.
| Apa | Status | Catatan |
|---|---|---|
| Kebijakan kepercayaan: job.sagemaker.amazonaws.com | Baru | Diperlukan untuk CreateJob API |
| Kebijakan kepercayaan: bedrock-agentcore.amazonaws.com | Baru | Diperlukan pada peran runtime agen (hanya AgentCore jalur) |
| PassRole: job.sagemaker.amazonaws.com | Baru | Prasyarat yang ada hanya mencakup sagemaker.amazonaws.com |
| Tindakan Job (CreateJob, DescribeJob, dll.) | Baru | Tidak di AmazonSageMakerFullAccess |
| batuan-agen-agen: ListAgentRuntimes | Baru | Diperlukan untuk pemilih runtime Studio |
| batuan-agen-agen: ListAgentRuntimeVersions | Baru | Diperlukan untuk pemilih versi Studio |
| AmazonSageMakerJobFullAccess kebijakan terkelola | Baru | Lampirkan ke peran eksekusi pekerjaan |
| AmazonSageMakerJobRuntimeAccess kebijakan terkelola | Baru | Lampirkan ke peran runtime agen |
| Lambda, penyebaran Batuan Dasar, S3, KMS, MLFlow, CloudWatch | Sudah tercakup | Melalui prasyarat yang ada atau kebijakan terkelola |
Peran penelepon
{ "Version": "2012-10-17", "Statement": [ { "Sid": "PassRoleForCreateJob", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::<account-id>:role/<ExecutionRoleName>", "Condition": { "StringEquals": { "iam:PassedToService": "job.sagemaker.amazonaws.com" } } }, { "Sid": "MTRLJobActions", "Effect": "Allow", "Action": [ "sagemaker:CreateJob", "sagemaker:DescribeJob", "sagemaker:StopJob", "sagemaker:DeleteJob" ], "Resource": "arn:aws:sagemaker:*:*:job/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MTRLListJobsPermission", "Effect": "Allow", "Action": [ "sagemaker:ListJobs", "sagemaker:ListJobSchemaVersions", "sagemaker:DescribeJobSchemaVersion" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
PassRole — memungkinkan penelepon mendelegasikan peran eksekusi ke. job.sagemaker.amazonaws.com
Kebijakan terkelola
Multi-turn RL menggunakan dua kebijakan AWS terkelola. Lampirkan masing-masing ke peran yang sesuai sebelum membuat pekerjaan.
AmazonSageMakerJobFullAccess— lampirkan ke peran eksekusi pekerjaan SageMaker AI (yang RoleArn Anda berikanCreateJob).
Kebijakan ini memberikan pekerjaan izin yang dibutuhkan saat menjalankan: read/write akses ke data pelatihan dan pos pemeriksaan di S3, izin KMS untuk S3-side enkripsi, akses ke konten hub SageMaker AI dan paket model, penelusuran eksperimen MLFlow, pemanggilan agen melalui Bedrock atau AgentCore Lambda, manajemen antarmuka jaringan VPC, dan penulisan Log. CloudWatch Referensi: AmazonSageMakerJobFullAccess.
AmazonSageMakerJobRuntimeAccess— lampirkan ke peran runtime agen (peran yang dijalankan agen Anda, baik di Bedrock AgentCore atau di belakang forwarder Lambda). Kebijakan ini memberikan API runtime yang dipanggil agen Anda selama peluncuran:sagemaker:Sample,,,sagemaker:SampleWithResponseStream, sagemaker:CompleteRollout dan. sagemaker:UpdateReward sagemaker:CallWithBearerToken Referensi: AmazonSageMakerJobRuntimeAccess.
Pembaruan kebijakan kepercayaan
Tambahkan job.sagemaker.amazonaws.com ke kebijakan kepercayaan peran eksekusi Anda:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "job.sagemaker.amazonaws.com" }, "Action": ["sts:AssumeRole", "sts:TagSession"] } ] }
Jika menggunakan Bedrock AgentCore, peran runtime agen Anda juga memerlukan kebijakan kepercayaannya sendiri:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock-agentcore.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Kebijakan inline tambahan untuk Studio UI
Jika Anda mengirimkan lowongan melalui SageMaker AI Studio, tambahkan kebijakan inline berikut ke peran eksekusi domain SageMaker AI Anda:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "MTRLJobActions", "Effect": "Allow", "Action": [ "sagemaker:CreateJob", "sagemaker:DescribeJob", "sagemaker:StopJob", "sagemaker:DeleteJob", "sagemaker:ListJobs", "sagemaker:ListJobSchemaVersions", "sagemaker:DescribeJobSchemaVersion" ], "Resource": "arn:aws:sagemaker:*:*:job/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockAgentCoreListPermissions", "Effect": "Allow", "Action": [ "bedrock-agentcore:ListAgentRuntimes", "bedrock-agentcore:ListAgentRuntimeVersions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleForCreateJob", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "job.sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
Opsi kebijakan kustom
Jika Anda lebih suka menentukan kebijakan Anda sendiri daripada menggunakan kebijakan yang AWS dikelola, gunakan yang berikut ini sebagai titik awal.
SageMaker Kebijakan peran eksekusi pekerjaan AI (setara denganAmazonSageMakerJobFullAccess):
{ "Version": "2012-10-17", "Statement": [ { "Sid": "S3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "KMSDescribeKey", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeHubContent" ], "Resource": [ "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerModelPackagePermissions", "Effect": "Allow", "Action": [ "sagemaker:AccessModelPackage", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MLflowPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeMlflowApp", "sagemaker:CallMlflowAppApi", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:StartTrace", "sagemaker-mlflow:EndTrace", "sagemaker-mlflow:SearchTraces", "sagemaker-mlflow:ListArtifacts" ], "Resource": [ "arn:aws:sagemaker:*:*:mlflow-app/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockAgentCorePermissions", "Effect": "Allow", "Action": [ "bedrock-agentcore:InvokeAgentRuntime", "bedrock-agentcore:StopRuntimeSession", "bedrock-agentcore:GetAgentRuntime" ], "Resource": "arn:aws:bedrock-agentcore:*:*:runtime/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2NetworkPermissions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeDhcpOptions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2NetworkInterfaceTagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Sid": "EC2NetworkInterfaceDeletePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaPermissions", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
Hubungan kepercayaan untuk peran eksekusi:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "job.sagemaker.amazonaws.com" }, "Action": ["sts:AssumeRole", "sts:TagSession"] } ] }
AmazonSageMakerJobRuntimeAccess setara + BedrockAgentCoreFullAccess
{ "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerJobRuntimePermissions", "Effect": "Allow", "Action": [ "sagemaker:Sample", "sagemaker:SampleWithResponseStream", "sagemaker:CompleteRollout", "sagemaker:UpdateReward" ], "Resource": "arn:aws:sagemaker:*:*:job/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BearerTokenPermissions", "Effect": "Allow", "Action": [ "sagemaker:CallWithBearerToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
Hubungan kepercayaan untuk peran runtime agen:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock-agentcore.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Catatan forwarder Lambda
Izin Lambda kustomisasi model yang ada mencakup fungsi dengan SageMakeratau pembuat sagemaker dalam namanya. Jika forwarder Lambda Anda menggunakan konvensi penamaan yang berbeda, tambahkan ARN secara eksplisit:
{ "Sid": "CustomAgentLambdaPermission", "Effect": "Allow", "Action": ["lambda:InvokeFunction"], "Resource": "arn:aws:lambda:*:*:function:your-agent-forwarder-function-name", "Condition": { "StringEquals": {"aws:ResourceAccount": "${aws:PrincipalAccount}"} } }
Pengaturan Lainnya
-
Jika Anda menggunakan VPC yang dikelola pelanggan, lihat. Konfigurasikan VPC untuk pekerjaan RL multi-putaran
-
Jika Anda menggunakan kunci KMS untuk mengenkripsi input dan output pekerjaan, peran eksekusi dan peran pemanggil memerlukan izin tambahan. Lihat Enkripsi saat istirahat untuk pembelajaran penguatan multi-putaran.
