-

Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.

    • catatan

    6. JSON
      {
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "emr-serverless.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

    catatan

  3. catatan

    1. Buka konsol IAM di https://console.aws.amazon.com/sagemaker/.

    5. catatan

    7. Pilih Buat kebijakan.

  5. penting

    SageMaker AI console

    5. Pilih Kirim.

    Python script

    import botocore.session
import json
sess = botocore.session.get_session()
client = sess.create_client('sagemaker')

client.update_user_profile(
DomainId="domainID", 
UserProfileName="user-profile-name",
DefaultUserSettings={
    'JupyterLabAppSettings': {
        'EmrSettings': {
            'ExecutionRoleArns': ["arn:aws:iam::studio-accountID:role/EMRServerlessRuntimeExecutionRoleA", 
                             "arn:aws:iam::studio-accountID:role/EMRServerlessRuntimeExecutionRoleAA"]
        }
        
    }
})
resp = client.describe_domain(DomainId="domainID")

resp['CreationTime'] = str(resp['CreationTime'])
resp['LastModifiedTime'] = str(resp['LastModifiedTime'])
print(json.dumps(resp, indent=2))

Sebelum memulai:

    6. JSON
      {
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "emr-serverless.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

    catatan

    3. catatan

    5. Pilih Buat kebijakan.

    8. JSON
      {
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111122223333:role/service-role/AmazonSageMaker-ExecutionRole"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

    1. Buka konsol IAM di https://console.aws.amazon.com/iam/.

    7. Pilih Buat kebijakan.

    8. JSON
      {
    "Version":"2012-10-17",		 	 	 
    "Statement": {
        "Sid": "AllowSTSToAssumeAssumableRole",
        "Effect": "Allow",
        "Action": "sts:AssumeRole",
        "Resource": "arn:aws:iam::111122223333:role/AssumableRole"
    }
}

  3. Langkah 3:

    penting

    SageMaker AI console

    5. Pilih Kirim.

    Python script

    import botocore.session
import json
sess = botocore.session.get_session()
client = sess.create_client('sagemaker')

client.update_user_profile(
DomainId="domainID", 
UserProfileName="user-profile-name",
DefaultUserSettings={
    'JupyterLabAppSettings': {
        'EmrSettings': {
            'AssumableRoleArns': ["arn:aws:iam::emr-accountID:role/AssumableRole"],
            'ExecutionRoleArns': ["arn:aws:iam::emr-accountID:role/EMRServerlessRuntimeExecutionRoleA", 
                             "arn:aws:iam::emr-accountID:role/AnotherRuntimeExecutionRole"]
        }
        
    }
})
resp = client.describe_user_profile(DomainId="domainID", UserProfileName=user-profile-name")

resp['CreationTime'] = str(resp['CreationTime'])
resp['LastModifiedTime'] = str(resp['LastModifiedTime'])
print(json.dumps(resp, indent=2))

    JSON
    {
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "EMRServerlessListApplications",
            "Effect": "Allow",
            "Action": [
                "emr-serverless:ListApplications"
            ],
            "Resource": "arn:aws:emr-serverless:us-east-1:111122223333:/*"
        },
        {
            "Sid": "EMRServerlessPassRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::111122223333:role/EMRServerlessAppRuntimeRole",
            "Condition": {
                "StringLike": {
                    "iam:PassedToService": "emr-serverless.amazonaws.com"
                }
            }
        },
        {
            "Sid": "EMRServerlessCreateApplicationAction",
            "Effect": "Allow",
            "Action": [
                "emr-serverless:CreateApplication",
                "emr-serverless:TagResource"
            ],
            "Resource": "arn:aws:emr-serverless:us-east-1:111122223333:/*",
            "Condition": {
                "ForAllValues:StringEquals": {
                    "aws:TagKeys": [
                        "sagemaker:domain-arn",
                        "sagemaker:user-profile-arn",
                        "sagemaker:space-arn"
                    ]
                },
                "Null": {
                    "aws:RequestTag/sagemaker:domain-arn": "false",
                    "aws:RequestTag/sagemaker:user-profile-arn": "false",
                    "aws:RequestTag/sagemaker:space-arn": "false"
                }
            }
        },
        {
            "Sid": "EMRServerlessDenyTaggingAction",
            "Effect": "Deny",
            "Action": [
                "emr-serverless:TagResource",
                "emr-serverless:UntagResource"
            ],
            "Resource": "arn:aws:emr-serverless:us-east-1:111122223333:/*",
            "Condition": {
                "Null": {
                    "aws:ResourceTag/sagemaker:domain-arn": "true",
                    "aws:ResourceTag/sagemaker:user-profile-arn": "true",
                    "aws:ResourceTag/sagemaker:space-arn": "true"
                }
            }
        },
        {
            "Sid": "EMRServerlessActions",
            "Effect": "Allow",
            "Action": [
                "emr-serverless:StartApplication",
                "emr-serverless:StopApplication",
                "emr-serverless:GetApplication",
                "emr-serverless:DeleteApplication",
                "emr-serverless:AccessLivyEndpoints",
                "emr-serverless:GetDashboardForJobRun"
            ],
            "Resource": "arn:aws:emr-serverless:us-east-1:111122223333:/applications/*",
            "Condition": {
                "Null": {
                    "aws:ResourceTag/sagemaker:domain-arn": "false",
                    "aws:ResourceTag/sagemaker:user-profile-arn": "false",
                    "aws:ResourceTag/sagemaker:space-arn": "false"
                }
            }
        }
    ]
}

  • JSON
    {
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "SageMakerUpdateResourcesPolicy",
            "Effect": "Allow",
            "Action": [
                "sagemaker:UpdateDomain",
                "sagemaker:UpdateUserprofile",
                "sagemaker:UpdateSpace"
            ],
            "Resource": [
                "arn:aws:sagemaker:us-east-1:111122223333:domain/*",
                "arn:aws:sagemaker:us-east-1:111122223333:user-profile/*"
            ]
        }
    ]
}