Set up Partner AI Apps

Grant permissions for AWS Marketplace. Partner AI Apps administrators require these permissions to be able to purchase subscriptions to Partner AI Apps from AWS Marketplace. To get access to AWS Marketplace, admins must attach the AWSMarketplaceManageSubscriptions managed policy to the IAM role they are using to access the SageMaker AI console and purchase the app. For details about the AWSMarketplaceManageSubscriptions managed policy, see AWS managed policies for AWS Marketplace buyers. For information about attaching managed policies, see Adding and removing IAM identity permissions.

Grant permissions for SageMaker AI to run operations on the admins behalf using other AWS services. Admins must grant SageMaker AI permissions to use these services and the resources they act upon. The following policy definition demonstrates how to grant the required Partner AI Apps permissions. These permissions are needed in addition to the existing permissions for the admin role. For more information, see How to use SageMaker AI execution roles.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreatePartnerApp",
                "sagemaker:DeletePartnerApp",
                "sagemaker:UpdatePartnerApp",
                "sagemaker:DescribePartnerApp",
                "sagemaker:ListPartnerApps",
                "sagemaker:CreatePartnerAppPresignedUrl",
                "sagemaker:CreatePartnerApp",
                "sagemaker:AddTags",
                "sagemaker:ListTags",
                "sagemaker:DeleteTags"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::*:role/*",
            "Condition": {
                "StringEquals": {
                     "iam:PassedToService": "sagemaker.amazonaws.com"
                 } 
            }
        }
    ]
}

Partner AI Apps require an execution role to interact with resources in the AWS account. Admins can create this execution role using the AWS CLI. The Partner AI App uses this role to complete actions related to Partner AI App functionality.

aws iam create-role --role-name PartnerAiAppExecutionRole --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "sagemaker.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}'

Create the AWS License Manager Service Linked Role by following the steps in Create a service-linked role for License Manager. 

Grant permissions for the Partner AI Appto access License Manager using the AWS CLI. These permissions are required access the licenses for Partner AI App. This allows the Partner AI App to verify access to the Partner AI App license.

aws iam put-role-policy --role-name PartnerAiAppExecutionRole --policy-name LicenseManagerPolicy --policy-document '{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": [
      "license-manager:CheckoutLicense",
      "license-manager:CheckInLicense",
      "license-manager:ExtendLicenseConsumption",
      "license-manager:GetLicense",
      "license-manager:GetLicenseUsage"
    ],
    "Resource": "*"
  }
}'

If the Partner AI App requires access to an Amazon S3 bucket, then add Amazon S3 permissions to the execution role. For more information, see Required permissions for Amazon S3 API operations.

Grant permissions for SageMaker AI to run operations on your behalf using other AWS services. Admins must grant SageMaker AI permissions to use these services and the resources they act upon. Admins grant SageMaker AI these permissions using an IAM execution role. For more information about IAM roles, see IAM roles. The following policy definition demonstrates how to grant the required Partner AI Apps permissions. This policy can be added to the execution role of the user profile.  For more information, see How to use SageMaker AI execution roles.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sagemaker:DescribePartnerApp",
                "sagemaker:ListPartnerApps",
                "sagemaker:CreatePartnerAppPresignedUrl"
            ],
            "Resource": "arn:aws:sagemaker:*:*:partner-app/app-*"
        }
    ]
}

(Optional) If launching Partner AI Apps from Studio, add the sts:TagSession trust policy to the role used to launch Studio or the Partner AI Apps directly as follows. This ensures that the identity can be propagated properly.

{
    "Effect": "Allow",
    "Principal": {
        "Service": "sagemaker.amazonaws.com"
    },
    "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
             ]
}

(Optional) If using the SDK of a Partner AI App to access functionality in SageMaker AI, add the following CallPartnerAppApi permission to the role used to run the SDK code. If running the SDK code from Studio, add the permission to the Studio execution role. If running the code from anywhere other than Studio, add the permission to the IAM role used with the notebook. This gives the user access the Partner AI App functionality from the Partner AI App’s SDK.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CallPartnerAppApi"
            ],
            "Resource": [
                "arn:aws:sagemaker:region:account:partner-app/app"
            ]
        }
    ]
}