AmazonSageMakerJobFullAccess SageMaker AI 任務政策更新

AWS SageMaker AI 任務的受管政策

此 AWS 受管政策授予 SageMaker AI 任務執行角色所需的許可，以存取 Amazon S3 中的資料、透過 Amazon API Gateway AgentCore 叫用代理程式、使用 MLflow 追蹤實驗、發佈模型套件、將日誌寫入 CloudWatch、叫用 Lambda 函數和管理 Amazon VPC 網路介面。

主題

AWS 受管政策：AmazonSageMakerJobFullAccess
Amazon SageMaker AI 更新至 SageMaker AI 任務受管政策

AWS 受管政策：AmazonSageMakerJobFullAccess

此政策提供許可，讓 SageMaker AI 任務執行角色存取執行訓練、處理和轉換任務所需的資源。您可以將此政策連接至用作 SageMaker AI 任務執行角色的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

s3 – 允許 SageMaker AI 任務從讀取輸入資料、將輸出資料寫入，以及列出 Amazon S3 儲存貯體的內容。僅限於相同帳戶中的資源。
kms – 允許 SageMaker AI 任務解密和產生資料金鑰，以使用客戶受管 AWS KMS 金鑰對 Amazon S3 物件進行伺服器端加密。Decrypt 和 GenerateDataKey動作只能透過 kms:ViaService限制為 Amazon S3。 DescribeKey 不受kms:ViaService限制。僅限於相同帳戶中的資源。
sagemaker （中樞） – 允許描述中樞內容，例如預先建置的模型和演算法。僅限於相同帳戶中的資源。
sagemaker （模型套件） – 允許為模型登錄工作流程建立、存取和描述模型套件和模型套件群組。僅限於相同帳戶中的資源。
sagemaker 和 sagemaker-mlflow – 允許任務使用 MLflow 進行實驗追蹤，包括建立實驗和執行、記錄指標、擷取結果和管理追蹤。僅限於相同帳戶中的資源。
bedrock-agentcore – 允許任務透過 Amazon API Gateway AgentCore 執行期叫用 AI 代理程式、停止執行期工作階段，以及取得執行期詳細資訊。僅限於相同帳戶中的資源。
ec2 – 允許管理在 Amazon VPC 模式下執行之任務的 Amazon VPC 網路介面，包括建立、刪除和描述網路介面和相關的 Amazon VPC 資源。ec2:CreateTags 動作僅限於 CreateNetworkInterface動作。僅限於相同帳戶中的資源。
logs – 允許建立日誌群組、日誌串流，以及將日誌事件寫入 Amazon CloudWatch Logs。僅限於字/aws/sagemaker/*首為的日誌群組。僅限於相同帳戶中的資源。
lambda – 允許在相同帳戶中叫用 Lambda 函數。


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3Permissions",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "s3:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "KMSPermissions",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:*:*:key/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                },
                "StringLike": {
                    "kms:ViaService": "s3.*.amazonaws.com"
                }
            }
        },
        {
            "Sid": "KMSDescribeKey",
            "Effect": "Allow",
            "Action": "kms:DescribeKey",
            "Resource": "arn:aws:kms:*:*:key/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "SageMakerHubPermissions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:DescribeHubContent"
            ],
            "Resource": [
                "arn:aws:sagemaker:*:*:hub/*",
                "arn:aws:sagemaker:*:*:hub-content/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "SageMakerModelPackagePermissions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:AccessModelPackage",
                "sagemaker:CreateModelPackage",
                "sagemaker:DescribeModelPackage",
                "sagemaker:DescribeModelPackageGroup"
            ],
            "Resource": [
                "arn:aws:sagemaker:*:*:model-package/*",
                "arn:aws:sagemaker:*:*:model-package-group/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "MLflowPermissions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:DescribeMlflowApp",
                "sagemaker:CallMlflowAppApi",
                "sagemaker-mlflow:CreateExperiment",
                "sagemaker-mlflow:CreateRun",
                "sagemaker-mlflow:UpdateRun",
                "sagemaker-mlflow:LogBatch",
                "sagemaker-mlflow:GetExperimentByName",
                "sagemaker-mlflow:GetMetricHistory",
                "sagemaker-mlflow:GetRun",
                "sagemaker-mlflow:StartTrace",
                "sagemaker-mlflow:EndTrace",
                "sagemaker-mlflow:SearchTraces",
                "sagemaker-mlflow:ListArtifacts"
            ],
            "Resource": [
                "arn:aws:sagemaker:*:*:mlflow-app/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "BedrockAgentCorePermissions",
            "Effect": "Allow",
            "Action": [
                "bedrock-agentcore:InvokeAgentRuntime",
                "bedrock-agentcore:StopRuntimeSession",
                "bedrock-agentcore:GetAgentRuntime"
            ],
            "Resource": "arn:aws:bedrock-agentcore:*:*:runtime/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "EC2NetworkPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:CreateNetworkInterfacePermission",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeDhcpOptions"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "EC2NetworkInterfaceTagPermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateTags"
            ],
            "Resource": "arn:aws:ec2:*:*:network-interface/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}",
                    "ec2:CreateAction": "CreateNetworkInterface"
                }
            }
        },
        {
            "Sid": "EC2NetworkInterfaceDeletePermissions",
            "Effect": "Allow",
            "Action": [
                "ec2:DeleteNetworkInterface",
                "ec2:DeleteNetworkInterfacePermission"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "CloudWatchLogsPermissions",
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogStreams"
            ],
            "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "LambdaPermissions",
            "Effect": "Allow",
            "Action": [
                "lambda:InvokeFunction"
            ],
            "Resource": "arn:aws:lambda:*:*:function:*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        }
    ]
}