Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Prasyarat
Multi-turn RL menggunakan CreateJob API SageMaker AI, yang memerlukan izin tambahan di atas prasyarat penyesuaian model yang ada. Tabel di bawah ini merangkum apa yang baru versus yang sudah dibahas.
| Apa | Status | Catatan |
|---|---|---|
| Kebijakan kepercayaan: job.sagemaker.amazonaws.com | Baru | Diperlukan untuk CreateJob API |
| Kebijakan kepercayaan: bedrock-agentcore.amazonaws.com | Baru | Diperlukan pada peran runtime agen (hanya AgentCore jalur) |
| PassRole: job.sagemaker.amazonaws.com | Baru | Prereq yang ada hanya mencakup sagemaker.amazonaws.com |
| Tindakan pekerjaan (CreateJob DescribeJob,, dll.) | Baru | Tidak masuk AmazonSageMakerFullAccess |
| inti agen dasar: ListAgentRuntimes | Baru | Diperlukan untuk Studio runtime picker |
| inti agen dasar: ListAgentRuntimeVersions | Baru | Diperlukan untuk pemilih versi Studio |
| AmazonSageMakerJobFullAccess kebijakan yang dikelola | Baru | Lampirkan ke peran eksekusi pekerjaan |
| AmazonSageMakerJobRuntimeAccess kebijakan yang dikelola | Baru | Lampirkan ke peran runtime agen |
| Lambda, penyebaran batuan dasar, S3, KMS, MLFlow, CloudWatch | Sudah tercakup | Melalui prasyarat yang ada atau kebijakan terkelola |
Peran penelepon
{ "Version": "2012-10-17", "Statement": [ { "Sid": "PassRoleForCreateJob", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::<account-id>:role/<ExecutionRoleName>", "Condition": { "StringEquals": { "iam:PassedToService": "job.sagemaker.amazonaws.com" } } }, { "Sid": "MTRLJobActions", "Effect": "Allow", "Action": [ "sagemaker:CreateJob", "sagemaker:DescribeJob", "sagemaker:StopJob", "sagemaker:DeleteJob" ], "Resource": "arn:aws:sagemaker:*:*:job/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MTRLListJobsPermission", "Effect": "Allow", "Action": [ "sagemaker:ListJobs", "sagemaker:ListJobSchemaVersions", "sagemaker:DescribeJobSchemaVersion" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
PassRole — memungkinkan pemanggil mendelegasikan peran eksekusi kejob.sagemaker.amazonaws.com.
Kebijakan terkelola
Multi-turn RL menggunakan dua kebijakan ter AWS kelola. Lampirkan masing-masing ke peran yang sesuai sebelum membuat pekerjaan.
AmazonSageMakerJobFullAccess— lampirkan ke peran eksekusi pekerjaan SageMaker AI (yang RoleArn Anda lewatiCreateJob).
Kebijakan ini memberi pekerjaan izin yang diperlukan saat menjalankan: read/write akses ke data pelatihan dan pos pemeriksaan di S3, izin KMS untuk S3-side enkripsi, akses ke konten hub SageMaker AI dan paket model, pelacakan eksperimen MLFlow, pemanggilan agen melalui Bedrock AgentCore atau Lambda, manajemen antarmuka jaringan VPC, dan penulisan Log. CloudWatch Referensi: AmazonSageMakerJobFullAccess.
AmazonSageMakerJobRuntimeAccess— lampirkan ke peran runtime agen (peran yang dijalankan agen Anda, baik di Bedrock AgentCore atau di belakang forwarder Lambda). Kebijakan ini memberikan API runtime yang dipanggil agen Anda selama peluncuran:sagemaker:Sample,sagemaker:SampleWithResponseStream,, sagemaker:CompleteRolloutsagemaker:UpdateReward, dansagemaker:CallWithBearerToken. Referensi: AmazonSageMakerJobRuntimeAccess.
Pembaruan kebijakan kepercayaan
Tambahkan job.sagemaker.amazonaws.com ke kebijakan kepercayaan peran eksekusi Anda:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "job.sagemaker.amazonaws.com" }, "Action": ["sts:AssumeRole", "sts:TagSession"] } ] }
Jika menggunakan Bedrock AgentCore, peran runtime agen Anda juga memerlukan kebijakan kepercayaannya sendiri:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock-agentcore.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Kebijakan inline tambahan untuk Studio UI
Jika Anda mengirimkan pekerjaan melalui SageMaker AI Studio, tambahkan kebijakan sebaris berikut ke peran eksekusi domain SageMaker AI Anda:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "MTRLJobActions", "Effect": "Allow", "Action": [ "sagemaker:CreateJob", "sagemaker:DescribeJob", "sagemaker:StopJob", "sagemaker:DeleteJob", "sagemaker:ListJobs", "sagemaker:ListJobSchemaVersions", "sagemaker:DescribeJobSchemaVersion" ], "Resource": "arn:aws:sagemaker:*:*:job/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockAgentCoreListPermissions", "Effect": "Allow", "Action": [ "bedrock-agentcore:ListAgentRuntimes", "bedrock-agentcore:ListAgentRuntimeVersions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "PassRoleForCreateJob", "Effect": "Allow", "Action": "iam:PassRole", "Resource": "arn:aws:iam::*:role/*", "Condition": { "StringEquals": { "iam:PassedToService": "job.sagemaker.amazonaws.com", "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
Opsi kebijakan kustom
Jika Anda lebih suka menentukan kebijakan Anda sendiri daripada menggunakan kebijakan yang AWS dikelola, gunakan yang berikut ini sebagai titik awal.
SageMaker Kebijakan peran eksekusi pekerjaan AI (setara denganAmazonSageMakerJobFullAccess):
{ "Version": "2012-10-17", "Statement": [ { "Sid": "S3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "KMSDescribeKey", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeHubContent" ], "Resource": [ "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerModelPackagePermissions", "Effect": "Allow", "Action": [ "sagemaker:AccessModelPackage", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MLflowPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeMlflowApp", "sagemaker:CallMlflowAppApi", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:StartTrace", "sagemaker-mlflow:EndTrace", "sagemaker-mlflow:SearchTraces", "sagemaker-mlflow:ListArtifacts" ], "Resource": [ "arn:aws:sagemaker:*:*:mlflow-app/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockAgentCorePermissions", "Effect": "Allow", "Action": [ "bedrock-agentcore:InvokeAgentRuntime", "bedrock-agentcore:StopRuntimeSession", "bedrock-agentcore:GetAgentRuntime" ], "Resource": "arn:aws:bedrock-agentcore:*:*:runtime/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2NetworkPermissions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeDhcpOptions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2NetworkInterfaceTagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Sid": "EC2NetworkInterfaceDeletePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaPermissions", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
Hubungan kepercayaan untuk peran eksekusi:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "job.sagemaker.amazonaws.com" }, "Action": ["sts:AssumeRole", "sts:TagSession"] } ] }
AmazonSageMakerJobRuntimeAccess setara + BedrockAgentCoreFullAccess
{ "Version": "2012-10-17", "Statement": [ { "Sid": "SageMakerJobRuntimePermissions", "Effect": "Allow", "Action": [ "sagemaker:Sample", "sagemaker:SampleWithResponseStream", "sagemaker:CompleteRollout", "sagemaker:UpdateReward" ], "Resource": "arn:aws:sagemaker:*:*:job/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BearerTokenPermissions", "Effect": "Allow", "Action": [ "sagemaker:CallWithBearerToken" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KMSPermissionsForMTRLRuntime", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "sagemaker.*.amazonaws.com" } } } ] }
Hubungan kepercayaan untuk peran runtime agen:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "bedrock-agentcore.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Catatan forwarder Lambda
Perizinan Lambda kustomisasi model yang ada mencakup fungsi dengan SageMaker atau sagemaker dalam nama. Jika forwarder Lambda Anda menggunakan konvensi penamaan yang berbeda, tambahkan ARN-nya secara eksplisit:
{ "Sid": "CustomAgentLambdaPermission", "Effect": "Allow", "Action": ["lambda:InvokeFunction"], "Resource": "arn:aws:lambda:*:*:function:your-agent-forwarder-function-name", "Condition": { "StringEquals": {"aws:ResourceAccount": "${aws:PrincipalAccount}"} } }
Pengaturan Lainnya
-
Jika Anda menggunakan VPC yang dikelola pelanggan, lihat. Konfigurasikan VPC untuk pekerjaan RL multi-putaran
-
Jika Anda menggunakan kunci KMS yang dikelola pelanggan untuk mengenkripsi input dan output pekerjaan, peran eksekusi, peran pemanggil, dan peran runtime agen harus memiliki izin tambahan. Lihat Enkripsi saat diam untuk pembelajaran penguatan multi-putaran.
