本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # 先决条件 在开始之前，请满足以下先决条件： + 通过 Studio 访问权限登录 SageMaker AI 域。如果您没有权限将 Studio 设置为域的默认体验，请联系您的管理员。有关更多信息，请参阅 [Amazon A SageMaker I 域名概述](https://docs.aws.amazon.com/sagemaker/latest/dg/gs-studio-onboard.html)。 + AWS CLI 按照[安装当前 AWS CLI 版本中的步骤进行](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv1.html#install-tool-bundled)更新。 + 在本地计算机上运行`aws configure`并提供您的 AWS 凭据。有关 AWS 证书的信息，请参阅[了解和获取您的 AWS 证书](https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html)。 ## 所需的 IAM 权限 SageMaker 自定义 AI 模型需要为您的 SageMaker AI 执行角色添加适当的权限。 ### 通过控制台设置权限 如果您通过控制台创建 SageMaker AI 域，则模型自定义权限将根据您的设置方法自动处理： + **快速设置**-默认情况下包括模型自定义权限。无需进行其他配置。 + **自定义设置**-配置执行角色时，选择 “**模型自定义** ML” 活动。有关机器学习活动及其授予的权限的更多信息，请参阅[为 IAM 角色配置机器学习活动](https://docs.aws.amazon.com/sagemaker/latest/dg/role-manager-ml-activities.html)。 ### 手动设置权限 如果您通过 AWS CLI、SDK 或设置域 CloudFormation，或者需要向现有执行角色添加模型自定义权限，请使用以下选项之一。 **选项 1（推荐）：附加 AWS 托管策略** 将`AmazonSageMakerModelCustomizationCoreAccess`托管策略附加到您的 SageMaker AI 执行角色。该政策涵盖基本模型自定义所需的所有权限，包括无服务器训练、自定义奖励函数 RL、模型评估以及部署到 SageMaker AI 或 Bedrock 端点。有关附加策略的信息，请参阅 Identity and A *ccess Management 用户指南中的添加和删除 IAM AWS 身份*[权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)。 **选项 2：创建内联策略** 如果您更喜欢手动管理权限，请使用以下 JSON 创建内联策略并将其附加到您的执行角色： ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerPublicHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListHubContents" ], "Resource": [ "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" ] }, { "Sid": "SageMakerHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:ImportHubContent", "sagemaker:ListHubs", "sagemaker:ListHubContents", "sagemaker:ListHubContentVersions", "sagemaker:DescribeHubContent", "sagemaker:DeleteHubContent" ], "Resource": [ "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "JumpStartS3Access", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::jumpstart*" ] }, { "Sid": "SageMakerTrainingJob", "Effect": "Allow", "Action": [ "sagemaker:CreateTrainingJob", "sagemaker:DescribeTrainingJob", "sagemaker:ListTrainingJobs", "sagemaker:StopTrainingJob" ], "Resource": [ "arn:aws:sagemaker:*:*:training-job/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerMLFlow", "Effect": "Allow", "Action": [ "sagemaker:UpdateMlflowApp", "sagemaker:DescribeMlflowApp", "sagemaker:CreatePresignedMlflowAppUrl", "sagemaker:CallMlflowAppApi", "sagemaker-mlflow:AccessUI", "sagemaker-mlflow:GetExperiment", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetLoggedModel", "sagemaker-mlflow:SearchExperiments", "sagemaker-mlflow:SearchRuns", "sagemaker-mlflow:ListArtifacts", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:LogMetric", "sagemaker-mlflow:LogParam", "sagemaker-mlflow:LogModel", "sagemaker-mlflow:LogInputs", "sagemaker-mlflow:SetTag", "sagemaker-mlflow:UpdateRun" ], "Resource": [ "arn:aws:sagemaker:*:*:mlflow-app/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BYODataSetS3Access", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::*SageMaker*", "arn:aws:s3:::*Sagemaker*", "arn:aws:s3:::*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerModelPackage", "Effect": "Allow", "Action": [ "sagemaker:CreateModel", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:UpdateModelPackage", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:ListModelPackages", "sagemaker:ListModelPackageGroups", "sagemaker:DescribeModel", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerLineage", "Effect": "Allow", "Action": [ "sagemaker:CreateAction", "sagemaker:CreateArtifact", "sagemaker:CreateContext", "sagemaker:DescribeAction", "sagemaker:DescribeArtifact", "sagemaker:DescribeTrialComponent", "sagemaker:QueryLineage", "sagemaker:AddAssociation", "sagemaker:UpdateArtifact" ], "Resource": [ "arn:aws:sagemaker:*:*:action/*", "arn:aws:sagemaker:*:*:artifact/*", "arn:aws:sagemaker:*:*:context/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:experiment-trial-component/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:pipeline/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerPipelines", "Effect": "Allow", "Action": [ "sagemaker:CreatePipeline", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:UpdatePipeline", "sagemaker:StartPipelineExecution" ], "Resource": [ "arn:aws:sagemaker:*:*:pipeline/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInference", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateInferenceComponent", "sagemaker:DescribeInferenceComponent", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DeleteInferenceComponent", "sagemaker:DeleteEndpoint", "sagemaker:InvokeEndpoint" ], "Resource": [ "arn:aws:sagemaker:*:*:inference-component/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInferenceAutoscaling", "Effect": "Allow", "Action": [ "application-autoscaling:DescribeScalableTargets" ], "Resource": [ "arn:aws:application-autoscaling:*:*:scalable-target/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerInferenceEcrReadAccess", "Effect": "Allow", "Action": [ "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Sid": "SageMakerListPermissions", "Effect": "Allow", "Action": [ "sagemaker:ListActions", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListEndpoints", "sagemaker:ListInferenceComponents", "sagemaker:ListMlflowApps", "sagemaker:ListMlflowTrackingServers", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListWorkforces", "sagemaker:Search" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerTagsPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*", "arn:aws:sagemaker:*:*:training-job/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:inference-component/*", "arn:aws:sagemaker:*:*:action/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerJobAdvancedSettings", "Effect": "Allow", "Action": [ "kms:DescribeKey", "kms:ListAliases", "iam:ListRoles", "ec2:DescribeVpcs" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogReadAccess", "Effect": "Allow", "Action": [ "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/*", "arn:aws:logs:*:*:log-group::log-stream:" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogWriteAccess", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/sagemaker/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaListFunctions", "Effect": "Allow", "Action": [ "lambda:ListFunctions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaPermissionsForRewardFunction", "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:InvokeFunction", "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:*SageMaker*", "arn:aws:lambda:*:*:function:*sagemaker*", "arn:aws:lambda:*:*:function:*Sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaLayerForAWSSDK", "Effect": "Allow", "Action": [ "lambda:GetLayerVersion" ], "Resource": [ "arn:aws:lambda:*:336392948345:layer:AWSSDK*" ] }, { "Sid": "BedrockCustomModelAndEvaluation", "Effect": "Allow", "Action": [ "bedrock:CreateCustomModel", "bedrock:CreateEvaluationJob", "bedrock:GetCustomModel", "bedrock:GetModelImportJob", "bedrock:GetImportedModel", "bedrock:GetEvaluationJob", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:*:*:evaluation-job/*", "arn:aws:bedrock:*:*:imported-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:model-import-job/*", "arn:aws:bedrock:*:*:foundation-model/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockModelImportAndList", "Effect": "Allow", "Action": [ "bedrock:CreateModelImportJob", "bedrock:ListProvisionedModelThroughputs", "bedrock:ListCustomModelDeployments", "bedrock:ListCustomModels", "bedrock:ListModelImportJobs" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockFoundationModelOperations", "Effect": "Allow", "Action": [ "bedrock:GetFoundationModelAvailability", "bedrock:ListFoundationModels" ], "Resource": "*" }, { "Sid": "PassRoleForSageMaker", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/*SageMaker*", "arn:aws:iam::*:role/service-role/*Sagemaker*", "arn:aws:iam::*:role/service-role/*sagemaker*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": [ "sagemaker.amazonaws.com", "job.sagemaker.amazonaws.com" ] }, "ArnLike": { "iam:AssociatedResourceArn": "arn:aws:sagemaker:*:*:*" } } }, { "Sid": "PassRoleForAWSLambda", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/SageMakerForLambda*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "lambda.amazonaws.com" }, "ArnLike": { "iam:AssociatedResourceArn": "arn:aws:lambda:*:*:function:*" } } }, { "Sid": "PassRoleForBedrock", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/SageMakerForBedrock*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "iam:PassedToService": "bedrock.amazonaws.com" } } } ] } ``` ## Lambda 和 Bedrock 的角色 除了 SageMaker AI 执行角色的权限外，模型自定义还需要其他两个服务的角色： + **Lambda** — 在训练期间执行自定义奖励函数 RL-based + **Bedrock** — 导入自定义模型进行部署时从 S3 读取模型工件 ### 如果您之前配置了执行角色（传统方法） 如果您之前遵循了本文档并更新了 SageMaker AI 执行角色的信任策略以包含`lambda.amazonaws.com`和`bedrock.amazonaws.com`作为可信服务主体，则您的现有配置将继续起作用。无需进行任何更改。 要使用这种方法，您的执行角色的信任策略必须包括以下服务主体： ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "sagemaker.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } ``` **注意** 这种方法不太安全，因为 Lambda 和 Bedrock 可以担任您的执行角色并继承其所有权限，而不仅仅是每项服务所需的权限。 ### 创建单独的角色（推荐） 为了提高安全性，请创建两个单独的范围缩小 IAM 角色——一个用于 Lambda，一个用于 Bedrock，而不是将这些服务主体添加到你的 AI 执行角色中。 SageMaker 每个角色仅信任其各自的服务，并且仅包含该服务所需的最低权限。 如果您通过 SageMaker AI 控制台快速设置来设置域，则会自动创建这些角色。如果您通过其他方法设置域名，请使用以下步骤手动创建域名。 ### Lambda 角色 此角色允许 Lambda 在 RL-based 模型自定义期间执行自定义奖励函数。 **命名惯例**：`SageMakerForLambda-{domain-id}` 1. 使用以下信任策略创建 IAM 角色。``替换为您的 12 位数 AWS 账户 ID。 ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "" }, "ArnLike": { "aws:SourceArn": "arn:aws:lambda:*::function:*" } } } ] } ``` 1. 将 `AWSLambdaBasicExecutionRole` AWS 托管式策略附加到角色。这将授予写入日志所需的权限 CloudWatch。 **注意** 此角色不需要 SageMaker AI 或 Bedrock 权限。`aws:SourceAccount`和`aws:SourceArn`条件将角色仅限于您账户中的 Lambda 函数，以防混淆副手攻击。 ### 基岩角色 此角色允许 Bedrock 在导入自定义模型时从您的 SageMaker AI-managed S3 存储桶中读取模型工件。 **命名惯例**：`SageMakerForBedrock-{domain-id}` 1. 使用以下信任策略创建 IAM 角色。``替换为您的 12 位数 AWS 账户 ID。 ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "" }, "ArnLike": { "aws:SourceArn": "arn:aws:bedrock:*::*" } } } ] } ``` 1. 将以下内联策略附加到该角色： ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerBucketReadAccess", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}", "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "AllowSSLRequestsOnly", "Action": "s3:*", "Effect": "Deny", "Resource": [ "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}", "arn:aws:s3:::sagemaker-*-${aws:PrincipalAccount}/*" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } } ] } ``` **注意** 此角色不需要 SageMaker AI、Lambda 或 Bedrock API 权限。它仅为 Bedrock 提供对 SageMaker AI-managed S3 存储桶中模型工件的读取权限。