本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 设置 Amazon Bedrock Marketplace
<a name="setup-amazon-bedrock-marketplace"></a>

您可以使用 [Amazon Bedrock 完全访问权限策略](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBedrockFullAccess.html)为 SageMaker AI 提供权限。建议使用托管式策略，但如果您无法使用托管式策略，请确保您的 IAM 角色具有以下权限。

以下是亚马逊 Bedrock Marketplace 的推荐定制政策。有关最新版本的 Amazon Bedrock 完全访问托管政策，请参阅[AmazonBedrockFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBedrockFullAccess.html)。

```
{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Sid": "BedrockAll",
            "Effect": "Allow",
            "Action": [
                "bedrock:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "DescribeKey",
            "Effect": "Allow",
            "Action": [
                "kms:DescribeKey"
            ],
            "Resource": "arn:*:kms:*:::*"
        },
        {
            "Sid": "APIsWithAllResourceAccess",
            "Effect": "Allow",
            "Action": [
                "iam:ListRoles",
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups"
            ],
            "Resource": "*"
        },
        {
            "Sid": "MarketplaceModelEndpointMutatingAPIs",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CreateEndpoint",
                "sagemaker:CreateEndpointConfig",
                "sagemaker:CreateModel",
                "sagemaker:DeleteEndpoint",
                "sagemaker:UpdateEndpoint"
            ],
            "Resource": [
                "arn:*:sagemaker:*:*:endpoint/*",
                "arn:*:sagemaker:*:*:endpoint-config/*",
                "arn:*:sagemaker:*:*:model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaLast": "bedrock.amazonaws.com"
                }
            }
        },
        {
            "Sid": "BedrockEndpointTaggingOperations",
            "Effect": "Allow",
            "Action": [
                "sagemaker:AddTags",
                "sagemaker:DeleteTags"
            ],
            "Resource": [
                "arn:*:sagemaker:*:*:endpoint/*",
                "arn:*:sagemaker:*:*:endpoint-config/*",
                "arn:*:sagemaker:*:*:model/*"
            ]
        },
        {
            "Sid": "MarketplaceModelEndpointNonMutatingAPIs",
            "Effect": "Allow",
            "Action": [
                "sagemaker:DescribeEndpoint",
                "sagemaker:DescribeEndpointConfig",
                "sagemaker:DescribeModel",
                "sagemaker:DescribeInferenceComponent",
                "sagemaker:ListEndpoints",
                "sagemaker:ListTags"
            ],
            "Resource": [
                "arn:*:sagemaker:*:*:endpoint/*",
                "arn:*:sagemaker:*:*:endpoint-config/*",
                "arn:*:sagemaker:*:*:model/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaLast": "bedrock.amazonaws.com"
                }
            }
        },
        {
            "Sid": "BedrockEndpointInvokingOperations",
            "Effect": "Allow",
            "Action": [
                "sagemaker:InvokeEndpoint",
                "sagemaker:InvokeEndpointWithResponseStream"
            ],
            "Resource": [
                "arn:*:sagemaker:*:*:endpoint/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:CalledViaLast": "bedrock.amazonaws.com"
                }
            }
        },
        {
            "Sid": "DiscoveringMarketplaceModel",
            "Effect": "Allow",
            "Action": [
                "sagemaker:DescribeHubContent"
            ],
            "Resource": [
                "arn:*:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*",
                "arn:*:sagemaker:*:aws:hub/SageMakerPublicHub"
            ]
        },
        {
            "Sid": "AllowMarketplaceModelsListing",
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListHubContents"
            ],
            "Resource": "arn:*:sagemaker:*:aws:hub/SageMakerPublicHub"
        },
        {
            "Sid": "RetrieveSubscribedMarketplaceLicenses",
            "Effect": "Allow",
            "Action": [
                "license-manager:ListReceivedLicenses"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "PassRoleToSageMaker",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": [
                "arn:*:iam::*:role/*Sagemaker*ForBedrock*"
            ],
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "sagemaker.amazonaws.com",
                        "bedrock.amazonaws.com"
                    ]
                }
            }
        },
        {
            "Sid": "PassRoleToBedrock",
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:*:iam::*:role/*AmazonBedrock*",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "bedrock.amazonaws.com"
                    ]
                }
            }
        }
    ]
}
```

**重要**  
Amazon Bedrock 完全访问策略仅提供对 Amazon Bedrock API 的权限。要在中使用 Amazon Bedrock AWS 管理控制台，您的 IAM 角色还必须具有以下权限：  

```
{
        "Sid": "AllowConsoleS3AccessForBedrockMarketplace",
        "Effect": "Allow",
        "Action": [
          "s3:GetObject",
          "s3:GetBucketCORS",
          "s3:ListBucket",
          "s3:ListBucketVersions",
          "s3:GetBucketLocation"
        ],
        "Resource": "*"
    }
```

如果您要自行编写策略，则必须附上支持对资源执行 Amazon Bedrock Marketplace 操作的策略声明。例如，以下策略支持 Amazon Bedrock 对已部署到端点的模型使用 `InvokeModel` 操作。

------
#### [ JSON ]

****  

```
{
    
        "Version":"2012-10-17",		 	 	 
        "Statement": [
            {
                "Sid": "BedrockAll",
                "Effect": "Allow",
                "Action": [
                    "bedrock:InvokeModel"
                ],
                "Resource": [
                    "arn:aws:bedrock:{{us-east-1}}:{{111122223333}}:marketplace/model-endpoint/all-access"
                ]
            },
            {
                "Sid": "VisualEditor1",
                "Effect": "Allow",
                "Action": ["sagemaker:InvokeEndpoint"],
                "Resource": "arn:aws:sagemaker:{{us-east-1}}:{{111122223333}}:endpoint/*",
                "Condition": {
                    "StringEquals": {
                        "aws:ResourceTag/project": "{{example-project-id}}",
                        "aws:CalledViaLast": "bedrock.amazonaws.com"
                    }
                }
            }
        ]
    
}
```

------

有关设置 Amazon Bedrock 的更多信息，请参阅[快速入门](getting-started.md)。

您可能需要使用 AWS Key Management Service 密钥对部署模型的端点进行加密。您必须修改前述策略，以便提供使用 AWS KMS 密钥的权限。

 AWS KMS 密钥还必须具有加密端点的权限。您必须修改 AWS KMS 资源策略来加密端点。有关修改策略的更多信息，请参阅[将 IAM 策略与一起使用 AWS Key Management Service](https://docs.aws.amazon.com/kms/latest/developerguide/iam-policies)。

您的 AWS KMS 密钥还必须具有`CreateGrant`权限。下面是密钥策略中必须具有的权限的示例。

```
{
"Sid": "Allow access for AmazonSageMaker-ExecutionRole",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::111122223333:role/{{SagemakerExecutionRole}}"
},
"Action": "kms:CreateGrant",
"Resource": "*"
}
```

有关提供创建授予权限的更多信息，请参阅[授予 CreateGrant 权限](https://docs.aws.amazon.com/kms/latest/developerguide/create-grant-overview.html#grant-creategrant)。