AWSSageMaker 專案和 JumpStart 的受管政策 - Amazon SageMaker AI
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicyAmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicyAmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicyAmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicyAmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicyAmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicyAmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicyAmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicyAmazonSageMakerServiceCatalogProductsEventsServiceRolePolicyAmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicyAmazonSageMakerServiceCatalogProductsGlueServiceRolePolicyAmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicyAWSService Catalog 政策更新

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

AWSSageMaker 專案和 JumpStart 的受管政策

這些AWS受管政策新增使用內建 Amazon SageMaker AI 專案範本和 JumpStart 解決方案的許可。這些政策可在您的帳戶中使用，AWS並由從 SageMaker AI 主控台建立的執行角色使用。

SageMaker Projects 和 JumpStart 使用 AWSService Catalog 來佈建客戶帳戶中AWS的資源。某些建立的資源需要擔任執行角色。例如，如果 AWSService Catalog 代表客戶為 SageMaker AI 機器學習 CI/CD 專案建立 CodePipeline 管道，則該管道需要 IAM 角色。

AmazonSageMakerServiceCatalogProductsLaunchRole 角色具有從 AWSService Catalog 啟動 SageMaker AI 產品組合所需的許可。AmazonSageMakerServiceCatalogProductsUseRole 角色具有從 AWSService Catalog 使用 SageMaker AI 產品組合所需的許可。AmazonSageMakerServiceCatalogProductsLaunchRole 角色會將 AmazonSageMakerServiceCatalogProductsUseRole角色傳遞至佈建的 AWSService Catalog 產品資源。

AWS 受管政策：AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy

此服務會使用此服務角色政策AWS Service Catalog，從 Amazon SageMaker AI 產品組合佈建產品。此政策會將許可授予一組相關AWS服務AWS CodePipeline，包括AWS CodeBuild、、AWS CodeCommitAWSGlue AWS CloudFormation等。

AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy 政策旨在由從 SageMaker AI 主控台建立的 AmazonSageMakerServiceCatalogProductsLaunchRole 角色使用。政策會新增許可，以使用 Service Catalog 為 SageMaker 專案和 JumpStart 佈建AWS資源到客戶的帳戶。

許可詳細資訊

此政策包含以下許可。

  • apigateway - 讓角色呼叫標記為 sagemaker:launch-source 的 API Gateway 端點。

  • cloudformation – 允許 AWS Service Catalog建立、更新和刪除 CloudFormation 堆疊。也允許 Service Catalog 標記和取消標記資源。

  • codebuild – 允許 CloudFormation 擔任AWS Service Catalog並傳遞給 CloudFormation 的角色建立、更新和刪除 CodeBuild 專案。 CloudFormation

  • codecommit – 允許 CloudFormation 擔任AWS Service Catalog並傳遞給 CloudFormation 的角色建立、更新和刪除 CodeCommit 儲存庫。 CloudFormation

  • codepipeline – 允許 CloudFormation 擔任AWS Service Catalog並傳遞給 CloudFormation 的角色建立、更新和刪除 CodePipelines。

  • codeconnections， codestar-connections – 也允許角色傳遞 AWS CodeConnections和 AWS CodeStar連線。

  • cognito-idp - 讓角色建立、更新和刪除群組和使用者集區。也可以標記資源。

  • ecr – 允許 CloudFormation 擔任AWS Service Catalog並傳遞給 CloudFormation 的角色建立和刪除 Amazon ECR 儲存庫。也可以標記資源。

  • events – 允許 CloudFormation 擔任AWS Service Catalog並傳遞給 CloudFormation 的角色建立和刪除 EventBridge 規則。用於將 CICD 管道的各種元件結合在一起。

  • firehose - 允許角色與 Firehose 串流互動。

  • glue – 允許角色與 互動AWS Glue。

  • iam - 讓角色傳遞字首為 AmazonSageMakerServiceCatalog 的角色。當專案佈建 AWS Service Catalog 產品時為必需，因為角色需要傳遞給 AWS Service Catalog。

  • lambda - 讓角色與 AWS Lambda 互動。也可以標記資源。

  • logs - 讓角色建立、刪除和存取日誌串流。

  • s3 – 允許 CloudFormation 擔任AWS Service Catalog並傳遞給 CloudFormation 的角色存取存放專案範本程式碼的 Amazon S3 儲存貯體。 CloudFormation

  • sagemaker - 允許角色與各種 SageMaker AI 服務互動。可以在範本佈建期間在 CloudFormation 中完成，也可以在 CICD 管道執行時在 CodeBuild 中完成。也可以標記以下資源：端點、端點組態、模型、管道、專案和模型套件。

  • states - 讓角色建立、刪除和更新字首為 sagemaker 的 Step Function。

若要檢視此政策的許可，請參閱《 AWS受管政策參考》中的 AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy。

AWS 受管政策：AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy

Amazon API Gateway 會在 Amazon Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品內使用此政策。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 API Gateway 所建立且需要角色AWS的資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • lambda - 調用合作夥伴範本建立的函式。

  • sagemaker - 調用合作夥伴範本建立的端點。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "lambda:InvokeFunction",
      "Resource": "arn:aws:lambda:*:*:function:sagemaker-*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/sagemaker:project-name": "false",
          "aws:ResourceTag/sagemaker:partner": "false"
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "sagemaker:InvokeEndpoint",
      "Resource": "arn:aws:sagemaker:*:*:endpoint/*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/sagemaker:project-name": "false",
          "aws:ResourceTag/sagemaker:partner": "false"
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}

AWS受管政策：AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy

此政策由 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品AWS CloudFormation內使用。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 所建立CloudFormation且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • iam - 傳遞 AmazonSageMakerServiceCatalogProductsLambdaRole 和 AmazonSageMakerServiceCatalogProductsApiGatewayRole 角色。

  • lambda – 建立、更新、刪除和叫用AWS Lambda函數；擷取、發佈和刪除 Lambda 層的版本。

  • apigateway - 建立、更新和刪除 Amazon API Gateway 資源。

  • s3 - 從 Amazon Simple Storage Service (Amazon S3) 儲存貯體擷取 lambda-auth-code/layer.zip 檔案。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsLambdaRole"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "lambda.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsApiGatewayRole"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "apigateway.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:DeleteFunction",
        "lambda:UpdateFunctionCode",
        "lambda:ListTags",
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "arn:aws:lambda:*:*:function:sagemaker-*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/sagemaker:project-name": "false",
          "aws:ResourceTag/sagemaker:partner": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:CreateFunction",
        "lambda:TagResource"
      ],
      "Resource": [
        "arn:aws:lambda:*:*:function:sagemaker-*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/sagemaker:project-name": "false",
          "aws:ResourceTag/sagemaker:partner": "false"
        },
        "ForAnyValue:StringEquals": {
          "aws:TagKeys": [
            "sagemaker:project-name",
            "sagemaker:partner"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "lambda:PublishLayerVersion",
        "lambda:GetLayerVersion",
        "lambda:DeleteLayerVersion",
        "lambda:GetFunction"
      ],
      "Resource": [
        "arn:aws:lambda:*:*:layer:sagemaker-*",
        "arn:aws:lambda:*:*:function:sagemaker-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "apigateway:GET",
        "apigateway:DELETE",
        "apigateway:PATCH",
        "apigateway:POST",
        "apigateway:PUT"
      ],
      "Resource": [
        "arn:aws:apigateway:*::/restapis/*",
        "arn:aws:apigateway:*::/restapis"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/sagemaker:project-name": "false",
          "aws:ResourceTag/sagemaker:partner": "false"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "apigateway:POST",
        "apigateway:PUT"
      ],
      "Resource": [
        "arn:aws:apigateway:*::/restapis",
        "arn:aws:apigateway:*::/tags/*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/sagemaker:project-name": "false",
          "aws:ResourceTag/sagemaker:partner": "false"
        },
        "ForAnyValue:StringEquals": {
          "aws:TagKeys": [
            "sagemaker:project-name",
            "sagemaker:partner"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::sagemaker-*/lambda-auth-code/layer.zip"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}
顯示較多顯示較少

AWS受管政策：AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy

此政策由 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品AWS Lambda內使用。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 Lambda 建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • secretsmanager - 從合作夥伴提供的機密中擷取資料，用於合作夥伴範本。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "secretsmanager:GetSecretValue",
      "Resource": "arn:aws:secretsmanager:*:*:secret:*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/sagemaker:partner": false
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    }
  ]
}
顯示較多顯示較少

AWS受管政策：AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy

Amazon API Gateway 會在 Amazon Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品內使用此政策。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 API Gateway 建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • logs - 建立和讀取 CloudWatch Logs 群組、串流和事件；更新事件；描述各種資源。

    這些許可僅限於其日誌群組前字首以“aws/apigateway/”開頭的資源。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogDelivery",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DeleteLogDelivery",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:DescribeResourcePolicies",
        "logs:DescribeDestinations",
        "logs:DescribeExportTasks",
        "logs:DescribeMetricFilters",
        "logs:DescribeQueries",
        "logs:DescribeQueryDefinitions",
        "logs:DescribeSubscriptionFilters",
        "logs:GetLogDelivery",
        "logs:GetLogEvents",
        "logs:PutLogEvents",
        "logs:PutResourcePolicy",
        "logs:UpdateLogDelivery"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/apigateway/*"
    }
  ]
}

AWS受管政策：AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy

此政策由 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品AWS CloudFormation內使用。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 所建立CloudFormation且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • sagemaker - 允許存取各種 SageMaker AI 資源，但不包括網域、使用者設定檔、應用程式和流程定義。

  • iam - 傳遞 AmazonSageMakerServiceCatalogProductsCodeBuildRole 和 AmazonSageMakerServiceCatalogProductsExecutionRole 角色。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddAssociation",
        "sagemaker:AddTags",
        "sagemaker:AssociateTrialComponent",
        "sagemaker:BatchDescribeModelPackage",
        "sagemaker:BatchGetMetrics",
        "sagemaker:BatchGetRecord",
        "sagemaker:BatchPutMetrics",
        "sagemaker:CreateAction",
        "sagemaker:CreateAlgorithm",
        "sagemaker:CreateApp",
        "sagemaker:CreateAppImageConfig",
        "sagemaker:CreateArtifact",
        "sagemaker:CreateAutoMLJob",
        "sagemaker:CreateCodeRepository",
        "sagemaker:CreateCompilationJob",
        "sagemaker:CreateContext",
        "sagemaker:CreateDataQualityJobDefinition",
        "sagemaker:CreateDeviceFleet",
        "sagemaker:CreateDomain",
        "sagemaker:CreateEdgePackagingJob",
        "sagemaker:CreateEndpoint",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateExperiment",
        "sagemaker:CreateFeatureGroup",
        "sagemaker:CreateFlowDefinition",
        "sagemaker:CreateHumanTaskUi",
        "sagemaker:CreateHyperParameterTuningJob",
        "sagemaker:CreateImage",
        "sagemaker:CreateImageVersion",
        "sagemaker:CreateInferenceRecommendationsJob",
        "sagemaker:CreateLabelingJob",
        "sagemaker:CreateLineageGroupPolicy",
        "sagemaker:CreateModel",
        "sagemaker:CreateModelBiasJobDefinition",
        "sagemaker:CreateModelExplainabilityJobDefinition",
        "sagemaker:CreateModelPackage",
        "sagemaker:CreateModelPackageGroup",
        "sagemaker:CreateModelQualityJobDefinition",
        "sagemaker:CreateMonitoringSchedule",
        "sagemaker:CreateNotebookInstance",
        "sagemaker:CreateNotebookInstanceLifecycleConfig",
        "sagemaker:CreatePipeline",
        "sagemaker:CreatePresignedDomainUrl",
        "sagemaker:CreatePresignedNotebookInstanceUrl",
        "sagemaker:CreateProcessingJob",
        "sagemaker:CreateProject",
        "sagemaker:CreateTrainingJob",
        "sagemaker:CreateTransformJob",
        "sagemaker:CreateTrial",
        "sagemaker:CreateTrialComponent",
        "sagemaker:CreateUserProfile",
        "sagemaker:CreateWorkforce",
        "sagemaker:CreateWorkteam",
        "sagemaker:DeleteAction",
        "sagemaker:DeleteAlgorithm",
        "sagemaker:DeleteApp",
        "sagemaker:DeleteAppImageConfig",
        "sagemaker:DeleteArtifact",
        "sagemaker:DeleteAssociation",
        "sagemaker:DeleteCodeRepository",
        "sagemaker:DeleteContext",
        "sagemaker:DeleteDataQualityJobDefinition",
        "sagemaker:DeleteDeviceFleet",
        "sagemaker:DeleteDomain",
        "sagemaker:DeleteEndpoint",
        "sagemaker:DeleteEndpointConfig",
        "sagemaker:DeleteExperiment",
        "sagemaker:DeleteFeatureGroup",
        "sagemaker:DeleteFlowDefinition",
        "sagemaker:DeleteHumanLoop",
        "sagemaker:DeleteHumanTaskUi",
        "sagemaker:DeleteImage",
        "sagemaker:DeleteImageVersion",
        "sagemaker:DeleteLineageGroupPolicy",
        "sagemaker:DeleteModel",
        "sagemaker:DeleteModelBiasJobDefinition",
        "sagemaker:DeleteModelExplainabilityJobDefinition",
        "sagemaker:DeleteModelPackage",
        "sagemaker:DeleteModelPackageGroup",
        "sagemaker:DeleteModelPackageGroupPolicy",
        "sagemaker:DeleteModelQualityJobDefinition",
        "sagemaker:DeleteMonitoringSchedule",
        "sagemaker:DeleteNotebookInstance",
        "sagemaker:DeleteNotebookInstanceLifecycleConfig",
        "sagemaker:DeletePipeline",
        "sagemaker:DeleteProject",
        "sagemaker:DeleteRecord",
        "sagemaker:DeleteTags",
        "sagemaker:DeleteTrial",
        "sagemaker:DeleteTrialComponent",
        "sagemaker:DeleteUserProfile",
        "sagemaker:DeleteWorkforce",
        "sagemaker:DeleteWorkteam",
        "sagemaker:DeregisterDevices",
        "sagemaker:DescribeAction",
        "sagemaker:DescribeAlgorithm",
        "sagemaker:DescribeApp",
        "sagemaker:DescribeAppImageConfig",
        "sagemaker:DescribeArtifact",
        "sagemaker:DescribeAutoMLJob",
        "sagemaker:DescribeCodeRepository",
        "sagemaker:DescribeCompilationJob",
        "sagemaker:DescribeContext",
        "sagemaker:DescribeDataQualityJobDefinition",
        "sagemaker:DescribeDevice",
        "sagemaker:DescribeDeviceFleet",
        "sagemaker:DescribeDomain",
        "sagemaker:DescribeEdgePackagingJob",
        "sagemaker:DescribeEndpoint",
        "sagemaker:DescribeEndpointConfig",
        "sagemaker:DescribeExperiment",
        "sagemaker:DescribeFeatureGroup",
        "sagemaker:DescribeFlowDefinition",
        "sagemaker:DescribeHumanLoop",
        "sagemaker:DescribeHumanTaskUi",
        "sagemaker:DescribeHyperParameterTuningJob",
        "sagemaker:DescribeImage",
        "sagemaker:DescribeImageVersion",
        "sagemaker:DescribeInferenceRecommendationsJob",
        "sagemaker:DescribeLabelingJob",
        "sagemaker:DescribeLineageGroup",
        "sagemaker:DescribeModel",
        "sagemaker:DescribeModelBiasJobDefinition",
        "sagemaker:DescribeModelExplainabilityJobDefinition",
        "sagemaker:DescribeModelPackage",
        "sagemaker:DescribeModelPackageGroup",
        "sagemaker:DescribeModelQualityJobDefinition",
        "sagemaker:DescribeMonitoringSchedule",
        "sagemaker:DescribeNotebookInstance",
        "sagemaker:DescribeNotebookInstanceLifecycleConfig",
        "sagemaker:DescribePipeline",
        "sagemaker:DescribePipelineDefinitionForExecution",
        "sagemaker:DescribePipelineExecution",
        "sagemaker:DescribeProcessingJob",
        "sagemaker:DescribeProject",
        "sagemaker:DescribeSubscribedWorkteam",
        "sagemaker:DescribeTrainingJob",
        "sagemaker:DescribeTransformJob",
        "sagemaker:DescribeTrial",
        "sagemaker:DescribeTrialComponent",
        "sagemaker:DescribeUserProfile",
        "sagemaker:DescribeWorkforce",
        "sagemaker:DescribeWorkteam",
        "sagemaker:DisableSagemakerServicecatalogPortfolio",
        "sagemaker:DisassociateTrialComponent",
        "sagemaker:EnableSagemakerServicecatalogPortfolio",
        "sagemaker:GetDeviceFleetReport",
        "sagemaker:GetDeviceRegistration",
        "sagemaker:GetLineageGroupPolicy",
        "sagemaker:GetModelPackageGroupPolicy",
        "sagemaker:GetRecord",
        "sagemaker:GetSagemakerServicecatalogPortfolioStatus",
        "sagemaker:GetSearchSuggestions",
        "sagemaker:InvokeEndpoint",
        "sagemaker:InvokeEndpointAsync",
        "sagemaker:ListActions",
        "sagemaker:ListAlgorithms",
        "sagemaker:ListAppImageConfigs",
        "sagemaker:ListApps",
        "sagemaker:ListArtifacts",
        "sagemaker:ListAssociations",
        "sagemaker:ListAutoMLJobs",
        "sagemaker:ListCandidatesForAutoMLJob",
        "sagemaker:ListCodeRepositories",
        "sagemaker:ListCompilationJobs",
        "sagemaker:ListContexts",
        "sagemaker:ListDataQualityJobDefinitions",
        "sagemaker:ListDeviceFleets",
        "sagemaker:ListDevices",
        "sagemaker:ListDomains",
        "sagemaker:ListEdgePackagingJobs",
        "sagemaker:ListEndpointConfigs",
        "sagemaker:ListEndpoints",
        "sagemaker:ListExperiments",
        "sagemaker:ListFeatureGroups",
        "sagemaker:ListFlowDefinitions",
        "sagemaker:ListHumanLoops",
        "sagemaker:ListHumanTaskUis",
        "sagemaker:ListHyperParameterTuningJobs",
        "sagemaker:ListImageVersions",
        "sagemaker:ListImages",
        "sagemaker:ListInferenceRecommendationsJobs",
        "sagemaker:ListLabelingJobs",
        "sagemaker:ListLabelingJobsForWorkteam",
        "sagemaker:ListLineageGroups",
        "sagemaker:ListModelBiasJobDefinitions",
        "sagemaker:ListModelExplainabilityJobDefinitions",
        "sagemaker:ListModelMetadata",
        "sagemaker:ListModelPackageGroups",
        "sagemaker:ListModelPackages",
        "sagemaker:ListModelQualityJobDefinitions",
        "sagemaker:ListModels",
        "sagemaker:ListMonitoringExecutions",
        "sagemaker:ListMonitoringSchedules",
        "sagemaker:ListNotebookInstanceLifecycleConfigs",
        "sagemaker:ListNotebookInstances",
        "sagemaker:ListPipelineExecutionSteps",
        "sagemaker:ListPipelineExecutions",
        "sagemaker:ListPipelineParametersForExecution",
        "sagemaker:ListPipelines",
        "sagemaker:ListProcessingJobs",
        "sagemaker:ListProjects",
        "sagemaker:ListSubscribedWorkteams",
        "sagemaker:ListTags",
        "sagemaker:ListTrainingJobs",
        "sagemaker:ListTrainingJobsForHyperParameterTuningJob",
        "sagemaker:ListTransformJobs",
        "sagemaker:ListTrialComponents",
        "sagemaker:ListTrials",
        "sagemaker:ListUserProfiles",
        "sagemaker:ListWorkforces",
        "sagemaker:ListWorkteams",
        "sagemaker:PutLineageGroupPolicy",
        "sagemaker:PutModelPackageGroupPolicy",
        "sagemaker:PutRecord",
        "sagemaker:QueryLineage",
        "sagemaker:RegisterDevices",
        "sagemaker:RenderUiTemplate",
        "sagemaker:Search",
        "sagemaker:SendHeartbeat",
        "sagemaker:SendPipelineExecutionStepFailure",
        "sagemaker:SendPipelineExecutionStepSuccess",
        "sagemaker:StartHumanLoop",
        "sagemaker:StartMonitoringSchedule",
        "sagemaker:StartNotebookInstance",
        "sagemaker:StartPipelineExecution",
        "sagemaker:StopAutoMLJob",
        "sagemaker:StopCompilationJob",
        "sagemaker:StopEdgePackagingJob",
        "sagemaker:StopHumanLoop",
        "sagemaker:StopHyperParameterTuningJob",
        "sagemaker:StopInferenceRecommendationsJob",
        "sagemaker:StopLabelingJob",
        "sagemaker:StopMonitoringSchedule",
        "sagemaker:StopNotebookInstance",
        "sagemaker:StopPipelineExecution",
        "sagemaker:StopProcessingJob",
        "sagemaker:StopTrainingJob",
        "sagemaker:StopTransformJob",
        "sagemaker:UpdateAction",
        "sagemaker:UpdateAppImageConfig",
        "sagemaker:UpdateArtifact",
        "sagemaker:UpdateCodeRepository",
        "sagemaker:UpdateContext",
        "sagemaker:UpdateDeviceFleet",
        "sagemaker:UpdateDevices",
        "sagemaker:UpdateDomain",
        "sagemaker:UpdateEndpoint",
        "sagemaker:UpdateEndpointWeightsAndCapacities",
        "sagemaker:UpdateExperiment",
        "sagemaker:UpdateImage",
        "sagemaker:UpdateModelPackage",
        "sagemaker:UpdateMonitoringSchedule",
        "sagemaker:UpdateNotebookInstance",
        "sagemaker:UpdateNotebookInstanceLifecycleConfig",
        "sagemaker:UpdatePipeline",
        "sagemaker:UpdatePipelineExecution",
        "sagemaker:UpdateProject",
        "sagemaker:UpdateTrainingJob",
        "sagemaker:UpdateTrial",
        "sagemaker:UpdateTrialComponent",
        "sagemaker:UpdateUserProfile",
        "sagemaker:UpdateWorkforce",
        "sagemaker:UpdateWorkteam"
      ],
      "NotResource": [
        "arn:aws:sagemaker:*:*:domain/*",
        "arn:aws:sagemaker:*:*:user-profile/*",
        "arn:aws:sagemaker:*:*:app/*",
        "arn:aws:sagemaker:*:*:flow-definition/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole",
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole"
      ]
    }
  ]
}
顯示較多顯示較少

AWS受管政策：AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy

此政策由 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品AWS CodeBuild內使用。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 CodeBuild 建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • sagemaker - 允許存取各種 SageMaker AI 資源。

  • codecommit - 將 CodeCommit 封存上傳至 CodeBuild 管道、取得上傳狀態以及取消上傳；取得分支和遞交資訊。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。

  • ecr - 建立 Amazon ECR 儲存庫和容器映像；上傳影像層。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存庫。

    ecr - 閱讀所有資源。

  • iam - 傳遞下列角色：

    • AmazonSageMakerServiceCatalogProductsCloudformationRole 至 AWS CloudFormation。

    • AmazonSageMakerServiceCatalogProductsCodeBuildRole 至 AWS CodeBuild。

    • AmazonSageMakerServiceCatalogProductsCodePipelineRole 至 AWS CodePipeline。

    • AmazonSageMakerServiceCatalogProductsEventsRole 至 Amazon EventBridge。

    • AmazonSageMakerServiceCatalogProductsExecutionRole 至 Amazon SageMaker AI。

  • logs - 建立和讀取 CloudWatch Logs 群組、串流和事件；更新事件；描述各種資源。

    這些許可僅限於其名稱字首以 “aws/codebuild” 開頭的資源。

  • s3 - 建立、讀取和列出 Amazon S3 儲存貯體。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存貯體。

  • codeconnections、 codestar-connections – 使用 AWS CodeConnections和 AWS CodeStar連線。

若要檢視此政策的許可，請參閱《 AWS受管政策參考》中的 AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy。

AWS受管政策：AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy

此政策由 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品AWS CodePipeline內使用。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 CodePipeline 建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • cloudformation - 建立、讀取、刪除和更新 CloudFormation 堆疊；建立、讀取、刪除和執行變更集；設定堆疊政策；標記和取消標記資源。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。

  • s3— 建立、讀取、列出和刪除 Amazon S3 儲存貯體；新增、讀取和刪除儲存貯體中的物件；讀取和設定 CORS 組態；讀取存取控制清單 (ACL)；以及讀取儲存貯體所在的 AWS 區域。

    這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。

  • iam - 傳遞 AmazonSageMakerServiceCatalogProductsCloudformationRole 角色。

  • codebuild— 取得 CodeBuild 建置資訊並開始組建。這些許可僅限於名稱以 “sagemaker-” 開頭的專案與建置資源。

  • codecommit - 將 CodeCommit 封存上傳至 CodeBuild 管道、取得上傳狀態以及取消上傳；取得分支和遞交資訊。

  • codeconnections、 codestar-connections – 使用 AWS CodeConnections和 AWS CodeStar連線。

若要檢視此政策的許可，請參閱 AWS受管政策參考中的 AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy。

AWS 受管政策：AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy

在 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品中，Amazon EventBridge 會使用此政策。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 EventBridge 建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • codepipeline - 啟動 CodeBuild 執行。這些許可僅限於名稱以 “sagemaker-” 開頭的管道。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "codepipeline:StartPipelineExecution",
      "Resource": "arn:aws:codepipeline:*:*:sagemaker-*"
    }
  ]
}

AWS受管政策：AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy

Amazon Data Firehose 會在 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品內使用此政策。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 Firehose 建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • firehose - 傳送 Firehose 記錄。這些許可僅限於交付串流名稱以 “sagemaker-” 開頭的資源。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "firehose:PutRecord",
        "firehose:PutRecordBatch"
      ],
      "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*"
    }
  ]
}

AWS受管政策：AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy

Glue 在 Amazon SageMaker AI AWS產品組合的 AWSService Catalog 佈建產品中使用此政策。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 Glue 所建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • glue – 建立、讀取和刪除 AWSGlue 分割區、資料表和資料表版本。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。建立和讀取 AWSGlue 資料庫。這些許可僅限於名稱為 “default”、“global_temp” 或以 “sagemaker-” 開頭的資料庫。取得使用者定義的函式。

  • s3— 建立、讀取、列出和刪除 Amazon S3 儲存貯體；新增、讀取和刪除儲存貯體中的物件；讀取和設定 CORS 組態；讀取存取控制清單 (ACL)，以及讀取儲存貯體所在的 AWS 區域。

    這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。

  • logs - 建立、讀取和刪除 CloudWatch Logs 日誌群組、串流和交付；以及建立資源政策。

    這些許可僅限於其名稱字首以 “aws/glue” 開頭的資源。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "glue:BatchCreatePartition",
        "glue:BatchDeletePartition",
        "glue:BatchDeleteTable",
        "glue:BatchDeleteTableVersion",
        "glue:BatchGetPartition",
        "glue:CreateDatabase",
        "glue:CreatePartition",
        "glue:CreateTable",
        "glue:DeletePartition",
        "glue:DeleteTable",
        "glue:DeleteTableVersion",
        "glue:GetDatabase",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetTableVersion",
        "glue:GetTableVersions",
        "glue:SearchTables",
        "glue:UpdatePartition",
        "glue:UpdateTable",
        "glue:GetUserDefinedFunctions"
      ],
      "Resource": [
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:database/default",
        "arn:aws:glue:*:*:database/global_temp",
        "arn:aws:glue:*:*:database/sagemaker-*",
        "arn:aws:glue:*:*:table/sagemaker-*",
        "arn:aws:glue:*:*:tableVersion/sagemaker-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucketAcl",
        "s3:GetBucketCors",
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:PutBucketCors"
      ],
      "Resource": [
        "arn:aws:s3:::aws-glue-*",
        "arn:aws:s3:::sagemaker-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::aws-glue-*",
        "arn:aws:s3:::sagemaker-*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogDelivery",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DeleteLogDelivery",
        "logs:Describe*",
        "logs:GetLogDelivery",
        "logs:GetLogEvents",
        "logs:ListLogDeliveries",
        "logs:PutLogEvents",
        "logs:PutResourcePolicy",
        "logs:UpdateLogDelivery"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/glue/*"
    }
  ]
}

AWS 受管政策：AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy

此政策由 Amazon SageMaker AI 產品組合的AWS Service Catalog佈建產品AWS Lambda內使用。此政策旨在連接至 AmazonSageMakerServiceCatalogProductsLaunchRole 傳遞至 Lambda 建立且需要角色之AWS資源的 IAM 角色。

許可詳細資訊

此政策包含以下許可。

  • sagemaker - 允許存取各種 SageMaker AI 資源。

  • ecr - 建立和刪除 Amazon ECR 儲存庫；建立、讀取與刪除容器映像；上傳影像層。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存庫。

  • events - 建立、讀取和刪除 Amazon EventBridge 規則；以及建立和移除目標。這些許可僅限於名稱以 “sagemaker-” 開頭的規則。

  • s3— 建立、讀取、列出和刪除 Amazon S3 儲存貯體；新增、讀取和刪除儲存貯體中的物件；讀取和設定 CORS 組態；讀取存取控制清單 (ACL)，以及讀取儲存貯體所在的 AWS 區域。

    這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。

  • iam - 傳遞 AmazonSageMakerServiceCatalogProductsExecutionRole 角色。

  • logs - 建立、讀取和刪除 CloudWatch Logs 日誌群組、串流和交付；以及建立資源政策。

    這些許可僅限於其名稱字首以 “aws/lambda/” 開頭的資源。

  • codebuild – 開始並取得AWS CodeBuild組建的相關資訊。

JSON
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid" : "AmazonSageMakerLambdaECRPermission",
      "Effect": "Allow",
      "Action": [
        "ecr:DescribeImages",
        "ecr:BatchDeleteImage",
        "ecr:CompleteLayerUpload",
        "ecr:CreateRepository",
        "ecr:DeleteRepository",
        "ecr:InitiateLayerUpload",
        "ecr:PutImage",
        "ecr:UploadLayerPart"
      ],
      "Resource": [
        "arn:aws:ecr:*:*:repository/sagemaker-*"
      ]
    },
    {
      "Sid" : "AmazonSageMakerLambdaEventBridgePermission",
      "Effect": "Allow",
      "Action": [
        "events:DeleteRule",
        "events:DescribeRule",
        "events:PutRule",
        "events:PutTargets",
        "events:RemoveTargets"
      ],
      "Resource": [
        "arn:aws:events:*:*:rule/sagemaker-*"
      ]
    },
    {
      "Sid" : "AmazonSageMakerLambdaS3BucketPermission",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucketAcl",
        "s3:GetBucketCors",
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:PutBucketCors"
      ],
      "Resource": [
        "arn:aws:s3:::aws-glue-*",
        "arn:aws:s3:::sagemaker-*"
      ]
    },
    {
      "Sid" : "AmazonSageMakerLambdaS3ObjectPermission",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::aws-glue-*",
        "arn:aws:s3:::sagemaker-*"
      ]
    },
    {
      "Sid" : "AmazonSageMakerLambdaSageMakerPermission",
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddAssociation",
        "sagemaker:AddTags",
        "sagemaker:AssociateTrialComponent",
        "sagemaker:BatchDescribeModelPackage",
        "sagemaker:BatchGetMetrics",
        "sagemaker:BatchGetRecord",
        "sagemaker:BatchPutMetrics",
        "sagemaker:CreateAction",
        "sagemaker:CreateAlgorithm",
        "sagemaker:CreateApp",
        "sagemaker:CreateAppImageConfig",
        "sagemaker:CreateArtifact",
        "sagemaker:CreateAutoMLJob",
        "sagemaker:CreateCodeRepository",
        "sagemaker:CreateCompilationJob",
        "sagemaker:CreateContext",
        "sagemaker:CreateDataQualityJobDefinition",
        "sagemaker:CreateDeviceFleet",
        "sagemaker:CreateDomain",
        "sagemaker:CreateEdgePackagingJob",
        "sagemaker:CreateEndpoint",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateExperiment",
        "sagemaker:CreateFeatureGroup",
        "sagemaker:CreateFlowDefinition",
        "sagemaker:CreateHumanTaskUi",
        "sagemaker:CreateHyperParameterTuningJob",
        "sagemaker:CreateImage",
        "sagemaker:CreateImageVersion",
        "sagemaker:CreateInferenceRecommendationsJob",
        "sagemaker:CreateLabelingJob",
        "sagemaker:CreateLineageGroupPolicy",
        "sagemaker:CreateModel",
        "sagemaker:CreateModelBiasJobDefinition",
        "sagemaker:CreateModelExplainabilityJobDefinition",
        "sagemaker:CreateModelPackage",
        "sagemaker:CreateModelPackageGroup",
        "sagemaker:CreateModelQualityJobDefinition",
        "sagemaker:CreateMonitoringSchedule",
        "sagemaker:CreateNotebookInstance",
        "sagemaker:CreateNotebookInstanceLifecycleConfig",
        "sagemaker:CreatePipeline",
        "sagemaker:CreatePresignedDomainUrl",
        "sagemaker:CreatePresignedNotebookInstanceUrl",
        "sagemaker:CreateProcessingJob",
        "sagemaker:CreateProject",
        "sagemaker:CreateTrainingJob",
        "sagemaker:CreateTransformJob",
        "sagemaker:CreateTrial",
        "sagemaker:CreateTrialComponent",
        "sagemaker:CreateUserProfile",
        "sagemaker:CreateWorkforce",
        "sagemaker:CreateWorkteam",
        "sagemaker:DeleteAction",
        "sagemaker:DeleteAlgorithm",
        "sagemaker:DeleteApp",
        "sagemaker:DeleteAppImageConfig",
        "sagemaker:DeleteArtifact",
        "sagemaker:DeleteAssociation",
        "sagemaker:DeleteCodeRepository",
        "sagemaker:DeleteContext",
        "sagemaker:DeleteDataQualityJobDefinition",
        "sagemaker:DeleteDeviceFleet",
        "sagemaker:DeleteDomain",
        "sagemaker:DeleteEndpoint",
        "sagemaker:DeleteEndpointConfig",
        "sagemaker:DeleteExperiment",
        "sagemaker:DeleteFeatureGroup",
        "sagemaker:DeleteFlowDefinition",
        "sagemaker:DeleteHumanLoop",
        "sagemaker:DeleteHumanTaskUi",
        "sagemaker:DeleteImage",
        "sagemaker:DeleteImageVersion",
        "sagemaker:DeleteLineageGroupPolicy",
        "sagemaker:DeleteModel",
        "sagemaker:DeleteModelBiasJobDefinition",
        "sagemaker:DeleteModelExplainabilityJobDefinition",
        "sagemaker:DeleteModelPackage",
        "sagemaker:DeleteModelPackageGroup",
        "sagemaker:DeleteModelPackageGroupPolicy",
        "sagemaker:DeleteModelQualityJobDefinition",
        "sagemaker:DeleteMonitoringSchedule",
        "sagemaker:DeleteNotebookInstance",
        "sagemaker:DeleteNotebookInstanceLifecycleConfig",
        "sagemaker:DeletePipeline",
        "sagemaker:DeleteProject",
        "sagemaker:DeleteRecord",
        "sagemaker:DeleteTags",
        "sagemaker:DeleteTrial",
        "sagemaker:DeleteTrialComponent",
        "sagemaker:DeleteUserProfile",
        "sagemaker:DeleteWorkforce",
        "sagemaker:DeleteWorkteam",
        "sagemaker:DeregisterDevices",
        "sagemaker:DescribeAction",
        "sagemaker:DescribeAlgorithm",
        "sagemaker:DescribeApp",
        "sagemaker:DescribeAppImageConfig",
        "sagemaker:DescribeArtifact",
        "sagemaker:DescribeAutoMLJob",
        "sagemaker:DescribeCodeRepository",
        "sagemaker:DescribeCompilationJob",
        "sagemaker:DescribeContext",
        "sagemaker:DescribeDataQualityJobDefinition",
        "sagemaker:DescribeDevice",
        "sagemaker:DescribeDeviceFleet",
        "sagemaker:DescribeDomain",
        "sagemaker:DescribeEdgePackagingJob",
        "sagemaker:DescribeEndpoint",
        "sagemaker:DescribeEndpointConfig",
        "sagemaker:DescribeExperiment",
        "sagemaker:DescribeFeatureGroup",
        "sagemaker:DescribeFlowDefinition",
        "sagemaker:DescribeHumanLoop",
        "sagemaker:DescribeHumanTaskUi",
        "sagemaker:DescribeHyperParameterTuningJob",
        "sagemaker:DescribeImage",
        "sagemaker:DescribeImageVersion",
        "sagemaker:DescribeInferenceRecommendationsJob",
        "sagemaker:DescribeLabelingJob",
        "sagemaker:DescribeLineageGroup",
        "sagemaker:DescribeModel",
        "sagemaker:DescribeModelBiasJobDefinition",
        "sagemaker:DescribeModelExplainabilityJobDefinition",
        "sagemaker:DescribeModelPackage",
        "sagemaker:DescribeModelPackageGroup",
        "sagemaker:DescribeModelQualityJobDefinition",
        "sagemaker:DescribeMonitoringSchedule",
        "sagemaker:DescribeNotebookInstance",
        "sagemaker:DescribeNotebookInstanceLifecycleConfig",
        "sagemaker:DescribePipeline",
        "sagemaker:DescribePipelineDefinitionForExecution",
        "sagemaker:DescribePipelineExecution",
        "sagemaker:DescribeProcessingJob",
        "sagemaker:DescribeProject",
        "sagemaker:DescribeSubscribedWorkteam",
        "sagemaker:DescribeTrainingJob",
        "sagemaker:DescribeTransformJob",
        "sagemaker:DescribeTrial",
        "sagemaker:DescribeTrialComponent",
        "sagemaker:DescribeUserProfile",
        "sagemaker:DescribeWorkforce",
        "sagemaker:DescribeWorkteam",
        "sagemaker:DisableSagemakerServicecatalogPortfolio",
        "sagemaker:DisassociateTrialComponent",
        "sagemaker:EnableSagemakerServicecatalogPortfolio",
        "sagemaker:GetDeviceFleetReport",
        "sagemaker:GetDeviceRegistration",
        "sagemaker:GetLineageGroupPolicy",
        "sagemaker:GetModelPackageGroupPolicy",
        "sagemaker:GetRecord",
        "sagemaker:GetSagemakerServicecatalogPortfolioStatus",
        "sagemaker:GetSearchSuggestions",
        "sagemaker:InvokeEndpoint",
        "sagemaker:InvokeEndpointAsync",
        "sagemaker:ListActions",
        "sagemaker:ListAlgorithms",
        "sagemaker:ListAppImageConfigs",
        "sagemaker:ListApps",
        "sagemaker:ListArtifacts",
        "sagemaker:ListAssociations",
        "sagemaker:ListAutoMLJobs",
        "sagemaker:ListCandidatesForAutoMLJob",
        "sagemaker:ListCodeRepositories",
        "sagemaker:ListCompilationJobs",
        "sagemaker:ListContexts",
        "sagemaker:ListDataQualityJobDefinitions",
        "sagemaker:ListDeviceFleets",
        "sagemaker:ListDevices",
        "sagemaker:ListDomains",
        "sagemaker:ListEdgePackagingJobs",
        "sagemaker:ListEndpointConfigs",
        "sagemaker:ListEndpoints",
        "sagemaker:ListExperiments",
        "sagemaker:ListFeatureGroups",
        "sagemaker:ListFlowDefinitions",
        "sagemaker:ListHumanLoops",
        "sagemaker:ListHumanTaskUis",
        "sagemaker:ListHyperParameterTuningJobs",
        "sagemaker:ListImageVersions",
        "sagemaker:ListImages",
        "sagemaker:ListInferenceRecommendationsJobs",
        "sagemaker:ListLabelingJobs",
        "sagemaker:ListLabelingJobsForWorkteam",
        "sagemaker:ListLineageGroups",
        "sagemaker:ListModelBiasJobDefinitions",
        "sagemaker:ListModelExplainabilityJobDefinitions",
        "sagemaker:ListModelMetadata",
        "sagemaker:ListModelPackageGroups",
        "sagemaker:ListModelPackages",
        "sagemaker:ListModelQualityJobDefinitions",
        "sagemaker:ListModels",
        "sagemaker:ListMonitoringExecutions",
        "sagemaker:ListMonitoringSchedules",
        "sagemaker:ListNotebookInstanceLifecycleConfigs",
        "sagemaker:ListNotebookInstances",
        "sagemaker:ListPipelineExecutionSteps",
        "sagemaker:ListPipelineExecutions",
        "sagemaker:ListPipelineParametersForExecution",
        "sagemaker:ListPipelines",
        "sagemaker:ListProcessingJobs",
        "sagemaker:ListProjects",
        "sagemaker:ListSubscribedWorkteams",
        "sagemaker:ListTags",
        "sagemaker:ListTrainingJobs",
        "sagemaker:ListTrainingJobsForHyperParameterTuningJob",
        "sagemaker:ListTransformJobs",
        "sagemaker:ListTrialComponents",
        "sagemaker:ListTrials",
        "sagemaker:ListUserProfiles",
        "sagemaker:ListWorkforces",
        "sagemaker:ListWorkteams",
        "sagemaker:PutLineageGroupPolicy",
        "sagemaker:PutModelPackageGroupPolicy",
        "sagemaker:PutRecord",
        "sagemaker:QueryLineage",
        "sagemaker:RegisterDevices",
        "sagemaker:RenderUiTemplate",
        "sagemaker:Search",
        "sagemaker:SendHeartbeat",
        "sagemaker:SendPipelineExecutionStepFailure",
        "sagemaker:SendPipelineExecutionStepSuccess",
        "sagemaker:StartHumanLoop",
        "sagemaker:StartMonitoringSchedule",
        "sagemaker:StartNotebookInstance",
        "sagemaker:StartPipelineExecution",
        "sagemaker:StopAutoMLJob",
        "sagemaker:StopCompilationJob",
        "sagemaker:StopEdgePackagingJob",
        "sagemaker:StopHumanLoop",
        "sagemaker:StopHyperParameterTuningJob",
        "sagemaker:StopInferenceRecommendationsJob",
        "sagemaker:StopLabelingJob",
        "sagemaker:StopMonitoringSchedule",
        "sagemaker:StopNotebookInstance",
        "sagemaker:StopPipelineExecution",
        "sagemaker:StopProcessingJob",
        "sagemaker:StopTrainingJob",
        "sagemaker:StopTransformJob",
        "sagemaker:UpdateAction",
        "sagemaker:UpdateAppImageConfig",
        "sagemaker:UpdateArtifact",
        "sagemaker:UpdateCodeRepository",
        "sagemaker:UpdateContext",
        "sagemaker:UpdateDeviceFleet",
        "sagemaker:UpdateDevices",
        "sagemaker:UpdateDomain",
        "sagemaker:UpdateEndpoint",
        "sagemaker:UpdateEndpointWeightsAndCapacities",
        "sagemaker:UpdateExperiment",
        "sagemaker:UpdateImage",
        "sagemaker:UpdateModelPackage",
        "sagemaker:UpdateMonitoringSchedule",
        "sagemaker:UpdateNotebookInstance",
        "sagemaker:UpdateNotebookInstanceLifecycleConfig",
        "sagemaker:UpdatePipeline",
        "sagemaker:UpdatePipelineExecution",
        "sagemaker:UpdateProject",
        "sagemaker:UpdateTrainingJob",
        "sagemaker:UpdateTrial",
        "sagemaker:UpdateTrialComponent",
        "sagemaker:UpdateUserProfile",
        "sagemaker:UpdateWorkforce",
        "sagemaker:UpdateWorkteam"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:action/*",
        "arn:aws:sagemaker:*:*:algorithm/*",
        "arn:aws:sagemaker:*:*:app-image-config/*",
        "arn:aws:sagemaker:*:*:artifact/*",
        "arn:aws:sagemaker:*:*:automl-job/*",
        "arn:aws:sagemaker:*:*:code-repository/*",
        "arn:aws:sagemaker:*:*:compilation-job/*",
        "arn:aws:sagemaker:*:*:context/*",
        "arn:aws:sagemaker:*:*:data-quality-job-definition/*",
        "arn:aws:sagemaker:*:*:device-fleet/*/device/*",
        "arn:aws:sagemaker:*:*:device-fleet/*",
        "arn:aws:sagemaker:*:*:edge-packaging-job/*",
        "arn:aws:sagemaker:*:*:endpoint/*",
        "arn:aws:sagemaker:*:*:endpoint-config/*",
        "arn:aws:sagemaker:*:*:experiment/*",
        "arn:aws:sagemaker:*:*:experiment-trial/*",
        "arn:aws:sagemaker:*:*:experiment-trial-component/*",
        "arn:aws:sagemaker:*:*:feature-group/*",
        "arn:aws:sagemaker:*:*:human-loop/*",
        "arn:aws:sagemaker:*:*:human-task-ui/*",
        "arn:aws:sagemaker:*:*:hyper-parameter-tuning-job/*",
        "arn:aws:sagemaker:*:*:image/*",
        "arn:aws:sagemaker:*:*:image-version/*/*",
        "arn:aws:sagemaker:*:*:inference-recommendations-job/*",
        "arn:aws:sagemaker:*:*:labeling-job/*",
        "arn:aws:sagemaker:*:*:model/*",
        "arn:aws:sagemaker:*:*:model-bias-job-definition/*",
        "arn:aws:sagemaker:*:*:model-explainability-job-definition/*",
        "arn:aws:sagemaker:*:*:model-package/*",
        "arn:aws:sagemaker:*:*:model-package-group/*",
        "arn:aws:sagemaker:*:*:model-quality-job-definition/*",
        "arn:aws:sagemaker:*:*:monitoring-schedule/*",
        "arn:aws:sagemaker:*:*:notebook-instance/*",
        "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/*",
        "arn:aws:sagemaker:*:*:pipeline/*",
        "arn:aws:sagemaker:*:*:pipeline/*/execution/*",
        "arn:aws:sagemaker:*:*:processing-job/*",
        "arn:aws:sagemaker:*:*:project/*",
        "arn:aws:sagemaker:*:*:training-job/*",
        "arn:aws:sagemaker:*:*:transform-job/*",
        "arn:aws:sagemaker:*:*:workforce/*",
        "arn:aws:sagemaker:*:*:workteam/*"
      ]
    },
    {
      "Sid" : "AmazonSageMakerLambdaPassRolePermission",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole"
      ]
    },
    {
      "Sid" : "AmazonSageMakerLambdaLogPermission",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogDelivery",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DeleteLogDelivery",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:DescribeResourcePolicies",
        "logs:DescribeDestinations",
        "logs:DescribeExportTasks",
        "logs:DescribeMetricFilters",
        "logs:DescribeQueries",
        "logs:DescribeQueryDefinitions",
        "logs:DescribeSubscriptionFilters",
        "logs:GetLogDelivery",
        "logs:GetLogEvents",
        "logs:ListLogDeliveries",
        "logs:PutLogEvents",
        "logs:PutResourcePolicy",
        "logs:UpdateLogDelivery"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*"
    },
    {
      "Sid" : "AmazonSageMakerLambdaCodeBuildPermission",
      "Effect": "Allow",
      "Action": [
        "codebuild:StartBuild",
        "codebuild:BatchGetBuilds"
      ],
      "Resource": "arn:aws:codebuild:*:*:project/sagemaker-*",
      "Condition": {
        "StringLike": {
          "aws:ResourceTag/sagemaker:project-name": "*"
        }
      }
    }
  ]
}
顯示較多顯示較少

AWSService Catalog AWS受管政策的 Amazon SageMaker AI 更新

檢視自此服務開始追蹤 Amazon SageMaker AI AWS受管政策更新以來的詳細資訊。

政策 版本 變更 Date

AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策

 10

已更新 codestar-connections:PassConnection和 codeconnections:PassConnection許可。

 2025 年 9 月 27 日

AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy - 更新的政策

 3

已更新 codestar-connections:UseConnection和 codeconnections:UseConnection許可。

 2025 年 9 月 27 日

AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy - 更新的政策

 3

已更新 codestar-connections:UseConnection和 codeconnections:UseConnection許可。

 2025 年 9 月 27 日

AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策

 9

新增 cloudformation:TagResource、cloudformation:UntagResource 和 codeconnections:PassConnection 許可。

 2024 年 7 月 1 日

AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策

 7

將政策復原至版本 7 (v7)。移除 cloudformation:TagResource、cloudformation:UntagResource 和 codeconnections:PassConnection 許可。

 2024 年 6 月 12 日

AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策

 8

新增 cloudformation:TagResource、cloudformation:UntagResource 和 codeconnections:PassConnection 許可。

 2024 年 6 月 11 日

AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy - 更新的政策

 2

新增 codestar-connections:UseConnection和 codeconnections:UseConnection 許可。

 2024 年 6 月 11 日

AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy - 更新的政策

 2

新增 cloudformation:TagResource、cloudformation:UntagResource、codestar-connections:UseConnection 和 codeconnections:UseConnection 許可。

 2024 年 6 月 11 日

AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy - 更新的政策

 2

新增 codebuild:StartBuild和 codebuild:BatchGetBuilds 許可。

 2024 年 6 月 11 日

AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy

 1

初始政策

 2023 年 8 月 1 日

AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy

 1

初始政策

 2023 年 8 月 1 日

AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy

 1

初始政策

 2023 年 8 月 1 日

AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy - 更新的政策

 2

新增許可至 glue:GetUserDefinedFunctions。

 2022 年 8 月 26 日

AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策

 7

新增許可至 sagemaker:AddTags。

 2022 年 8 月 2 日
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 6

新增許可至 lambda:TagResource。

 2022 年 7 月 14 日

AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy

 1

初始政策

 2022 年 4 月 4 日

AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy

 1

初始政策

 2022 年 3 月 24 日

AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy

 1

初始政策

 2022 年 3 月 24 日

AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy

 1

初始政策

 2022 年 3 月 24 日
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 5

新增許可至 ecr-idp:TagResource。

 2022 年 3 月 21 日

AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy

 1

初始政策

 2022 年 2 月 22 日

AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy

 1

初始政策

 2022 年 2 月 22 日

AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy

 1

初始政策

 2022 年 2 月 22 日
AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy 1

初始政策

 2022 年 2 月 22 日
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 4

新增 cognito-idp:TagResource 和 s3:PutBucketCORS 的許可。

 2022 年 2 月 16 日
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 3

新增 sagemaker 的許可。

建立、讀取、更新和刪除 SageMaker 映像。

 2021 年 9 月 15 日
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 2

新增 sagemaker 和 codestar-connections 的許可。

建立、讀取、更新和刪除程式碼儲存庫。

將AWS CodeStar連線傳遞至 AWS CodePipeline。

 2021 年 7 月 1 日
AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy 1

初始政策

 2020 年 11 月 27 日