AWS 受管政策： AmazonDataZoneSageMakerAccess - Amazon DataZone

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

AWS 受管政策： AmazonDataZoneSageMakerAccess

此政策提供 Amazon DataZone 將 Amazon SageMaker 資產發佈至目錄的許可。它還授予 Amazon DataZone 許可，以授予對目錄中 Amazon SageMaker 發佈資產的存取權或撤銷存取權。

此政策包含執行以下動作的許可：

  • cloudtrail – 擷取 CloudTrail 追蹤的相關資訊。

  • cloudwatch – 擷取目前的 CloudWatch 警示。

  • 日誌 – 擷取 CloudWatch 日誌的指標篩選條件。

  • sns – 擷取 SNS 主題的訂閱清單。

  • config – 擷取組態記錄器、資源和 Config AWS 規則的相關資訊。也允許服務連結角色建立和刪除 AWS Config 規則，並根據規則執行評估。

  • iam – 取得並產生帳戶的登入資料報告。

  • 組織 – 擷取組織的帳戶和組織單位 (OU) 資訊。

  • securityhub – 擷取 Security Hub 服務、標準和控制項設定方式的相關資訊。

  • tag – 擷取資源標籤的相關資訊。


{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Sid":"AmazonSageMakerReadPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:DescribeFeatureGroup",
            "sagemaker:ListModelPackages",
            "sagemaker:DescribeModelPackage",
            "sagemaker:DescribeModelPackageGroup",
            "sagemaker:DescribeAlgorithm",
            "sagemaker:ListTags",
            "sagemaker:DescribeDomain",
            "sagemaker:GetModelPackageGroupPolicy",
            "sagemaker:Search"
         ],
         "Resource":"*"
      },
      {
         "Sid":"AmazonSageMakerTaggingPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:AddTags",
            "sagemaker:DeleteTags"
         ],
         "Resource":"*",
         "Condition":{
            "ForAnyValue:StringLike":{
               "aws:TagKeys":[
                  "sagemaker:shared-with:*"
               ]
            }
         }
      },
      {
         "Sid":"AmazonSageMakerModelPackageGroupPolicyPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:PutModelPackageGroupPolicy",
            "sagemaker:DeleteModelPackageGroupPolicy"
         ],
         "Resource":[
            "arn:*:sagemaker:*:*:model-package-group/*"
         ]
      },
      {
         "Sid":"AmazonSageMakerRAMPermission",
         "Effect":"Allow",
         "Action":[
            "ram:GetResourceShares",
            "ram:GetResourceShareInvitations",
            "ram:GetResourceShareAssociations"
         ],
         "Resource":"*"
      },
      {
         "Sid":"AmazonSageMakerRAMResourcePolicyPermission",
         "Effect":"Allow",
         "Action":[
            "sagemaker:PutResourcePolicy",
            "sagemaker:GetResourcePolicy",
            "sagemaker:DeleteResourcePolicy"
         ],
         "Resource":[
            "arn:*:sagemaker:*:*:feature-group/*"
         ]
      },
      {
         "Sid":"AmazonSageMakerRAMTagResourceSharePermission",
         "Effect":"Allow",
         "Action":[
            "ram:TagResource"
         ],
         "Resource":"arn:*:ram:*:*:resource-share/*",
         "Condition":{
            "Null":{
               "aws:RequestTag/AwsDataZoneDomainId":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerRAMDeleteResourceSharePermission",
         "Effect":"Allow",
         "Action":[
            "ram:DeleteResourceShare"
         ],
         "Resource":"arn:*:ram:*:*:resource-share/*",
         "Condition":{
            "Null":{
               "aws:ResourceTag/AwsDataZoneDomainId":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerRAMCreateResourceSharePermission",
         "Effect":"Allow",
         "Action":[
            "ram:CreateResourceShare"
         ],
         "Resource":"*",
         "Condition":{
            "StringLikeIfExists":{
               "ram:RequestedResourceType":[
                  "sagemaker:*"
               ]
            },
            "Null":{
               "aws:RequestTag/AwsDataZoneDomainId":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerS3BucketPolicyPermission",
         "Effect":"Allow",
         "Action":[
            "s3:DeleteBucketPolicy",
            "s3:PutBucketPolicy",
            "s3:GetBucketPolicy"
         ],
         "Resource":[
            "arn:aws:s3:::sagemaker-datazone*",
            "arn:aws:s3:::SageMaker-DataZone*",
            "arn:aws:s3:::datazone-sagemaker*",
            "arn:aws:s3:::DataZone-SageMaker*",
            "arn:aws:s3:::amazon-datazone*",
            "arn:aws:s3:::amazon-sagemaker*"
         ]
      },
      {
         "Sid":"AmazonSageMakerS3Permission",
         "Effect":"Allow",
         "Action":[
            "s3:GetObject",
            "s3:ListBucket"
         ],
         "Resource":[
            "arn:aws:s3:::sagemaker-datazone*",
            "arn:aws:s3:::SageMaker-DataZone*",
            "arn:aws:s3:::datazone-sagemaker*",
            "arn:aws:s3:::DataZone-SageMaker*",
            "arn:aws:s3:::amazon-datazone*",
            "arn:aws:s3:::amazon-sagemaker*"
         ]
      },
      {
         "Sid":"AmazonSageMakerECRPermission",
         "Effect":"Allow",
         "Action":[
            "ecr:GetRepositoryPolicy",
            "ecr:SetRepositoryPolicy",
            "ecr:DeleteRepositoryPolicy"
         ],
         "Resource":"*",
         "Condition":{
            "Null":{
               "aws:ResourceTag/AmazonDataZoneEnvironment":"false"
            }
         }
      },
      {
         "Sid":"AmazonSageMakerKMSReadPermission",
         "Effect":"Allow",
         "Action":[
            "kms:DescribeKey"
         ],
         "Resource":"*",
         "Condition":{
            "ForAnyValue:StringEquals":{
               "aws:TagKeys":[
                  "AmazonDataZoneEnvironment"
               ]
            }
         }
      },
      {
         "Sid":"AmazonSageMakerKMSGrantPermission",
         "Effect":"Allow",
         "Action":[
            "kms:CreateGrant"
         ],
         "Resource":"*",
         "Condition":{
            "ForAnyValue:StringEquals":{
               "aws:TagKeys":[
                  "AmazonDataZoneEnvironment"
               ]
            },
            "ForAllValues:StringEquals":{
               "kms:GrantOperations":[
                  "Decrypt"
               ]
            }
         }
      }
   ]
}