AWS managed policies for SageMaker AI job runtime

Attach this policy to the IAM role that your agent runtime uses. It grants your agent runtime the permissions needed to invoke Amazon SageMaker AI job runtime APIs during model customization for sample generation, trajectory completion, and reward submission.

AWS managed policy: AmazonSageMakerJobRuntimeAccess

Use this policy to give your agent runtime the permissions to invoke SageMaker AI job runtime APIs during model customization for sample generation, trajectory completion, and reward submission. This policy restricts all permissions to resources within your AWS account.

Permissions details

This policy includes the following permissions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SageMakerJobRuntimePermissions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Sample",
                "sagemaker:SampleWithResponseStream",
                "sagemaker:CompleteRollout",
                "sagemaker:UpdateReward"
            ],
            "Resource": "arn:aws:sagemaker:*:*:job/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "BearerTokenPermissions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CallWithBearerToken"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "KMSPermissionsForMTRLRuntime",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:*:*:key/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                },
                "StringLike": {
                    "kms:ViaService": "sagemaker.*.amazonaws.com"
                }
            }
        }
    ]
}

For more information about this policy, see AmazonSageMakerJobRuntimeAccess in the AWS Managed Policy Reference Guide.

Amazon SageMaker AI updates to SageMaker AI job runtime managed policies

View details about updates to AWS managed policies for Amazon SageMaker AI since Amazon SageMaker AI began tracking these changes.