本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
AWS 托管策略：AmazonDataZoneSageMakerAccess
该政策授予亚马逊将亚马逊 SageMaker 资产发布到目录的 DataZone 权限。它还授予亚马逊授予访问 DataZone 权限或撤销对亚马逊在目录中 SageMaker 发布的资产的访问权限的权限。
此策略包括以下权限：
-
cloudtrail — 检索有关 CloudTrail 跟踪的信息。
-
cloudwatch — 检索当前 CloudWatch 警报。
-
日志-检索 CloudWatch 日志的指标筛选器。
-
sns — 检索SNS主题的订阅列表。
-
config-检索有关配置记录器、资源和 AWS Config 规则的信息。还允许服务相关角色创建和删除 AWS Config 规则，以及根据规则运行评估。
-
iam — 获取并生成账户的凭证报告。
-
组织-检索组织的帐户和组织单位 (OU) 信息。
-
securityhub — 检索有关如何配置 Security Hub 服务、标准和控件的信息。
-
tag — 检索有关资源标签的信息。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerReadPermission", "Effect": "Allow", "Action": [ "sagemaker:DescribeFeatureGroup", "sagemaker:ListModelPackages", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeAlgorithm", "sagemaker:ListTags", "sagemaker:DescribeDomain", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:Search" ], "Resource": "*" }, { "Sid": "AmazonSageMakerTaggingPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:shared-with:*" ] } } }, { "Sid": "AmazonSageMakerModelPackageGroupPolicyPermission", "Effect": "Allow", "Action": [ "sagemaker:PutModelPackageGroupPolicy", "sagemaker:DeleteModelPackageGroupPolicy" ], "Resource": [ "arn:*:sagemaker:*:*:model-package-group/*" ] }, { "Sid": "AmazonSageMakerRAMPermission", "Effect": "Allow", "Action": [ "ram:GetResourceShares", "ram:GetResourceShareInvitations", "ram:GetResourceShareAssociations" ], "Resource": "*" }, { "Sid": "AmazonSageMakerRAMResourcePolicyPermission", "Effect": "Allow", "Action": [ "sagemaker:PutResourcePolicy", "sagemaker:GetResourcePolicy", "sagemaker:DeleteResourcePolicy" ], "Resource": [ "arn:*:sagemaker:*:*:feature-group/*" ] }, { "Sid": "AmazonSageMakerRAMTagResourceSharePermission", "Effect": "Allow", "Action": [ "ram:TagResource" ], "Resource": "arn:*:ram:*:*:resource-share/*", "Condition": { "Null": { "aws:RequestTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerRAMDeleteResourceSharePermission", "Effect": "Allow", "Action": [ "ram:DeleteResourceShare" ], "Resource": "arn:*:ram:*:*:resource-share/*", "Condition": { "Null": { "aws:ResourceTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerRAMCreateResourceSharePermission", "Effect": "Allow", "Action": [ "ram:CreateResourceShare" ], "Resource": "*", "Condition": { "StringLikeIfExists": { "ram:RequestedResourceType": [ "sagemaker:*" ] }, "Null": { "aws:RequestTag/AwsDataZoneDomainId": "false" } } }, { "Sid": "AmazonSageMakerS3BucketPolicyPermission", "Effect": "Allow", "Action": [ "s3:DeleteBucketPolicy", "s3:PutBucketPolicy", "s3:GetBucketPolicy" ], "Resource": [ "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AmazonSageMakerS3Permission", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-datazone*", "arn:aws:s3:::SageMaker-DataZone*", "arn:aws:s3:::datazone-sagemaker*", "arn:aws:s3:::DataZone-SageMaker*", "arn:aws:s3:::amazon-datazone*" ] }, { "Sid": "AmazonSageMakerECRPermission", "Effect": "Allow", "Action": [ "ecr:GetRepositoryPolicy", "ecr:SetRepositoryPolicy", "ecr:DeleteRepositoryPolicy" ], "Resource": "*", "Condition": { "Null": { "aws:ResourceTag/AmazonDataZoneEnvironment": "false" } } }, { "Sid": "AmazonSageMakerKMSReadPermission", "Effect": "Allow", "Action": [ "kms:DescribeKey" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] } } }, { "Sid": "AmazonSageMakerKMSGrantPermission", "Effect": "Allow", "Action": [ "kms:CreateGrant" ], "Resource": "*", "Condition": { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "AmazonDataZoneEnvironment" ] }, "ForAllValues:StringEquals": { "kms:GrantOperations": [ "Decrypt" ] } } } ] }
