本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# AWS SageMaker AI 任務的 受管政策
此 AWS 受管政策授予 SageMaker AI 任務執行角色所需的許可，以存取 Amazon S3 中的資料、透過 Amazon API Gateway AgentCore 叫用代理程式、使用 MLflow 追蹤實驗、發佈模型套件、將日誌寫入 CloudWatch、叫用 Lambda 函數和管理 Amazon VPC 網路介面。
**Topics**
+ [AWS 受管政策：AmazonSageMakerJobFullAccess](#security-iam-awsmanpol-AmazonSageMakerJobFullAccess)
+ [Amazon SageMaker AI 更新至 SageMaker AI 任務受管政策](#security-iam-awsmanpol-jobs-updates)
## AWS 受管政策：AmazonSageMakerJobFullAccess
此政策提供許可，讓 SageMaker AI 任務執行角色存取執行訓練、處理和轉換任務所需的資源。您可以將此政策連接至用作 SageMaker AI 任務執行角色的 IAM 角色。
**許可詳細資訊**
此政策包含以下許可。
+ `s3` – 允許 SageMaker AI 任務從 讀取輸入資料、將輸出資料寫入 ，以及列出 Amazon S3 儲存貯體的內容。僅限於相同帳戶中的資源。
+ `kms` – 允許 SageMaker AI 任務解密和產生資料金鑰，以使用客戶受管 AWS KMS 金鑰對 Amazon S3 物件進行伺服器端加密。`Decrypt` 和 `GenerateDataKey`動作只能透過 `kms:ViaService`限制為 Amazon S3。 `DescribeKey` 不受`kms:ViaService`限制。僅限於相同帳戶中的資源。
+ `sagemaker` （中樞） – 允許描述中樞內容，例如預先建置的模型和演算法。僅限於相同帳戶中的資源。
+ `sagemaker` （模型套件） – 允許為模型登錄工作流程建立、存取和描述模型套件和模型套件群組。僅限於相同帳戶中的資源。
+ `sagemaker` 和 `sagemaker-mlflow` – 允許任務使用 MLflow 進行實驗追蹤，包括建立實驗和執行、記錄指標、擷取結果和管理追蹤。僅限於相同帳戶中的資源。
+ `bedrock-agentcore` – 允許任務透過 Amazon API Gateway AgentCore 執行期叫用 AI 代理程式、停止執行期工作階段，以及取得執行期詳細資訊。僅限於相同帳戶中的資源。
+ `ec2` – 允許管理在 Amazon VPC 模式下執行之任務的 Amazon VPC 網路介面，包括建立、刪除和描述網路介面和相關的 Amazon VPC 資源。`ec2:CreateTags` 動作僅限於 `CreateNetworkInterface`動作。僅限於相同帳戶中的資源。
+ `logs` – 允許建立日誌群組、日誌串流，以及將日誌事件寫入 Amazon CloudWatch Logs。僅限於字`/aws/sagemaker/*`首為 的日誌群組。僅限於相同帳戶中的資源。
+ `lambda` – 允許在相同帳戶中叫用 Lambda 函數。
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "S3Permissions",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:ListBucket"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"s3:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KMSPermissions",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"StringLike": {
"kms:ViaService": "s3.*.amazonaws.com"
}
}
},
{
"Sid": "KMSDescribeKey",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SageMakerHubPermissions",
"Effect": "Allow",
"Action": [
"sagemaker:DescribeHubContent"
],
"Resource": [
"arn:aws:sagemaker:*:*:hub/*",
"arn:aws:sagemaker:*:*:hub-content/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SageMakerModelPackagePermissions",
"Effect": "Allow",
"Action": [
"sagemaker:AccessModelPackage",
"sagemaker:CreateModelPackage",
"sagemaker:DescribeModelPackage",
"sagemaker:DescribeModelPackageGroup"
],
"Resource": [
"arn:aws:sagemaker:*:*:model-package/*",
"arn:aws:sagemaker:*:*:model-package-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "MLflowPermissions",
"Effect": "Allow",
"Action": [
"sagemaker:DescribeMlflowApp",
"sagemaker:CallMlflowAppApi",
"sagemaker-mlflow:CreateExperiment",
"sagemaker-mlflow:CreateRun",
"sagemaker-mlflow:UpdateRun",
"sagemaker-mlflow:LogBatch",
"sagemaker-mlflow:GetExperimentByName",
"sagemaker-mlflow:GetMetricHistory",
"sagemaker-mlflow:GetRun",
"sagemaker-mlflow:StartTrace",
"sagemaker-mlflow:EndTrace",
"sagemaker-mlflow:SearchTraces",
"sagemaker-mlflow:ListArtifacts"
],
"Resource": [
"arn:aws:sagemaker:*:*:mlflow-app/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "BedrockAgentCorePermissions",
"Effect": "Allow",
"Action": [
"bedrock-agentcore:InvokeAgentRuntime",
"bedrock-agentcore:StopRuntimeSession",
"bedrock-agentcore:GetAgentRuntime"
],
"Resource": "arn:aws:bedrock-agentcore:*:*:runtime/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EC2NetworkPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInterfacePermission",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeDhcpOptions"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EC2NetworkInterfaceTagPermissions",
"Effect": "Allow",
"Action": [
"ec2:CreateTags"
],
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"ec2:CreateAction": "CreateNetworkInterface"
}
}
},
{
"Sid": "EC2NetworkInterfaceDeletePermissions",
"Effect": "Allow",
"Action": [
"ec2:DeleteNetworkInterface",
"ec2:DeleteNetworkInterfacePermission"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CloudWatchLogsPermissions",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"logs:DescribeLogStreams"
],
"Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "LambdaPermissions",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction"
],
"Resource": "arn:aws:lambda:*:*:function:*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
}
]
}
```
如需詳細資訊，請參閱《 AWS 受管政策參考指南》中的 [AmazonSageMakerJobFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerJobFullAccess.html)。
## Amazon SageMaker AI 更新至 SageMaker AI 任務受管政策
檢視自此服務開始追蹤這些變更以來SageMaker AI 任務受 AWS 管政策更新的詳細資訊。
| 政策 | 版本 | 變更 | 日期 |
| --- | --- | --- | --- |
| [AmazonSageMakerJobFullAccess](#security-iam-awsmanpol-AmazonSageMakerJobFullAccess) – 新政策 | 1 | 初始政策 | 2026 年 6 月 4 日 |