AWS managed policies for SageMaker training plans

This AWS managed policy grants permissions needed to create and manage Amazon SageMaker training plans and Reserved Capacity in SageMaker AI. The policy can be attached to IAM roles used for creating and managing training plans and reserved capacity within SageMaker AI including your SageMaker AI execution role.

AWS managed policy: AmazonSageMakerTrainingPlanCreateAccess

This policy provides the necessary permissions to create, describe, search for, and list training plans in SageMaker AI. Additionally, it also allows adding tags to training plans and reserved capacity resources under specific conditions.

Permissions details

This policy includes the following permissions.

JSON

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Sid": "CreateTrainingPlanPermissions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateTrainingPlan",
        "sagemaker:CreateReservedCapacity",
        "sagemaker:DescribeReservedCapacity"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:training-plan/*",
        "arn:aws:sagemaker:*:*:reserved-capacity/*"
      ]
    },
    {
      "Sid": "AggTagsToTrainingPlanPermissions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddTags"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:training-plan/*",
        "arn:aws:sagemaker:*:*:reserved-capacity/*"
      ],
      "Condition": {
        "StringEquals": {
          "sagemaker:TaggingAction": ["CreateTrainingPlan","CreateReservedCapacity"]
        }
      }
    },
    {
      "Sid": "DescribeTrainingPlanPermissions",
      "Effect": "Allow",
      "Action": "sagemaker:DescribeTrainingPlan",
      "Resource": [
        "arn:aws:sagemaker:*:*:training-plan/*"
      ]
    },
    {
      "Sid": "NonResourceLevelTrainingPlanPermissions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:SearchTrainingPlanOfferings",
        "sagemaker:ListTrainingPlans"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ListUltraServersByReservedCapacityPermissions",
      "Effect": "Allow",
      "Action": "sagemaker:ListUltraServersByReservedCapacity",
      "Resource": [
      "arn:aws:sagemaker:*:*:reserved-capacity/*"
      ]
    }
  ]
}

AWS managed policy: AmazonSageMakerCapacityReservationServiceRolePolicy

This policy is used by the service-linked role named AWSServiceRoleForSageMakerCapacityReservation to publish CloudWatch metrics for Reserved Capacity utilization into customer accounts. The service-linked role is created by the service principal capacityreservation.sagemaker.amazonaws.com.

Permissions details

This policy includes the following permissions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudwatchPutMetricDataAccess",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:PutMetricData"
            ],
            "Resource": [
                "*"
            ],
            "Condition": {
                "StringEquals": {
                    "cloudwatch:namespace": "aws/sagemaker/CapacityReservations"
                }
            }
        }
    ]
}

For more information, see AmazonSageMakerCapacityReservationServiceRolePolicy in the AWS Managed Policy Reference Guide.

Amazon SageMaker AI updates to SageMaker training plans managed policies

View details about updates to AWS managed policies for Amazon SageMaker AI since this service began tracking these changes.