本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
AWS SageMaker AI 作业的托管策略
该 AWS 托管策略授予 SageMaker AI 任务执行角色访问亚马逊 S3 中的数据、通过 Amazon API Gateway 调用代理 AgentCore、使用 mlFlow 跟踪实验、发布模型包、写入日志 CloudWatch、调用 Lambda 函数以及管理 Amazon VPC 网络接口所需的权限。
AWS 托管策略： AmazonSageMakerJobFullAccess
此策略为 SageMaker AI 任务执行角色提供访问运行训练、处理和转换作业所需的资源的权限。您可以将此策略附加到用作 A SageMaker I 任务执行角色的 IAM 角色。
权限详细信息
该策略包含以下权限。
-
s3— 允许 SageMaker AI 作业从 Amazon S3 存储桶读取输入数据，将输出数据写入 Amazon S3 存储桶并列出其内容。仅限于同一账户中的资源。 -
kms— 允许 SageMaker AI 任务使用客户管理的密钥解密和生成数据密钥，以便对 Amazon S3 对象进行服务器端加密。 AWS KMSDecrypt和GenerateDataKey操作仅限于 Amazon S3。kms:ViaServiceDescribeKeykms:ViaService不受限制地允许。仅限于同一账户中的资源。 -
sagemaker(Hub)-允许描述中心内容，例如预先构建的模型和算法。仅限于同一账户中的资源。 -
sagemaker（模型包）-允许为模型注册表工作流程创建、访问和描述模型包和模型包组。仅限于同一账户中的资源。 -
sagemaker和sagemaker-mlflow— 允许作业使用 mlFlow 进行实验跟踪，包括创建实验和运行、记录指标、检索结果和管理跟踪。仅限于同一账户中的资源。 -
bedrock-agentcore— 允许作业通过 Amazon API Gateway AgentCore 运行时调用 AI 代理、停止运行时会话和获取运行时详细信息。仅限于同一账户中的资源。 -
ec2— 允许管理在 Amazon VPC 模式下运行的任务的 Amazon VPC 网络接口，包括创建、删除和描述网络接口及相关的 Amazon VPC 资源。该ec2:CreateTags操作仅限于该CreateNetworkInterface操作。仅限于同一账户中的资源。 -
logs— 允许创建日志组、日志流以及将日志事件写入 Amazon CloudWatch 日志。仅限于带有/aws/sagemaker/*前缀的日志组。仅限于同一账户中的资源。 -
lambda— 允许在同一个账户中调用 Lambda 函数。
{ "Version": "2012-10-17", "Statement": [ { "Sid": "S3Permissions", "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:ListBucket" ], "Resource": "*", "Condition": { "StringEquals": { "s3:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "KMSPermissions", "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" }, "StringLike": { "kms:ViaService": "s3.*.amazonaws.com" } } }, { "Sid": "KMSDescribeKey", "Effect": "Allow", "Action": "kms:DescribeKey", "Resource": "arn:aws:kms:*:*:key/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerHubPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeHubContent" ], "Resource": [ "arn:aws:sagemaker:*:*:hub/*", "arn:aws:sagemaker:*:*:hub-content/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "SageMakerModelPackagePermissions", "Effect": "Allow", "Action": [ "sagemaker:AccessModelPackage", "sagemaker:CreateModelPackage", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup" ], "Resource": [ "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "MLflowPermissions", "Effect": "Allow", "Action": [ "sagemaker:DescribeMlflowApp", "sagemaker:CallMlflowAppApi", "sagemaker-mlflow:CreateExperiment", "sagemaker-mlflow:CreateRun", "sagemaker-mlflow:UpdateRun", "sagemaker-mlflow:LogBatch", "sagemaker-mlflow:GetExperimentByName", "sagemaker-mlflow:GetMetricHistory", "sagemaker-mlflow:GetRun", "sagemaker-mlflow:StartTrace", "sagemaker-mlflow:EndTrace", "sagemaker-mlflow:SearchTraces", "sagemaker-mlflow:ListArtifacts" ], "Resource": [ "arn:aws:sagemaker:*:*:mlflow-app/*" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "BedrockAgentCorePermissions", "Effect": "Allow", "Action": [ "bedrock-agentcore:InvokeAgentRuntime", "bedrock-agentcore:StopRuntimeSession", "bedrock-agentcore:GetAgentRuntime" ], "Resource": "arn:aws:bedrock-agentcore:*:*:runtime/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2NetworkPermissions", "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups", "ec2:DescribeDhcpOptions" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "EC2NetworkInterfaceTagPermissions", "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "arn:aws:ec2:*:*:network-interface/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}", "ec2:CreateAction": "CreateNetworkInterface" } } }, { "Sid": "EC2NetworkInterfaceDeletePermissions", "Effect": "Allow", "Action": [ "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "CloudWatchLogsPermissions", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Sid": "LambdaPermissions", "Effect": "Allow", "Action": [ "lambda:InvokeFunction" ], "Resource": "arn:aws:lambda:*:*:function:*", "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] }
有关更多信息，请参阅AmazonSageMakerJobFullAccess《 AWS 托管策略参考指南》。
Amazon SageMaker AI 更新了 SageMaker AI 作业托管政策
查看有关自该服务开始跟踪 SageMaker AI 作业 AWS 托管策略变更以来这些更新的详细信息。
| Policy | 版本 | 更改 | 日期 |
|---|---|---|---|
1 |
初始策略 |
2026 年 6 月 4 日 |
