本文為英文版的機器翻譯版本,如內容有任何歧義或不一致之處,概以英文版為準。
AWS 專案與管 SageMaker 理的政策 JumpStart
這些 AWS 受管政策可新增使用內建 Amazon SageMaker 專案範本和 JumpStart 解決方案的許可。這些政策可在您的 AWS account 和由從 SageMaker 控制台創建的執行角色使用。
SageMaker 專案和 JumpStart 使用 AWS 要佈建的 Service Catalog AWS 客戶帳戶中的資源。某些建立的資源需要擔任執行角色。例如,如果 AWS Service Catalog 會代表客戶針對 SageMaker 機器學習 CI/CD 專案建立管線,然後該管線需要角色。 CodePipeline IAM
該AmazonSageMakerServiceCatalogProductsLaunchRoleAmazonSageMakerServiceCatalogProductsLaunchRole
角AmazonSageMakerServiceCatalogProductsUseRole
色傳遞給已佈建的 AWS Service Catalog 產品資源。
主題
- AWS 管理策略: AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
- AWS 受管理的策略: AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy
- AWS 受管理的策略: AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy
- AWS 受管理的策略: AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy
- AWS 受管理的策略: AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy
- AWS 受管政策: AmazonSageMakerServiceCatalogProductsCloudformationServiceRole策略
- AWS 受管理的策略: AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
- AWS 受管理的策略: AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy
- AWS 受管政策: AmazonSageMakerServiceCatalogProductsEventsServiceRole策略
- AWS 受管政策: AmazonSageMakerServiceCatalogProductsFirehoseServiceRole策略
- AWS 受管政策: AmazonSageMakerServiceCatalogProductsGlueServiceRole策略
- AWS 受管政策: AmazonSageMakerServiceCatalogProductsLambdaServiceRole策略
- Amazon SageMaker 更新 AWS Service Catalog AWS 受管政策
AWS 管理策略: AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
此服務角色原則由 AWS Service Catalog 從 Amazon 產品 SageMaker 組合提供產品的服務。該策略授予一組相關的權限 AWS 服務包括 AWS CodePipeline, AWS CodeBuild, AWS CodeCommit, AWS Glue AWS CloudFormation,和其他人。
該AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
策略旨在由從 SageMaker 控制台建立的AmazonSageMakerServiceCatalogProductsLaunchRole
角色使用。該策略將權限添加到提供 AWS SageMaker 專案資源,以及將 Service Catalog JumpStart 用於客戶帳戶。
許可詳細資訊
此政策包含以下許可。
-
apigateway
— 允許角色呼叫標記為的API閘道端點sagemaker:launch-source
。 -
cloudformation
— 允許 AWS Service Catalog 以建立、更新和刪除 CloudFormation 堆疊。也允許 Service Catalog 標記和取消標記資源。 -
codebuild
— 允許以下方式承擔的角色 AWS Service Catalog 並傳遞 CloudFormation 給創建,更新和刪除 CodeBuild 項目。 -
codecommit
— 允許以下方式承擔的角色 AWS Service Catalog 並傳遞 CloudFormation 給創建,更新和刪除 CodeCommit 存儲庫。 -
codepipeline
— 允許以下方式承擔的角色 AWS Service Catalog 並傳遞 CloudFormation 給創建,更新和刪除 CodePipelines。 -
codestarconnections
,codestar-connections
— 還允許角色通過 AWS CodeConnections 以及 AWS CodeStar 連接。 -
cognito-idp
- 讓角色建立、更新和刪除群組和使用者集區。也可以標記資源。 -
ecr
— 允許以下方式承擔的角色 AWS Service Catalog 並傳遞 CloudFormation 給創建和刪除 Amazon ECR 存儲庫。也可以標記資源。 -
events
— 允許以下方式承擔的角色 AWS Service Catalog 並傳遞 CloudFormation 給建立和刪除 EventBridge 規則。用於將CICD管線的各種元件綁在一起。 -
firehose
— 允許該角色與「Firehose」串流互動。 -
glue
— 允許角色與之互動 AWS Glue. -
iam
- 讓角色傳遞字首為AmazonSageMakerServiceCatalog
的角色。這是必要的,當項目規定 AWS Service Catalog 產品,作為一個角色需要傳遞給 AWS Service Catalog. -
lambda
— 允許角色與之互動 AWS Lambda。 還允許標記資源。 -
logs
- 讓角色建立、刪除和存取日誌串流。 -
s3
— 允許以下方式承擔的角色 AWS Service Catalog 並傳遞 CloudFormation 給存放專案範本程式碼的 Amazon S3 儲存貯體。 -
sagemaker
— 允許角色與各種 SageMaker 服務互動。這可以在模板佈建 CloudFormation 期間以及CICD管道執行 CodeBuild 期間完成。也可以標記以下資源:端點、端點組態、模型、管道、專案和模型套件。 -
states
- 讓角色建立、刪除和更新字首為sagemaker
的 Step Function。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPermission", "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPostPermission", "Effect": "Allow", "Action": [ "apigateway:POST" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPatchPermission", "Effect": "Allow", "Action": [ "apigateway:PATCH" ], "Resource": [ "arn:aws:apigateway:*::/account" ] }, { "Sid": "AmazonSageMakerServiceCatalogCFnMutatePermission", "Effect": "Allow", "Action": [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition": { "ArnLikeIfExists": { "cloudformation:RoleArn": [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogCFnTagPermission", "Effect": "Allow", "Action": [ "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", "Condition" : { "Null": { "aws:ResourceTag/sagemaker:project-name": "false" } } }, { "Sid": "AmazonSageMakerServiceCatalogCFnReadPermission", "Effect": "Allow", "Action": [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid": "AmazonSageMakerServiceCatalogCFnTemplatePermission", "Effect": "Allow", "Action": [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource": "*" }, { "Sid": "AmazonSageMakerServiceCatalogCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeCommitPermission", "Effect": "Allow", "Action": [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource": [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeCommitListPermission", "Effect": "Allow", "Action": [ "codecommit:ListRepositories" ], "Resource": "*" }, { "Sid": "AmazonSageMakerServiceCatalogCodePipelinePermission", "Effect": "Allow", "Action": [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource": [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCIAMUserPermission", "Effect": "Allow", "Action": [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource": "*", "Condition": { "ForAnyValue:StringLike": { "aws:TagKeys": [ "sagemaker:launch-source" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogCIAMPermission", "Effect": "Allow", "Action": [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:launch-source": "*" } } }, { "Sid": "AmazonSageMakerServiceCatalogECRPermission", "Effect": "Allow", "Action": [ "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:TagResource" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogEventBridgePermission", "Effect": "Allow", "Action": [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogFirehosePermission", "Effect": "Allow", "Action": [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Sid": "AmazonSageMakerServiceCatalogGluePermission", "Effect": "Allow", "Action": [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueClassiferPermission", "Effect": "Allow", "Action": [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource": [ "*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueWorkflowPermission", "Effect": "Allow", "Action": [ "glue:CreateWorkflow" ], "Resource": [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueJobPermission", "Effect": "Allow", "Action": [ "glue:CreateJob" ], "Resource": [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueCrawlerPermission", "Effect": "Allow", "Action": [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource": [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogGlueTriggerPermission", "Effect": "Allow", "Action": [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource": [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Sid": "AmazonSageMakerServiceCatalogLambdaPermission", "Effect": "Allow", "Action": [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogLambdaTagPermission", "Effect": "Allow", "Action": "lambda:TagResource", "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogLogGroupPermission", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Sid": "AmazonSageMakerServiceCatalogS3ReadPermission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*", "Condition": { "StringEquals": { "s3:ExistingObjectTag/servicecatalog:provisioning": "true" } } }, { "Sid": "AmazonSageMakerServiceCatalogS3ReadSagemakerResourcePermission", "Effect": "Allow", "Action": "s3:GetObject", "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogS3MutatePermission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource": "arn:aws:s3:::sagemaker-*" }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource": [ "arn:aws:sagemaker:*:*:*" ] }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerTagPermission", "Effect": "Allow", "Action": [ "sagemaker:AddTags" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ], "Condition": { "ForAllValues:StringLike": { "aws:TagKeys": [ "sagemaker:*" ] } } }, { "Sid": "AmazonSageMakerServiceCatalogSageMakerImagePermission", "Effect": "Allow", "Action": [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource": [ "arn:aws:sagemaker:*:*:image/*" ] }, { "Sid": "AmazonSageMakerServiceCatalogStepFunctionPermission", "Effect": "Allow", "Action": [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource": [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Sid": "AmazonSageMakerServiceCatalogCodeStarPermission", "Effect": "Allow", "Action": "codestar-connections:PassConnection", "Resource": "arn:aws:codestar-connections:*:*:connection/*", "Condition": { "StringEquals": { "codestar-connections:PassedToService": "codepipeline.amazonaws.com" } } }, { "Sid": "AmazonSageMakerServiceCatalogCodeConnectionPermission", "Effect": "Allow", "Action": "codeconnections:PassConnection", "Resource": "arn:aws:codeconnections:*:*:connection/*", "Condition": { "StringEquals": { "codeconnections:PassedToService": "codepipeline.amazonaws.com" } } }, ] }
AWS 受管理的策略: AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy
Amazon API 網關內部使用此政策 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
lambda
- 調用合作夥伴範本建立的函式。 -
sagemaker
- 調用合作夥伴範本建立的端點。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:sagemaker-*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "sagemaker:InvokeEndpoint", "Resource": "arn:aws:sagemaker:*:*:endpoint/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
AWS 受管理的策略: AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy
此政策的使用者 AWS CloudFormation 在 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
iam
- 傳遞AmazonSageMakerServiceCatalogProductsLambdaRole
和AmazonSageMakerServiceCatalogProductsApiGatewayRole
角色。 -
lambda
-創建,更新,刪除和調用 AWS Lambda 函數;擷取、發佈和刪除 Lambda 層的版本。 -
apigateway
— 建立、更新和刪除 Amazon API 閘道資源。 -
s3
- 從 Amazon Simple Storage Service (Amazon S3) 儲存貯體擷取lambda-auth-code/layer.zip
檔案。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsLambdaRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsApiGatewayRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "apigateway.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:ListTags", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name", "sagemaker:partner" ] } } }, { "Effect": "Allow", "Action": [ "lambda:PublishLayerVersion", "lambda:GetLayerVersion", "lambda:DeleteLayerVersion", "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:layer:sagemaker-*", "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT" ], "Resource": [ "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST", "apigateway:PUT" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name", "sagemaker:partner" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*/lambda-auth-code/layer.zip" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
AWS 受管理的策略: AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy
此政策的使用者 AWS Lambda 在 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
secretsmanager
- 從合作夥伴提供的機密中擷取資料,用於合作夥伴範本。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:partner": false }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
AWS 受管理的策略: AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy
Amazon API 網關內部使用此政策 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
logs
— 創建和讀取 CloudWatch 日誌組, 流, 和事件; 更新事件; 描述各種資源.這些許可僅限於其日誌群組前字首以“aws/apigateway/”開頭的資源。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/apigateway/*" } ] }
AWS 受管政策: AmazonSageMakerServiceCatalogProductsCloudformationServiceRole策略
此政策的使用者 AWS CloudFormation 在 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
sagemaker
— 允許訪問各種 SageMaker 資源,但不包括域,用戶配置文件,應用程序和流程定義。 -
iam
- 傳遞AmazonSageMakerServiceCatalogProductsCodeBuildRole
和AmazonSageMakerServiceCatalogProductsExecutionRole
角色。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ] } ] }
AWS 受管理的策略: AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
此政策的使用者 AWS CodeBuild 在 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
sagemaker
— 允許訪問各種 SageMaker 資源. -
codecommit
— 將 CodeCommit 檔案上傳到 CodeBuild 管道,獲取上傳狀態並取消上傳;獲取分支並提交信息。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。 -
ecr
— 創建 Amazon ECR 存儲庫和容器映像; 上傳圖像層。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存庫。ecr
- 閱讀所有資源。 -
iam
- 傳遞下列角色:-
AmazonSageMakerServiceCatalogProductsCloudformationRole
到 AWS CloudFormation. -
AmazonSageMakerServiceCatalogProductsCodeBuildRole
到 AWS CodeBuild. -
AmazonSageMakerServiceCatalogProductsCodePipelineRole
到 AWS CodePipeline. -
AmazonSageMakerServiceCatalogProductsEventsRole
到 Amazon EventBridge。 -
AmazonSageMakerServiceCatalogProductsExecutionRole
到 Amazon SageMaker。
-
-
logs
— 創建和讀取 CloudWatch 日誌組, 流, 和事件; 更新事件; 描述各種資源.這些許可僅限於其名稱字首以 “aws/codebuild” 開頭的資源。
-
s3
- 建立、讀取和列出 Amazon S3 儲存貯體。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存貯體。 -
codestarconnections
,codestar-connections
— 使用 AWS CodeConnections 以及 AWS CodeStar 連接。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AmazonSageMakerCodeBuildCodeCommitPermission", "Effect": "Allow", "Action": [ "codecommit:CancelUploadArchive", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetUploadArchiveStatus", "codecommit:UploadArchive" ], "Resource": "arn:aws:codecommit:*:*:sagemaker-*" }, { "Sid": "AmazonSageMakerCodeBuildECRReadPermission", "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImageScanFindings", "ecr:DescribeRegistry", "ecr:DescribeImageReplicationStatus", "ecr:DescribeRepositories", "ecr:DescribeImageReplicationStatus", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer" ], "Resource": [ "*" ] }, { "Sid": "AmazonSageMakerCodeBuildECRWritePermission", "Effect": "Allow", "Action": [ "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid": "AmazonSageMakerCodeBuildPassRoletPermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsEventsRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodePipelineRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCloudformationRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ], "Condition": { "StringEquals": { "iam:PassedToService": [ "events.amazonaws.com", "codepipeline.amazonaws.com", "cloudformation.amazonaws.com", "codebuild.amazonaws.com", "sagemaker.amazonaws.com" ] } } }, { "Sid": "AmazonSageMakerCodeBuildLogPermission", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*" }, { "Sid": "AmazonSageMakerCodeBuildS3Permission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors", "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid": "AmazonSageMakerCodeBuildSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ] }, { "Sid" : "AmazonSageMakerCodeBuildCodeStarConnectionPermission", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } }, { "Sid" : "AmazonSageMakerCodeBuildCodeConnectionPermission", "Effect": "Allow", "Action": [ "codeconnections:UseConnection" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } } ] }
AWS 受管理的策略: AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy
此政策的使用者 AWS CodePipeline 在 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
cloudformation
— 建立、讀取、刪除和更新 CloudFormation堆疊;建立、讀取、刪除和執行變更集;設定堆疊原則;標記和取消標記資源。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。 -
s3
— 建立、讀取、列出和刪除 Amazon S3 儲存貯體;新增、讀取和刪除值區中的物件;讀取和設定CORS組態;讀取存取控制清單 (ACL);以及讀取 AWS 值區所在的區域。這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。
-
iam
- 傳遞AmazonSageMakerServiceCatalogProductsCloudformationRole
角色。 -
codebuild
-獲取構 CodeBuild 建信息並開始構建。這些許可僅限於名稱以 “sagemaker-” 開頭的專案與建置資源。 -
codecommit
— 將 CodeCommit 檔案上傳到 CodeBuild 管道,獲取上傳狀態並取消上傳;獲取分支並提交信息。 -
codestarconnections
,codestar-connections
— 使用 AWS CodeConnections 以及 AWS CodeStar 連接。
{ "Version": "2012-10-17", "Statement": [ { "Sid" : "AmazonSageMakerCodePipelineCFnPermission", "Effect": "Allow", "Action": [ "cloudformation:CreateChangeSet", "cloudformation:CreateStack", "cloudformation:DescribeChangeSet", "cloudformation:DeleteChangeSet", "cloudformation:DeleteStack", "cloudformation:DescribeStacks", "cloudformation:ExecuteChangeSet", "cloudformation:SetStackPolicy", "cloudformation:UpdateStack" ], "Resource": "arn:aws:cloudformation:*:*:stack/sagemaker-*" }, { "Sid" : "AmazonSageMakerCodePipelineCFnTagPermission", "Effect": "Allow", "Action": [ "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource": "arn:aws:cloudformation:*:*:stack/sagemaker-*" "Condition" : { "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name" ] } }, { "Sid" : "AmazonSageMakerCodePipelineS3Permission", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*" ] }, { "Sid" : "AmazonSageMakerCodePipelinePassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCloudformationRole" ] }, { "Sid" : "AmazonSageMakerCodePipelineCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:BatchGetBuilds", "codebuild:StartBuild" ], "Resource": [ "arn:aws:codebuild:*:*:project/sagemaker-*", "arn:aws:codebuild:*:*:build/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerCodePipelineCodeCommitPermission", "Effect": "Allow", "Action": [ "codecommit:CancelUploadArchive", "codecommit:GetBranch", "codecommit:GetCommit", "codecommit:GetUploadArchiveStatus", "codecommit:UploadArchive" ], "Resource": "arn:aws:codecommit:*:*:sagemaker-*" }, { "Sid" : "AmazonSageMakerCodePipelineCodeStarConnectionPermission", "Effect": "Allow", "Action": [ "codestar-connections:UseConnection" ], "Resource": [ "arn:aws:codestar-connections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } }, { "Sid" : "AmazonSageMakerCodePipelineCodeConnectionPermission", "Effect": "Allow", "Action": [ "codeconnections:UseConnection" ], "Resource": [ "arn:aws:codeconnections:*:*:connection/*" ], "Condition": { "StringEqualsIgnoreCase": { "aws:ResourceTag/sagemaker": "true" } } } ] }
AWS 受管政策: AmazonSageMakerServiceCatalogProductsEventsServiceRole策略
Amazon EventBridge 內部使用此政策 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
codepipeline
-開始 CodeBuild 執行。這些許可僅限於名稱以 “sagemaker-” 開頭的管道。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "codepipeline:StartPipelineExecution", "Resource": "arn:aws:codepipeline:*:*:sagemaker-*" } ] }
AWS 受管政策: AmazonSageMakerServiceCatalogProductsFirehoseServiceRole策略
Amazon 數據 Firehose 件內使用此政策 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
firehose
— 發送 Firehose 記錄。這些許可僅限於交付串流名稱以 “sagemaker-” 開頭的資源。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" } ] }
AWS 受管政策: AmazonSageMakerServiceCatalogProductsGlueServiceRole策略
此政策的使用者 AWS 內 Glue AWS 從 Amazon 產品組合佈建的 Service Catalog 產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
glue
— 創建,讀取和刪除 AWS Glue 分區,表格和表格版本。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。創建和閱讀 AWS Glue 資料庫。這些許可僅限於名稱為 “default”、“global_temp” 或以 “sagemaker-” 開頭的資料庫。取得使用者定義的函式。 -
s3
— 建立、讀取、列出和刪除 Amazon S3 儲存貯體;新增、讀取和刪除值區中的物件;讀取和設定CORS組態;讀取存取控制清單 (ACL),以及讀取 AWS 值區所在的區域。這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。
-
logs
— 建立、讀取和刪除 CloudWatch 記錄檔群組、串流和傳送;以及建立資源原則。這些許可僅限於其名稱字首以 “aws/glue” 開頭的資源。
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeletePartition", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetDatabase", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:SearchTables", "glue:UpdatePartition", "glue:UpdateTable", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:tableVersion/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/glue/*" } ] }
AWS 受管政策: AmazonSageMakerServiceCatalogProductsLambdaServiceRole策略
此政策的使用者 AWS Lambda 在 AWS Service Catalog 來自 Amazon 產品組合的佈建產 SageMaker 品。該策略旨在附加IAM到傳AmazonSageMakerServiceCatalogProductsLaunchRole
許可詳細資訊
此政策包含以下許可。
-
sagemaker
— 允許訪問各種 SageMaker 資源. -
ecr
— 建立和刪除 Amazon ECR 儲存庫;建立、讀取和刪除容器映像;上傳影像層。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存庫。 -
events
— 建立、讀取和刪除 Amazon EventBridge 規則;以及建立和移除目標。這些許可僅限於名稱以 “sagemaker-” 開頭的規則。 -
s3
— 建立、讀取、列出和刪除 Amazon S3 儲存貯體;新增、讀取和刪除值區中的物件;讀取和設定CORS組態;讀取存取控制清單 (ACL),以及讀取 AWS 值區所在的區域。這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。
-
iam
- 傳遞AmazonSageMakerServiceCatalogProductsExecutionRole
角色。 -
logs
— 建立、讀取和刪除 CloudWatch 記錄檔群組、串流和傳送;以及建立資源原則。這些許可僅限於其名稱字首以 “aws/lambda/” 開頭的資源。
-
codebuild
— 啟動並獲取有關信息 AWS CodeBuild 構建。
{ "Version": "2012-10-17", "Statement": [ { "Sid" : "AmazonSageMakerLambdaECRPermission", "Effect": "Allow", "Action": [ "ecr:DescribeImages", "ecr:BatchDeleteImage", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaEventBridgePermission", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaS3BucketPermission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaS3ObjectPermission", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:action/*", "arn:aws:sagemaker:*:*:algorithm/*", "arn:aws:sagemaker:*:*:app-image-config/*", "arn:aws:sagemaker:*:*:artifact/*", "arn:aws:sagemaker:*:*:automl-job/*", "arn:aws:sagemaker:*:*:code-repository/*", "arn:aws:sagemaker:*:*:compilation-job/*", "arn:aws:sagemaker:*:*:context/*", "arn:aws:sagemaker:*:*:data-quality-job-definition/*", "arn:aws:sagemaker:*:*:device-fleet/*/device/*", "arn:aws:sagemaker:*:*:device-fleet/*", "arn:aws:sagemaker:*:*:edge-packaging-job/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:experiment/*", "arn:aws:sagemaker:*:*:experiment-trial/*", "arn:aws:sagemaker:*:*:experiment-trial-component/*", "arn:aws:sagemaker:*:*:feature-group/*", "arn:aws:sagemaker:*:*:human-loop/*", "arn:aws:sagemaker:*:*:human-task-ui/*", "arn:aws:sagemaker:*:*:hyper-parameter-tuning-job/*", "arn:aws:sagemaker:*:*:image/*", "arn:aws:sagemaker:*:*:image-version/*/*", "arn:aws:sagemaker:*:*:inference-recommendations-job/*", "arn:aws:sagemaker:*:*:labeling-job/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:model-bias-job-definition/*", "arn:aws:sagemaker:*:*:model-explainability-job-definition/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-quality-job-definition/*", "arn:aws:sagemaker:*:*:monitoring-schedule/*", "arn:aws:sagemaker:*:*:notebook-instance/*", "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:pipeline/*/execution/*", "arn:aws:sagemaker:*:*:processing-job/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:training-job/*", "arn:aws:sagemaker:*:*:transform-job/*", "arn:aws:sagemaker:*:*:workforce/*", "arn:aws:sagemaker:*:*:workteam/*" ] }, { "Sid" : "AmazonSageMakerLambdaPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ] }, { "Sid" : "AmazonSageMakerLambdaLogPermission", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" }, { "Sid" : "AmazonSageMakerLambdaCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:StartBuild", "codebuild:BatchGetBuilds" ], "Resource": "arn:aws:codebuild:*:*:project/sagemaker-*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:project-name": "*" } } } ] }
Amazon SageMaker 更新 AWS Service Catalog AWS 受管政策
檢視有關更新的詳細資訊 AWS SageMaker 由於此服務開始追蹤這些變更,因此 Amazon 的受管政策。
政策 | 版本 | 變更 | 日期 |
---|---|---|---|
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 |
9 |
新增 |
2024年7月1日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 |
7 |
將原則復原至第 7 版 (v7)。移除 |
2024年6月12日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 |
8 |
新增 |
2024年6月11日 |
AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy - 更新的政策 |
2 |
新增 |
2024年6月11日 |
AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy - 更新的政策 |
2 |
新增 |
2024年6月11日 |
AmazonSageMakerServiceCatalogProductsLambdaServiceRole政策 - 更新的政策 |
2 |
新增 |
2024年6月11日 |
AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy |
1 | 初始政策 |
2023 年 8 月 1 日 |
AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy |
1 | 初始政策 |
2023 年 8 月 1 日 |
AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy |
1 | 初始政策 |
2023 年 8 月 1 日 |
AmazonSageMakerServiceCatalogProductsGlueServiceRole政策 - 更新的政策 |
2 |
新增許可至 |
2022 年 8 月 26 日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 |
7 |
新增許可至 |
2022 年 8 月 2 日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 | 6 |
新增許可至 |
2022 年 7 月 14 日 |
AmazonSageMakerServiceCatalogProductsLambdaServiceRole政策 |
1 |
初始政策 |
2022 年 4 月 4 日 |
AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy |
1 |
初始政策 |
2022 年 3 月 24 日 |
AmazonSageMakerServiceCatalogProductsCloudformationServiceRole政策 |
1 |
初始政策 |
2022 年 3 月 24 日 |
AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy |
1 |
初始政策 |
2022 年 3 月 24 日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 | 5 |
新增許可至 |
2022 年 3 月 21 日 |
AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy |
1 |
初始政策 |
2022 年 2 月 22 日 |
1 |
初始政策 |
2022 年 2 月 22 日 | |
1 |
初始政策 |
2022 年 2 月 22 日 | |
AmazonSageMakerServiceCatalogProductsGlueServiceRole政策 | 1 |
初始政策 |
2022 年 2 月 22 日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 | 4 |
新增 |
2022 年 2 月 16 日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 | 3 |
新增 建立、讀取、更新和刪除 SageMaker 影像。 |
2021 年 9 月 15 日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy -更新政策 | 2 |
新增 建立、讀取、更新和刪除程式碼儲存庫。 Pass AWS CodeStar 連線至 AWS CodePipeline. |
2021 年 7 月 1 日 |
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy | 1 | 初始政策 |
2020 年 11 月 27 日 |