本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# AWS SageMaker AI 作业的托管策略
该 AWS 托管策略授予 SageMaker AI 任务执行角色访问亚马逊 S3 中的数据、通过 Amazon API Gateway 调用代理 AgentCore、使用 mlFlow 跟踪实验、发布模型包、写入日志 CloudWatch、调用 Lambda 函数以及管理 Amazon VPC 网络接口所需的权限。
**Topics**
+ [AWS 托管策略： AmazonSageMakerJobFullAccess](#security-iam-awsmanpol-AmazonSageMakerJobFullAccess)
+ [Amazon SageMaker AI 更新了 SageMaker AI 作业托管政策](#security-iam-awsmanpol-jobs-updates)
## AWS 托管策略： AmazonSageMakerJobFullAccess
此策略为 SageMaker AI 任务执行角色提供访问运行训练、处理和转换作业所需的资源的权限。您可以将此策略附加到用作 A SageMaker I 任务执行角色的 IAM 角色。
**权限详细信息**
该策略包含以下权限。
+ `s3`— 允许 SageMaker AI 作业从 Amazon S3 存储桶读取输入数据，将输出数据写入 Amazon S3 存储桶并列出其内容。仅限于同一账户中的资源。
+ `kms`— 允许 SageMaker AI 任务使用客户管理的密钥解密和生成数据密钥，以便对 Amazon S3 对象进行服务器端加密。 AWS KMS `Decrypt`和`GenerateDataKey`操作仅限于 Amazon S3。`kms:ViaService` `DescribeKey``kms:ViaService`不受限制地允许。仅限于同一账户中的资源。
+ `sagemaker`(Hub)-允许描述中心内容，例如预先构建的模型和算法。仅限于同一账户中的资源。
+ `sagemaker`（模型包）-允许为模型注册表工作流程创建、访问和描述模型包和模型包组。仅限于同一账户中的资源。
+ `sagemaker`和 `sagemaker-mlflow` — 允许作业使用 mlFlow 进行实验跟踪，包括创建实验和运行、记录指标、检索结果和管理跟踪。仅限于同一账户中的资源。
+ `bedrock-agentcore`— 允许作业通过 Amazon API Gateway AgentCore 运行时调用 AI 代理、停止运行时会话和获取运行时详细信息。仅限于同一账户中的资源。
+ `ec2`— 允许管理在 Amazon VPC 模式下运行的任务的 Amazon VPC 网络接口，包括创建、删除和描述网络接口及相关的 Amazon VPC 资源。该`ec2:CreateTags`操作仅限于该`CreateNetworkInterface`操作。仅限于同一账户中的资源。
+ `logs`— 允许创建日志组、日志流以及将日志事件写入 Amazon CloudWatch 日志。仅限于带有`/aws/sagemaker/*`前缀的日志组。仅限于同一账户中的资源。
+ `lambda`— 允许在同一个账户中调用 Lambda 函数。
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3Permissions",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"s3:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KMSPermissions",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"StringLike": {
"kms:ViaService": "s3.*.amazonaws.com"
}
}
},
{
"Sid": "KMSDescribeKey",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SageMakerHubPermissions",
"Effect": "Allow",
"Action": [
"sagemaker:DescribeHubContent"
],
"Resource": [
"arn:aws:sagemaker:*:*:hub/*",
"arn:aws:sagemaker:*:*:hub-content/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SageMakerModelPackagePermissions",
"Effect": "Allow",
"Action": [
"sagemaker:AccessModelPackage",
"sagemaker:CreateModelPackage",
"sagemaker:DescribeModelPackage",
"sagemaker:DescribeModelPackageGroup"
],
"Resource": [
"arn:aws:sagemaker:*:*:model-package/*",
"arn:aws:sagemaker:*:*:model-package-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "MLflowPermissions",
"Effect": "Allow",
"Action": [
"sagemaker:DescribeMlflowApp",
"sagemaker:CallMlflowAppApi",
"sagemaker-mlflow:CreateExperiment",
"sagemaker-mlflow:CreateRun",
"sagemaker-mlflow:UpdateRun",
"sagemaker-mlflow:LogBatch",
"sagemaker-mlflow:GetExperimentByName",
"sagemaker-mlflow:GetMetricHistory",
"sagemaker-mlflow:GetRun",
"sagemaker-mlflow:StartTrace",
"sagemaker-mlflow:EndTrace",
"sagemaker-mlflow:SearchTraces",
"sagemaker-mlflow:ListArtifacts"
],
"Resource": [
"arn:aws:sagemaker:*:*:mlflow-app/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "BedrockAgentCorePermissions",
"Effect": "Allow",
"Action": [
"bedrock-agentcore:InvokeAgentRuntime",
"bedrock-agentcore:StopRuntimeSession",
"bedrock-agentcore:GetAgentRuntime"
],
"Resource": "arn:aws:bedrock-agentcore:*:*:runtime/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EC2NetworkPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInterfacePermission",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeDhcpOptions"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EC2NetworkInterfaceTagPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"ec2:CreateAction": "CreateNetworkInterface"
}
}
},
{
"Sid": "EC2NetworkInterfaceDeletePermissions",
"Effect": "Allow",
"Action": [
"ec2:DeleteNetworkInterface",
"ec2:DeleteNetworkInterfacePermission"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CloudWatchLogsPermissions",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "LambdaPermissions",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction"
],
"Resource": "arn:aws:lambda:*:*:function:*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
}
```
有关更多信息，请参阅[AmazonSageMakerJobFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerJobFullAccess.html)《 AWS 托管策略参考指南》。
## Amazon SageMaker AI 更新了 SageMaker AI 作业托管政策
查看有关自该服务开始跟踪 SageMaker AI 作业 AWS 托管策略变更以来这些更新的详细信息。
| Policy | 版本 | 更改 | 日期 |
| --- | --- | --- | --- |
| [AmazonSageMakerJobFullAccess](#security-iam-awsmanpol-AmazonSageMakerJobFullAccess) - 新策略 | 1 | 初始策略 | 2026 年 6 月 4 日 |