# 步骤 6：为 SageMaker AI 笔记本创建 IAM 策略
<a name="create-sagemaker-notebook-policy"></a>

如果计划将 SageMaker AI 笔记本与开发端点结合使用，则必须在创建笔记本时指定权限。您通过使用 AWS Identity and Access Management（IAM）提供这些权限。

**为 SageMaker AI 笔记本创建 IAM 策略**

1. 登录 AWS 管理控制台，然后通过以下网址打开 IAM 控制台：[https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/)。

1. 在左侧导航窗格中，选择 **Policies（策略）**。

1. 选择**创建策略**。

1. 在 **Create Policy (创建策略)** 页面上，导航到用于编辑 JSON 的选项卡。使用以下 JSON 语句创建一个策略文档。编辑环境的 *bucket-name*、*region-code* 和 *account-id*。

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
           {
               "Action": [
                   "s3:ListBucket"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:s3:::amzn-s3-demo-bucket"
               ]
           },
           {
               "Action": [
                   "s3:GetObject"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:s3:::amzn-s3-demo-bucket*"
               ]
           },
           {
               "Action": [
                   "logs:CreateLogStream",
                   "logs:DescribeLogStreams",
                   "logs:PutLogEvents",
                   "logs:CreateLogGroup"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:logs:us-east-1:111122223333:log-group:/aws/sagemaker/*",
                   "arn:aws:logs:us-east-1:111122223333:log-group:/aws/sagemaker/*:log-stream:aws-glue-*"
               ]
           },
           {
               "Action": [
                   "glue:UpdateDevEndpoint",
                   "glue:GetDevEndpoint",
                   "glue:GetDevEndpoints"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:glue:us-east-1:111122223333:devEndpoint/*"
               ]
           },
           {
               "Action": [
                   "sagemaker:ListTags"
               ],
               "Effect": "Allow",
               "Resource": [
                   "arn:aws:sagemaker:us-east-1:111122223333:notebook-instance/*"
               ]
           }
       ]
   }
   ```

------

   然后，选择**查看策略**。

   下表描述了此策略授予的权限。    
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_cn/glue/latest/dg/create-sagemaker-notebook-policy.html)

1. 在 **Review Policy (查看策略)** 屏幕上，输入您的 **Policy Name (策略名称)**，例如 `AWSGlueSageMakerNotebook`。输入可选描述，然后在您对该策略满意时选择 **Create policy (创建策略)**。