翻訳は機械翻訳により提供されています。提供された翻訳内容と英語版の間で齟齬、不一致または矛盾がある場合、英語版が優先します。
# AmazonSageMakerSpacesControllerPolicy
**説明**: EKS SageMaker Spaces への安全なリモートアクセスを可能にするために SageMaker Spaces アドオンに必要な Systems Manager のアクティベーション、セッション管理SageMaker キーオペレーションのアクセス許可を付与します。
`AmazonSageMakerSpacesControllerPolicy` は [AWS マネージドポリシー](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)です。
## このポリシーを使用すると
ユーザー、グループおよびロールに `AmazonSageMakerSpacesControllerPolicy` をアタッチできます。
## ポリシーの詳細
+ **タイプ**: AWS 管理ポリシー
+ **作成日時**: 2025 年 11 月 19 日 04:34 UTC
+ **編集日時:** 2026 年 2 月 12 日 18:01 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AmazonSageMakerSpacesControllerPolicy`
## ポリシーのバージョン
**ポリシーのバージョン:** v3 (デフォルト)
ポリシーのデフォルトバージョンは、ポリシーのアクセス許可を定義するバージョンです。ポリシーを持つユーザーまたはロールが AWS リソースへのアクセスをリクエストすると、 はポリシーのデフォルトバージョン AWS をチェックして、リクエストを許可するかどうかを決定します。
## JSON ポリシードキュメント
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "AllowOperatorToSSMCreateActivationForSpaces",
"Effect" : "Allow",
"Action" : [
"ssm:CreateActivation"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/sagemaker.amazonaws.com/managed-by" : "amazon-sagemaker-spaces",
"aws:RequestTag/sagemaker.amazonaws.com/eks-cluster-arn" : "${aws:PrincipalTag/eks-cluster-arn}"
}
}
},
{
"Sid" : "AllowOperatorToSSMDescribeActivations",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeActivations"
],
"Resource" : "*"
},
{
"Sid" : "AllowOperatorToSSMDescribeSessions",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeSessions"
],
"Resource" : "*"
},
{
"Sid" : "AllowOperatorToSSMDeleteActivation",
"Effect" : "Allow",
"Action" : [
"ssm:DeleteActivation"
],
"Resource" : "*"
},
{
"Sid" : "AllowOperatorToAddTagsToActivation",
"Effect" : "Allow",
"Action" : "ssm:AddTagsToResource",
"Resource" : [
"arn:aws:ssm:*:*:managed-instance/*",
"arn:aws:iam::*:role/sagemaker-space-*"
],
"Condition" : {
"StringEquals" : {
"aws:RequestTag/sagemaker.amazonaws.com/managed-by" : "amazon-sagemaker-spaces",
"aws:RequestTag/sagemaker.amazonaws.com/eks-cluster-arn" : "${aws:PrincipalTag/eks-cluster-arn}"
}
}
},
{
"Sid" : "AllowOperatorToSSMDescribeManagedNodes",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeInstanceInformation"
],
"Resource" : "*"
},
{
"Sid" : "AllowOperatorToSSMDeregisterWorkspaceInstances",
"Effect" : "Allow",
"Action" : [
"ssm:DeregisterManagedInstance"
],
"Resource" : "arn:aws:ssm:*:*:managed-instance/*",
"Condition" : {
"StringEquals" : {
"ssm:resourceTag/sagemaker.amazonaws.com/managed-by" : "amazon-sagemaker-spaces",
"ssm:resourceTag/sagemaker.amazonaws.com/eks-cluster-arn" : "${aws:PrincipalTag/eks-cluster-arn}"
}
}
},
{
"Sid" : "AllowOperatorToPassSsmManagedNodeRole",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : "arn:aws:iam::*:role/sagemaker-space-*",
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : "ssm.amazonaws.com"
}
}
},
{
"Sid" : "AllowOperatorToSSMStartSession",
"Effect" : "Allow",
"Action" : [
"ssm:StartSession"
],
"Resource" : "arn:aws:ssm:*:*:managed-instance/*",
"Condition" : {
"StringEquals" : {
"ssm:resourceTag/sagemaker.amazonaws.com/managed-by" : "amazon-sagemaker-spaces",
"ssm:resourceTag/sagemaker.amazonaws.com/eks-cluster-arn" : "${aws:PrincipalTag/eks-cluster-arn}"
}
}
},
{
"Sid" : "AllowStartSessionDocuments",
"Effect" : "Allow",
"Action" : [
"ssm:StartSession"
],
"Resource" : [
"arn:aws:ssm:*::document/AWS-StartSSHSession",
"arn:aws:ssm:*:*:document/SageMaker-Space*"
]
},
{
"Sid" : "KMSDescribeKey",
"Effect" : "Allow",
"Action" : [
"kms:DescribeKey"
],
"Resource" : "arn:aws:kms:*:*:key/*"
},
{
"Sid" : "KMSKeyOperations",
"Effect" : "Allow",
"Action" : [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringEquals" : {
"kms:EncryptionContext:sagemaker:component" : "amazon-sagemaker-spaces",
"kms:EncryptionContext:sagemaker:eks-cluster-arn" : "${aws:PrincipalTag/eks-cluster-arn}"
}
}
},
{
"Sid" : "AllowOperatorToSSMDescribeDocument",
"Effect" : "Allow",
"Action" : [
"ssm:DescribeDocument"
],
"Resource" : [
"arn:aws:ssm:*:*:document/SageMaker-Space*"
]
},
{
"Sid" : "AllowOperatorToSSMCreateDocument",
"Effect" : "Allow",
"Action" : [
"ssm:CreateDocument"
],
"Resource" : "arn:aws:ssm:*:*:document/SageMaker-Space*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/sagemaker.amazonaws.com/managed-by" : "amazon-sagemaker-spaces",
"aws:RequestTag/sagemaker.amazonaws.com/eks-cluster-arn" : "${aws:PrincipalTag/eks-cluster-arn}"
}
}
},
{
"Sid" : "AllowOperatorToEnableAdvancedTierForManagedInstances",
"Effect" : "Allow",
"Action" : [
"ssm:UpdateServiceSetting",
"ssm:GetServiceSetting",
"ssm:ResetServiceSetting"
],
"Resource" : "arn:aws:ssm:*:*:servicesetting/ssm/managed-instance/activation-tier"
},
{
"Sid" : "AllowOperatorToAddTagsToSSMDocument",
"Effect" : "Allow",
"Action" : "ssm:AddTagsToResource",
"Resource" : "arn:aws:ssm:*:*:document/SageMaker-Space*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/sagemaker.amazonaws.com/managed-by" : "amazon-sagemaker-spaces"
}
}
}
]
}
```
## 詳細情報
+ [IAM Identity Center で AWS マネージドポリシーを使用してアクセス許可セットを作成する](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [IAM ID のアクセス許可の追加および削除](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [IAM ポリシーのバージョニングについて理解する](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [AWS 管理ポリシーの使用を開始し、最小特権のアクセス許可に移行する](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)