本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy **描述**： AWS 服务 目录服务使用的服务角色策略，用于配置亚马逊产品 SageMaker 组合中的商品。向一组相关服务授予权限 CodePipeline，包括、 CodeBuild、 CodeCommit CloudFormation、Glue 等。 `AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy` 是一项 [AWS 托管式策略](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。 ## 使用此策略 您可以将 `AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy` 附加到您的用户、组和角色。 ## 策略详细信息 + **类型**： AWS 托管策略 + **创建时间**：2020 年 11 月 27 日 18:48 UTC + **编辑时间：世界标准时间** 2026 年 2 月 12 日 18:02 + **ARN**: `arn:aws:iam::aws:policy/AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy` ## 策略版本 **策略版本：**v12（默认） 此策略的默认版本是定义策略权限的版本。当使用该策略的用户或角色请求访问 AWS 资源时， AWS 会检查策略的默认版本以确定是否允许该请求。 ## JSON 策略文档 ``` { "Version" : "2012-10-17", "Statement" : [ { "Sid" : "AmazonSageMakerServiceCatalogAPIGatewayPermission", "Effect" : "Allow", "Action" : [ "apigateway:GET", "apigateway:POST", "apigateway:PUT", "apigateway:PATCH", "apigateway:DELETE" ], "Resource" : "*", "Condition" : { "StringLike" : { "aws:ResourceTag/sagemaker:launch-source" : "*" } } }, { "Sid" : "AmazonSageMakerServiceCatalogAPIGatewayPostPermission", "Effect" : "Allow", "Action" : [ "apigateway:POST" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : [ "sagemaker:launch-source" ] } } }, { "Sid" : "AmazonSageMakerServiceCatalogAPIGatewayPatchPermission", "Effect" : "Allow", "Action" : [ "apigateway:PATCH" ], "Resource" : [ "arn:aws:apigateway:*::/account" ] }, { "Sid" : "AmazonSageMakerServiceCatalogCFnMutatePermission", "Effect" : "Allow", "Action" : [ "cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:DeleteStack" ], "Resource" : "arn:aws:cloudformation:*:*:stack/SC-*", "Condition" : { "ArnLikeIfExists" : { "cloudformation:RoleArn" : [ "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" ] } } }, { "Sid" : "AmazonSageMakerServiceCatalogCFnTagPermission", "Effect" : "Allow", "Action" : [ "cloudformation:TagResource", "cloudformation:UntagResource" ], "Resource" : "arn:aws:cloudformation:*:*:stack/SC-*", "Condition" : { "Null" : { "aws:ResourceTag/sagemaker:project-name" : "false" } } }, { "Sid" : "AmazonSageMakerServiceCatalogCFnReadPermission", "Effect" : "Allow", "Action" : [ "cloudformation:DescribeStackEvents", "cloudformation:DescribeStacks" ], "Resource" : "arn:aws:cloudformation:*:*:stack/SC-*" }, { "Sid" : "AmazonSageMakerServiceCatalogCFnTemplatePermission", "Effect" : "Allow", "Action" : [ "cloudformation:GetTemplateSummary", "cloudformation:ValidateTemplate" ], "Resource" : "*" }, { "Sid" : "AmazonSageMakerServiceCatalogCodeBuildPermission", "Effect" : "Allow", "Action" : [ "codebuild:CreateProject", "codebuild:DeleteProject", "codebuild:UpdateProject" ], "Resource" : [ "arn:aws:codebuild:*:*:project/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogCodeCommitPermission", "Effect" : "Allow", "Action" : [ "codecommit:CreateCommit", "codecommit:CreateRepository", "codecommit:DeleteRepository", "codecommit:GetRepository", "codecommit:TagResource" ], "Resource" : [ "arn:aws:codecommit:*:*:sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogCodeCommitListPermission", "Effect" : "Allow", "Action" : [ "codecommit:ListRepositories" ], "Resource" : "*" }, { "Sid" : "AmazonSageMakerServiceCatalogCodePipelinePermission", "Effect" : "Allow", "Action" : [ "codepipeline:CreatePipeline", "codepipeline:DeletePipeline", "codepipeline:GetPipeline", "codepipeline:GetPipelineState", "codepipeline:StartPipelineExecution", "codepipeline:TagResource", "codepipeline:UpdatePipeline" ], "Resource" : [ "arn:aws:codepipeline:*:*:sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogCIAMUserPermission", "Effect" : "Allow", "Action" : [ "cognito-idp:CreateUserPool", "cognito-idp:TagResource" ], "Resource" : "*", "Condition" : { "ForAnyValue:StringLike" : { "aws:TagKeys" : [ "sagemaker:launch-source" ] } } }, { "Sid" : "AmazonSageMakerServiceCatalogCIAMPermission", "Effect" : "Allow", "Action" : [ "cognito-idp:CreateGroup", "cognito-idp:CreateUserPoolDomain", "cognito-idp:CreateUserPoolClient", "cognito-idp:DeleteGroup", "cognito-idp:DeleteUserPool", "cognito-idp:DeleteUserPoolClient", "cognito-idp:DeleteUserPoolDomain", "cognito-idp:DescribeUserPool", "cognito-idp:DescribeUserPoolClient", "cognito-idp:UpdateUserPool", "cognito-idp:UpdateUserPoolClient" ], "Resource" : "*", "Condition" : { "StringLike" : { "aws:ResourceTag/sagemaker:launch-source" : "*" } } }, { "Sid" : "AmazonSageMakerServiceCatalogECRPermission", "Effect" : "Allow", "Action" : [ "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:TagResource" ], "Resource" : [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogEventBridgePermission", "Effect" : "Allow", "Action" : [ "events:DescribeRule", "events:DeleteRule", "events:DisableRule", "events:EnableRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource" : [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogFirehosePermission", "Effect" : "Allow", "Action" : [ "firehose:CreateDeliveryStream", "firehose:DeleteDeliveryStream", "firehose:DescribeDeliveryStream", "firehose:StartDeliveryStreamEncryption", "firehose:StopDeliveryStreamEncryption", "firehose:UpdateDestination" ], "Resource" : "arn:aws:firehose:*:*:deliverystream/sagemaker-*" }, { "Sid" : "AmazonSageMakerServiceCatalogGluePermission", "Effect" : "Allow", "Action" : [ "glue:CreateDatabase", "glue:DeleteDatabase" ], "Resource" : [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:userDefinedFunction/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogGlueClassiferPermission", "Effect" : "Allow", "Action" : [ "glue:CreateClassifier", "glue:DeleteClassifier", "glue:DeleteCrawler", "glue:DeleteJob", "glue:DeleteTrigger", "glue:DeleteWorkflow", "glue:StopCrawler" ], "Resource" : [ "*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogGlueWorkflowPermission", "Effect" : "Allow", "Action" : [ "glue:CreateWorkflow" ], "Resource" : [ "arn:aws:glue:*:*:workflow/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogGlueJobPermission", "Effect" : "Allow", "Action" : [ "glue:CreateJob" ], "Resource" : [ "arn:aws:glue:*:*:job/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogGlueCrawlerPermission", "Effect" : "Allow", "Action" : [ "glue:CreateCrawler", "glue:GetCrawler" ], "Resource" : [ "arn:aws:glue:*:*:crawler/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogGlueTriggerPermission", "Effect" : "Allow", "Action" : [ "glue:CreateTrigger", "glue:GetTrigger" ], "Resource" : [ "arn:aws:glue:*:*:trigger/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogPassRolePermission", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalog*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogLambdaPermission", "Effect" : "Allow", "Action" : [ "lambda:AddPermission", "lambda:CreateFunction", "lambda:DeleteFunction", "lambda:GetFunction", "lambda:GetFunctionConfiguration", "lambda:InvokeFunction", "lambda:RemovePermission" ], "Resource" : [ "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogLambdaTagPermission", "Effect" : "Allow", "Action" : "lambda:TagResource", "Resource" : [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : [ "sagemaker:*" ] } } }, { "Sid" : "AmazonSageMakerServiceCatalogLogGroupPermission", "Effect" : "Allow", "Action" : [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogGroup", "logs:DeleteLogStream", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:PutRetentionPolicy" ], "Resource" : [ "arn:aws:logs:*:*:log-group:/aws/apigateway/AccessLogs/*", "arn:aws:logs:*:*:log-group::log-stream:*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogS3ReadPermission", "Effect" : "Allow", "Action" : "s3:GetObject", "Resource" : "*", "Condition" : { "StringEquals" : { "s3:ExistingObjectTag/servicecatalog:provisioning" : "true" } } }, { "Sid" : "AmazonSageMakerServiceCatalogS3ReadSagemakerResourcePermission", "Effect" : "Allow", "Action" : "s3:GetObject", "Resource" : [ "arn:aws:s3:::sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogS3MutatePermission", "Effect" : "Allow", "Action" : [ "s3:CreateBucket", "s3:DeleteBucket", "s3:DeleteBucketPolicy", "s3:GetBucketPolicy", "s3:PutBucketAcl", "s3:PutBucketNotification", "s3:PutBucketPolicy", "s3:PutBucketPublicAccessBlock", "s3:PutBucketLogging", "s3:PutEncryptionConfiguration", "s3:PutBucketCORS", "s3:PutBucketTagging", "s3:PutObjectTagging" ], "Resource" : "arn:aws:s3:::sagemaker-*" }, { "Sid" : "AmazonSageMakerServiceCatalogSageMakerPermission", "Effect" : "Allow", "Action" : [ "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateModel", "sagemaker:CreateWorkteam", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteModel", "sagemaker:DeleteWorkteam", "sagemaker:DescribeModel", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeEndpoint", "sagemaker:DescribeWorkteam", "sagemaker:CreateCodeRepository", "sagemaker:DescribeCodeRepository", "sagemaker:UpdateCodeRepository", "sagemaker:DeleteCodeRepository" ], "Resource" : [ "arn:aws:sagemaker:*:*:*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogSageMakerTagPermission", "Effect" : "Allow", "Action" : [ "sagemaker:AddTags" ], "Resource" : [ "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:model-package/*" ], "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : [ "sagemaker:*" ] } } }, { "Sid" : "AmazonSageMakerServiceCatalogSageMakerImagePermission", "Effect" : "Allow", "Action" : [ "sagemaker:CreateImage", "sagemaker:DeleteImage", "sagemaker:DescribeImage", "sagemaker:UpdateImage", "sagemaker:ListTags" ], "Resource" : [ "arn:aws:sagemaker:*:*:image/*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogStepFunctionPermission", "Effect" : "Allow", "Action" : [ "states:CreateStateMachine", "states:DeleteStateMachine", "states:UpdateStateMachine" ], "Resource" : [ "arn:aws:states:*:*:stateMachine:sagemaker-*" ] }, { "Sid" : "AmazonSageMakerServiceCatalogCodeStarPermission", "Effect" : "Allow", "Action" : "codestar-connections:PassConnection", "Resource" : [ "arn:aws:codestar-connections:*:*:connection/*", "arn:aws:codeconnections:*:*:connection/*" ], "Condition" : { "StringEquals" : { "codestar-connections:PassedToService" : "codepipeline.amazonaws.com" } } }, { "Sid" : "AmazonSageMakerServiceCatalogCodeConnectionPermission", "Effect" : "Allow", "Action" : "codeconnections:PassConnection", "Resource" : [ "arn:aws:codeconnections:*:*:connection/*", "arn:aws:codestar-connections:*:*:connection/*" ], "Condition" : { "StringEquals" : { "codeconnections:PassedToService" : "codepipeline.amazonaws.com" } } } ] } ``` ## 了解详情 + [在 IAM 身份中心使用 AWS 托管策略创建权限集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html) + [添加和删除 IAM 身份权限](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) + [了解 IAM policy 版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html) + [开始使用 AWS 托管策略，转向最低权限权限](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)