本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。 # AWS SageMaker 專案和 JumpStart 的受管政策 這些 AWS 受管政策新增使用內建 Amazon SageMaker AI 專案範本和 JumpStart 解決方案的許可。這些政策可在您的帳戶中使用， AWS 並由從 SageMaker AI 主控台建立的執行角色使用。 SageMaker Projects 和 JumpStart 使用 AWS Service Catalog 來佈建客戶帳戶中 AWS 的資源。某些建立的資源需要擔任執行角色。例如，如果 AWS Service Catalog 代表客戶為 SageMaker AI 機器學習 CI/CD 專案建立 CodePipeline 管道，則該管道需要 IAM 角色。 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 角色具有從 AWS Service Catalog 啟動 SageMaker AI 產品組合所需的許可。[AmazonSageMakerServiceCatalogProductsUseRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsUseRole) 角色具有從 AWS Service Catalog 使用 SageMaker AI 產品組合所需的許可。`AmazonSageMakerServiceCatalogProductsLaunchRole` 角色會將 `AmazonSageMakerServiceCatalogProductsUseRole`角色傳遞至佈建的 AWS Service Catalog 產品資源。 **Topics** + [AWS 受管政策：AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy) + [AWS 受管政策：AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy) + [AWS Service Catalog AWS 受管政策的 Amazon SageMaker AI 更新](#security-iam-awsmanpol-sc-updates) ## AWS 受管政策：AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy 此服務會使用此服務角色政策 AWS Service Catalog ，從 Amazon SageMaker AI 產品組合佈建產品。政策會授予一組相關 AWS 服務的許可 AWS CodePipeline，包括 AWS CodeBuild、、 AWS CodeCommit AWS Glue AWS CloudFormation等。 `AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy` 政策旨在由從 SageMaker AI 主控台建立的 `AmazonSageMakerServiceCatalogProductsLaunchRole` 角色使用。政策新增許可，以使用 Service Catalog 為 SageMaker 專案和 JumpStart 佈建 AWS 資源到客戶的帳戶。 **許可詳細資訊** 此政策包含以下許可。 + `apigateway` - 讓角色呼叫標記為 `sagemaker:launch-source` 的 API Gateway 端點。 + `cloudformation` – 允許 AWS Service Catalog 建立、更新和刪除 CloudFormation 堆疊。也允許 Service Catalog 標記和取消標記資源。 + `codebuild` – 允許 CloudFormation 擔任 AWS Service Catalog 並傳遞給 CloudFormation 的角色建立、更新和刪除 CodeBuild 專案。 CloudFormation + `codecommit` – 允許 CloudFormation 擔任 AWS Service Catalog 並傳遞給 CloudFormation 的角色建立、更新和刪除 CodeCommit 儲存庫。 CloudFormation + `codepipeline` – 允許 CloudFormation 擔任 AWS Service Catalog 並傳遞給 CloudFormation 的角色建立、更新和刪除 CodePipelines。 CloudFormation + `codeconnections`， `codestar-connections` – 也允許角色傳遞 AWS CodeConnections 和 AWS CodeStar 連線。 + `cognito-idp` - 讓角色建立、更新和刪除群組和使用者集區。也可以標記資源。 + `ecr` – 允許 CloudFormation 擔任 AWS Service Catalog 並傳遞給 CloudFormation 的角色建立和刪除 Amazon ECR 儲存庫。也可以標記資源。 + `events` – 允許 CloudFormation 擔任 AWS Service Catalog 並傳遞給 CloudFormation 的角色建立和刪除 EventBridge 規則。用於將 CICD 管道的各種元件結合在一起。 + `firehose` - 允許角色與 Firehose 串流互動。 + `glue` – 允許角色與 互動 AWS Glue。 + `iam` - 讓角色傳遞字首為 `AmazonSageMakerServiceCatalog` 的角色。當專案佈建 AWS Service Catalog 產品時為必需，因為角色需要傳遞給 AWS Service Catalog。 + `lambda` - 讓角色與 AWS Lambda互動。也可以標記資源。 + `logs` - 讓角色建立、刪除和存取日誌串流。 + `s3` – 允許 CloudFormation 擔任 AWS Service Catalog 的角色存取存放專案範本程式碼的 Amazon S3 儲存貯體。 + `sagemaker` - 允許角色與各種 SageMaker AI 服務互動。可以在範本佈建期間在 CloudFormation 中完成，也可以在 CICD 管道執行時在 CodeBuild 中完成。也可以標記以下資源：端點、端點組態、模型、管道、專案和模型套件。 + `states` - 讓角色建立、刪除和更新字首為 `sagemaker` 的 Step Function。 若要檢視此政策的許可，請參閱《 AWS 受管政策參考》中的 [AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy.html)。 ## AWS 受管政策：AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy Amazon API Gateway 會在 Amazon Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品內使用此政策。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 API Gateway 所建立且需要角色 AWS 的資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `lambda` - 調用合作夥伴範本建立的函式。 + `sagemaker` - 調用合作夥伴範本建立的端點。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "arn:aws:lambda:*:*:function:sagemaker-*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } }, { "Effect": "Allow", "Action": "sagemaker:InvokeEndpoint", "Resource": "arn:aws:sagemaker:*:*:endpoint/*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy 此政策由 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品 AWS CloudFormation 內使用。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 所建立 CloudFormation 且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `iam` - 傳遞 `AmazonSageMakerServiceCatalogProductsLambdaRole` 和 `AmazonSageMakerServiceCatalogProductsApiGatewayRole` 角色。 + `lambda` – 建立、更新、刪除和叫用 AWS Lambda 函數；擷取、發佈和刪除 Lambda 層的版本。 + `apigateway` - 建立、更新和刪除 Amazon API Gateway 資源。 + `s3` - 從 Amazon Simple Storage Service (Amazon S3) 儲存貯體擷取 `lambda-auth-code/layer.zip` 檔案。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsLambdaRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "lambda.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsApiGatewayRole" ], "Condition": { "StringEquals": { "iam:PassedToService": "apigateway.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "lambda:DeleteFunction", "lambda:UpdateFunctionCode", "lambda:ListTags", "lambda:InvokeFunction" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" } } }, { "Effect": "Allow", "Action": [ "lambda:CreateFunction", "lambda:TagResource" ], "Resource": [ "arn:aws:lambda:*:*:function:sagemaker-*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name", "sagemaker:partner" ] } } }, { "Effect": "Allow", "Action": [ "lambda:PublishLayerVersion", "lambda:GetLayerVersion", "lambda:DeleteLayerVersion", "lambda:GetFunction" ], "Resource": [ "arn:aws:lambda:*:*:layer:sagemaker-*", "arn:aws:lambda:*:*:function:sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "apigateway:GET", "apigateway:DELETE", "apigateway:PATCH", "apigateway:POST", "apigateway:PUT" ], "Resource": [ "arn:aws:apigateway:*::/restapis/*", "arn:aws:apigateway:*::/restapis" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" } } }, { "Effect": "Allow", "Action": [ "apigateway:POST", "apigateway:PUT" ], "Resource": [ "arn:aws:apigateway:*::/restapis", "arn:aws:apigateway:*::/tags/*" ], "Condition": { "Null": { "aws:ResourceTag/sagemaker:project-name": "false", "aws:ResourceTag/sagemaker:partner": "false" }, "ForAnyValue:StringEquals": { "aws:TagKeys": [ "sagemaker:project-name", "sagemaker:partner" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::sagemaker-*/lambda-auth-code/layer.zip" ], "Condition": { "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy 此政策由 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品 AWS Lambda 內使用。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 Lambda 建立且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `secretsmanager` - 從合作夥伴提供的機密中擷取資料，用於合作夥伴範本。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "secretsmanager:GetSecretValue", "Resource": "arn:aws:secretsmanager:*:*:secret:*", "Condition": { "Null": { "aws:ResourceTag/sagemaker:partner": false }, "StringEquals": { "aws:ResourceAccount": "${aws:PrincipalAccount}" } } } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy Amazon API Gateway 會在 Amazon Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品內使用此政策。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 API Gateway 建立且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `logs` - 建立和讀取 CloudWatch Logs 群組、串流和事件；更新事件；描述各種資源。 這些許可僅限於其日誌群組前字首以“aws/apigateway/”開頭的資源。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/apigateway/*" } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy 此政策由 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品 AWS CloudFormation 內使用。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 所建立 CloudFormation 且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `sagemaker` - 允許存取各種 SageMaker AI 資源，但不包括網域、使用者設定檔、應用程式和流程定義。 + `iam` - 傳遞 `AmazonSageMakerServiceCatalogProductsCodeBuildRole` 和 `AmazonSageMakerServiceCatalogProductsExecutionRole` 角色。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "NotResource": [ "arn:aws:sagemaker:*:*:domain/*", "arn:aws:sagemaker:*:*:user-profile/*", "arn:aws:sagemaker:*:*:app/*", "arn:aws:sagemaker:*:*:flow-definition/*" ] }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole", "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ] } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy 此政策由 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品 AWS CodeBuild 內使用。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 CodeBuild 建立且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `sagemaker` - 允許存取各種 SageMaker AI 資源。 + `codecommit` - 將 CodeCommit 封存上傳至 CodeBuild 管道、取得上傳狀態以及取消上傳；取得分支和遞交資訊。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。 + `ecr` - 建立 Amazon ECR 儲存庫和容器映像；上傳影像層。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存庫。 `ecr` - 閱讀所有資源。 + `iam` - 傳遞下列角色： + `AmazonSageMakerServiceCatalogProductsCloudformationRole` 至 AWS CloudFormation。 + `AmazonSageMakerServiceCatalogProductsCodeBuildRole` 至 AWS CodeBuild。 + `AmazonSageMakerServiceCatalogProductsCodePipelineRole` 至 AWS CodePipeline。 + `AmazonSageMakerServiceCatalogProductsEventsRole` 至 Amazon EventBridge。 + `AmazonSageMakerServiceCatalogProductsExecutionRole` 至 Amazon SageMaker AI。 + `logs` - 建立和讀取 CloudWatch Logs 群組、串流和事件；更新事件；描述各種資源。 這些許可僅限於其名稱字首以 “aws/codebuild” 開頭的資源。 + `s3` - 建立、讀取和列出 Amazon S3 儲存貯體。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存貯體。 + `codeconnections`、 `codestar-connections` – 使用 AWS CodeConnections 和 AWS CodeStar 連線。 若要檢視此政策的許可，請參閱《 AWS 受管政策參考》中的 [AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy.html)。 ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy 此政策由 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品 AWS CodePipeline 內使用。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 CodePipeline 建立且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `cloudformation` - 建立、讀取、刪除和更新 CloudFormation 堆疊；建立、讀取、刪除和執行變更集；設定堆疊政策；標記和取消標記資源。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。 + `s3`— 建立、讀取、列出和刪除 Amazon S3 儲存貯體；新增、讀取和刪除儲存貯體中的物件；讀取和設定 CORS 組態；讀取存取控制清單 (ACL)；以及讀取儲存貯體所在的 AWS 區域。 這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。 + `iam` - 傳遞 `AmazonSageMakerServiceCatalogProductsCloudformationRole` 角色。 + `codebuild`— 取得 CodeBuild 建置資訊並開始組建。這些許可僅限於名稱以 “sagemaker-” 開頭的專案與建置資源。 + `codecommit` - 將 CodeCommit 封存上傳至 CodeBuild 管道、取得上傳狀態以及取消上傳；取得分支和遞交資訊。 + `codeconnections`、 `codestar-connections` – 使用 AWS CodeConnections 和 AWS CodeStar 連線。 若要檢視此政策的許可，請參閱《 AWS 受管政策參考》中的 [AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy.html)。 ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy 在 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品中，Amazon EventBridge 會使用此政策。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 EventBridge 建立且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `codepipeline` - 啟動 CodeBuild 執行。這些許可僅限於名稱以 “sagemaker-” 開頭的管道。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "codepipeline:StartPipelineExecution", "Resource": "arn:aws:codepipeline:*:*:sagemaker-*" } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy Amazon Data Firehose 會在 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品內使用此政策。此政策旨在連接至 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 Firehose 建立且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `firehose` - 傳送 Firehose 記錄。這些許可僅限於交付串流名稱以 “sagemaker-” 開頭的資源。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "firehose:PutRecord", "firehose:PutRecordBatch" ], "Resource": "arn:aws:firehose:*:*:deliverystream/sagemaker-*" } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy Glue 在 Amazon SageMaker AI AWS 產品組合的 AWS Service Catalog 佈建產品中使用此政策。此政策旨在連接到 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 Glue 所建立且需要角色的 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `glue` – 建立、讀取和刪除 AWS Glue 分割區、資料表和資料表版本。這些許可僅限於名稱以 “sagemaker-” 開頭的資源。建立和讀取 AWS Glue 資料庫。這些許可僅限於名稱為 “default”、“global\$1temp” 或以 “sagemaker-” 開頭的資料庫。取得使用者定義的函式。 + `s3`— 建立、讀取、列出和刪除 Amazon S3 儲存貯體；新增、讀取和刪除儲存貯體中的物件；讀取和設定 CORS 組態；讀取存取控制清單 (ACL)，以及讀取儲存貯體所在的 AWS 區域。 這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。 + `logs` - 建立、讀取和刪除 CloudWatch Logs 日誌群組、串流和交付；以及建立資源政策。 這些許可僅限於其名稱字首以 “aws/glue” 開頭的資源。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "glue:BatchCreatePartition", "glue:BatchDeletePartition", "glue:BatchDeleteTable", "glue:BatchDeleteTableVersion", "glue:BatchGetPartition", "glue:CreateDatabase", "glue:CreatePartition", "glue:CreateTable", "glue:DeletePartition", "glue:DeleteTable", "glue:DeleteTableVersion", "glue:GetDatabase", "glue:GetPartition", "glue:GetPartitions", "glue:GetTable", "glue:GetTables", "glue:GetTableVersion", "glue:GetTableVersions", "glue:SearchTables", "glue:UpdatePartition", "glue:UpdateTable", "glue:GetUserDefinedFunctions" ], "Resource": [ "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:database/default", "arn:aws:glue:*:*:database/global_temp", "arn:aws:glue:*:*:database/sagemaker-*", "arn:aws:glue:*:*:table/sagemaker-*", "arn:aws:glue:*:*:tableVersion/sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:Describe*", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/glue/*" } ] } ``` ------ ## AWS 受管政策：AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy 此政策由 Amazon SageMaker AI 產品組合的 AWS Service Catalog 佈建產品 AWS Lambda 內使用。此政策旨在連接到 [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) 傳遞至 Lambda 建立且需要角色之 AWS 資源的 IAM 角色。 **許可詳細資訊** 此政策包含以下許可。 + `sagemaker` - 允許存取各種 SageMaker AI 資源。 + `ecr` - 建立和刪除 Amazon ECR 儲存庫；建立、讀取與刪除容器映像；上傳影像層。這些許可僅限於名稱以 “sagemaker-” 開頭的儲存庫。 + `events` - 建立、讀取和刪除 Amazon EventBridge 規則；以及建立和移除目標。這些許可僅限於名稱以 “sagemaker-” 開頭的規則。 + `s3`— 建立、讀取、列出和刪除 Amazon S3 儲存貯體；新增、讀取和刪除儲存貯體中的物件；讀取和設定 CORS 組態；讀取存取控制清單 (ACL)，以及讀取儲存貯體所在的 AWS 區域。 這些許可僅限於名稱以 “sagemaker-” 或 “aws-glue-” 開頭的儲存貯體。 + `iam` - 傳遞 `AmazonSageMakerServiceCatalogProductsExecutionRole` 角色。 + `logs` - 建立、讀取和刪除 CloudWatch Logs 日誌群組、串流和交付；以及建立資源政策。 這些許可僅限於其名稱字首以 “aws/lambda/” 開頭的資源。 + `codebuild` – 開始並取得 AWS CodeBuild 組建的相關資訊。 ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid" : "AmazonSageMakerLambdaECRPermission", "Effect": "Allow", "Action": [ "ecr:DescribeImages", "ecr:BatchDeleteImage", "ecr:CompleteLayerUpload", "ecr:CreateRepository", "ecr:DeleteRepository", "ecr:InitiateLayerUpload", "ecr:PutImage", "ecr:UploadLayerPart" ], "Resource": [ "arn:aws:ecr:*:*:repository/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaEventBridgePermission", "Effect": "Allow", "Action": [ "events:DeleteRule", "events:DescribeRule", "events:PutRule", "events:PutTargets", "events:RemoveTargets" ], "Resource": [ "arn:aws:events:*:*:rule/sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaS3BucketPermission", "Effect": "Allow", "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:GetBucketAcl", "s3:GetBucketCors", "s3:GetBucketLocation", "s3:ListAllMyBuckets", "s3:ListBucket", "s3:ListBucketMultipartUploads", "s3:PutBucketCors" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaS3ObjectPermission", "Effect": "Allow", "Action": [ "s3:AbortMultipartUpload", "s3:DeleteObject", "s3:GetObject", "s3:GetObjectVersion", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::aws-glue-*", "arn:aws:s3:::sagemaker-*" ] }, { "Sid" : "AmazonSageMakerLambdaSageMakerPermission", "Effect": "Allow", "Action": [ "sagemaker:AddAssociation", "sagemaker:AddTags", "sagemaker:AssociateTrialComponent", "sagemaker:BatchDescribeModelPackage", "sagemaker:BatchGetMetrics", "sagemaker:BatchGetRecord", "sagemaker:BatchPutMetrics", "sagemaker:CreateAction", "sagemaker:CreateAlgorithm", "sagemaker:CreateApp", "sagemaker:CreateAppImageConfig", "sagemaker:CreateArtifact", "sagemaker:CreateAutoMLJob", "sagemaker:CreateCodeRepository", "sagemaker:CreateCompilationJob", "sagemaker:CreateContext", "sagemaker:CreateDataQualityJobDefinition", "sagemaker:CreateDeviceFleet", "sagemaker:CreateDomain", "sagemaker:CreateEdgePackagingJob", "sagemaker:CreateEndpoint", "sagemaker:CreateEndpointConfig", "sagemaker:CreateExperiment", "sagemaker:CreateFeatureGroup", "sagemaker:CreateFlowDefinition", "sagemaker:CreateHumanTaskUi", "sagemaker:CreateHyperParameterTuningJob", "sagemaker:CreateImage", "sagemaker:CreateImageVersion", "sagemaker:CreateInferenceRecommendationsJob", "sagemaker:CreateLabelingJob", "sagemaker:CreateLineageGroupPolicy", "sagemaker:CreateModel", "sagemaker:CreateModelBiasJobDefinition", "sagemaker:CreateModelExplainabilityJobDefinition", "sagemaker:CreateModelPackage", "sagemaker:CreateModelPackageGroup", "sagemaker:CreateModelQualityJobDefinition", "sagemaker:CreateMonitoringSchedule", "sagemaker:CreateNotebookInstance", "sagemaker:CreateNotebookInstanceLifecycleConfig", "sagemaker:CreatePipeline", "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreatePresignedNotebookInstanceUrl", "sagemaker:CreateProcessingJob", "sagemaker:CreateProject", "sagemaker:CreateTrainingJob", "sagemaker:CreateTransformJob", "sagemaker:CreateTrial", "sagemaker:CreateTrialComponent", "sagemaker:CreateUserProfile", "sagemaker:CreateWorkforce", "sagemaker:CreateWorkteam", "sagemaker:DeleteAction", "sagemaker:DeleteAlgorithm", "sagemaker:DeleteApp", "sagemaker:DeleteAppImageConfig", "sagemaker:DeleteArtifact", "sagemaker:DeleteAssociation", "sagemaker:DeleteCodeRepository", "sagemaker:DeleteContext", "sagemaker:DeleteDataQualityJobDefinition", "sagemaker:DeleteDeviceFleet", "sagemaker:DeleteDomain", "sagemaker:DeleteEndpoint", "sagemaker:DeleteEndpointConfig", "sagemaker:DeleteExperiment", "sagemaker:DeleteFeatureGroup", "sagemaker:DeleteFlowDefinition", "sagemaker:DeleteHumanLoop", "sagemaker:DeleteHumanTaskUi", "sagemaker:DeleteImage", "sagemaker:DeleteImageVersion", "sagemaker:DeleteLineageGroupPolicy", "sagemaker:DeleteModel", "sagemaker:DeleteModelBiasJobDefinition", "sagemaker:DeleteModelExplainabilityJobDefinition", "sagemaker:DeleteModelPackage", "sagemaker:DeleteModelPackageGroup", "sagemaker:DeleteModelPackageGroupPolicy", "sagemaker:DeleteModelQualityJobDefinition", "sagemaker:DeleteMonitoringSchedule", "sagemaker:DeleteNotebookInstance", "sagemaker:DeleteNotebookInstanceLifecycleConfig", "sagemaker:DeletePipeline", "sagemaker:DeleteProject", "sagemaker:DeleteRecord", "sagemaker:DeleteTags", "sagemaker:DeleteTrial", "sagemaker:DeleteTrialComponent", "sagemaker:DeleteUserProfile", "sagemaker:DeleteWorkforce", "sagemaker:DeleteWorkteam", "sagemaker:DeregisterDevices", "sagemaker:DescribeAction", "sagemaker:DescribeAlgorithm", "sagemaker:DescribeApp", "sagemaker:DescribeAppImageConfig", "sagemaker:DescribeArtifact", "sagemaker:DescribeAutoMLJob", "sagemaker:DescribeCodeRepository", "sagemaker:DescribeCompilationJob", "sagemaker:DescribeContext", "sagemaker:DescribeDataQualityJobDefinition", "sagemaker:DescribeDevice", "sagemaker:DescribeDeviceFleet", "sagemaker:DescribeDomain", "sagemaker:DescribeEdgePackagingJob", "sagemaker:DescribeEndpoint", "sagemaker:DescribeEndpointConfig", "sagemaker:DescribeExperiment", "sagemaker:DescribeFeatureGroup", "sagemaker:DescribeFlowDefinition", "sagemaker:DescribeHumanLoop", "sagemaker:DescribeHumanTaskUi", "sagemaker:DescribeHyperParameterTuningJob", "sagemaker:DescribeImage", "sagemaker:DescribeImageVersion", "sagemaker:DescribeInferenceRecommendationsJob", "sagemaker:DescribeLabelingJob", "sagemaker:DescribeLineageGroup", "sagemaker:DescribeModel", "sagemaker:DescribeModelBiasJobDefinition", "sagemaker:DescribeModelExplainabilityJobDefinition", "sagemaker:DescribeModelPackage", "sagemaker:DescribeModelPackageGroup", "sagemaker:DescribeModelQualityJobDefinition", "sagemaker:DescribeMonitoringSchedule", "sagemaker:DescribeNotebookInstance", "sagemaker:DescribeNotebookInstanceLifecycleConfig", "sagemaker:DescribePipeline", "sagemaker:DescribePipelineDefinitionForExecution", "sagemaker:DescribePipelineExecution", "sagemaker:DescribeProcessingJob", "sagemaker:DescribeProject", "sagemaker:DescribeSubscribedWorkteam", "sagemaker:DescribeTrainingJob", "sagemaker:DescribeTransformJob", "sagemaker:DescribeTrial", "sagemaker:DescribeTrialComponent", "sagemaker:DescribeUserProfile", "sagemaker:DescribeWorkforce", "sagemaker:DescribeWorkteam", "sagemaker:DisableSagemakerServicecatalogPortfolio", "sagemaker:DisassociateTrialComponent", "sagemaker:EnableSagemakerServicecatalogPortfolio", "sagemaker:GetDeviceFleetReport", "sagemaker:GetDeviceRegistration", "sagemaker:GetLineageGroupPolicy", "sagemaker:GetModelPackageGroupPolicy", "sagemaker:GetRecord", "sagemaker:GetSagemakerServicecatalogPortfolioStatus", "sagemaker:GetSearchSuggestions", "sagemaker:InvokeEndpoint", "sagemaker:InvokeEndpointAsync", "sagemaker:ListActions", "sagemaker:ListAlgorithms", "sagemaker:ListAppImageConfigs", "sagemaker:ListApps", "sagemaker:ListArtifacts", "sagemaker:ListAssociations", "sagemaker:ListAutoMLJobs", "sagemaker:ListCandidatesForAutoMLJob", "sagemaker:ListCodeRepositories", "sagemaker:ListCompilationJobs", "sagemaker:ListContexts", "sagemaker:ListDataQualityJobDefinitions", "sagemaker:ListDeviceFleets", "sagemaker:ListDevices", "sagemaker:ListDomains", "sagemaker:ListEdgePackagingJobs", "sagemaker:ListEndpointConfigs", "sagemaker:ListEndpoints", "sagemaker:ListExperiments", "sagemaker:ListFeatureGroups", "sagemaker:ListFlowDefinitions", "sagemaker:ListHumanLoops", "sagemaker:ListHumanTaskUis", "sagemaker:ListHyperParameterTuningJobs", "sagemaker:ListImageVersions", "sagemaker:ListImages", "sagemaker:ListInferenceRecommendationsJobs", "sagemaker:ListLabelingJobs", "sagemaker:ListLabelingJobsForWorkteam", "sagemaker:ListLineageGroups", "sagemaker:ListModelBiasJobDefinitions", "sagemaker:ListModelExplainabilityJobDefinitions", "sagemaker:ListModelMetadata", "sagemaker:ListModelPackageGroups", "sagemaker:ListModelPackages", "sagemaker:ListModelQualityJobDefinitions", "sagemaker:ListModels", "sagemaker:ListMonitoringExecutions", "sagemaker:ListMonitoringSchedules", "sagemaker:ListNotebookInstanceLifecycleConfigs", "sagemaker:ListNotebookInstances", "sagemaker:ListPipelineExecutionSteps", "sagemaker:ListPipelineExecutions", "sagemaker:ListPipelineParametersForExecution", "sagemaker:ListPipelines", "sagemaker:ListProcessingJobs", "sagemaker:ListProjects", "sagemaker:ListSubscribedWorkteams", "sagemaker:ListTags", "sagemaker:ListTrainingJobs", "sagemaker:ListTrainingJobsForHyperParameterTuningJob", "sagemaker:ListTransformJobs", "sagemaker:ListTrialComponents", "sagemaker:ListTrials", "sagemaker:ListUserProfiles", "sagemaker:ListWorkforces", "sagemaker:ListWorkteams", "sagemaker:PutLineageGroupPolicy", "sagemaker:PutModelPackageGroupPolicy", "sagemaker:PutRecord", "sagemaker:QueryLineage", "sagemaker:RegisterDevices", "sagemaker:RenderUiTemplate", "sagemaker:Search", "sagemaker:SendHeartbeat", "sagemaker:SendPipelineExecutionStepFailure", "sagemaker:SendPipelineExecutionStepSuccess", "sagemaker:StartHumanLoop", "sagemaker:StartMonitoringSchedule", "sagemaker:StartNotebookInstance", "sagemaker:StartPipelineExecution", "sagemaker:StopAutoMLJob", "sagemaker:StopCompilationJob", "sagemaker:StopEdgePackagingJob", "sagemaker:StopHumanLoop", "sagemaker:StopHyperParameterTuningJob", "sagemaker:StopInferenceRecommendationsJob", "sagemaker:StopLabelingJob", "sagemaker:StopMonitoringSchedule", "sagemaker:StopNotebookInstance", "sagemaker:StopPipelineExecution", "sagemaker:StopProcessingJob", "sagemaker:StopTrainingJob", "sagemaker:StopTransformJob", "sagemaker:UpdateAction", "sagemaker:UpdateAppImageConfig", "sagemaker:UpdateArtifact", "sagemaker:UpdateCodeRepository", "sagemaker:UpdateContext", "sagemaker:UpdateDeviceFleet", "sagemaker:UpdateDevices", "sagemaker:UpdateDomain", "sagemaker:UpdateEndpoint", "sagemaker:UpdateEndpointWeightsAndCapacities", "sagemaker:UpdateExperiment", "sagemaker:UpdateImage", "sagemaker:UpdateModelPackage", "sagemaker:UpdateMonitoringSchedule", "sagemaker:UpdateNotebookInstance", "sagemaker:UpdateNotebookInstanceLifecycleConfig", "sagemaker:UpdatePipeline", "sagemaker:UpdatePipelineExecution", "sagemaker:UpdateProject", "sagemaker:UpdateTrainingJob", "sagemaker:UpdateTrial", "sagemaker:UpdateTrialComponent", "sagemaker:UpdateUserProfile", "sagemaker:UpdateWorkforce", "sagemaker:UpdateWorkteam" ], "Resource": [ "arn:aws:sagemaker:*:*:action/*", "arn:aws:sagemaker:*:*:algorithm/*", "arn:aws:sagemaker:*:*:app-image-config/*", "arn:aws:sagemaker:*:*:artifact/*", "arn:aws:sagemaker:*:*:automl-job/*", "arn:aws:sagemaker:*:*:code-repository/*", "arn:aws:sagemaker:*:*:compilation-job/*", "arn:aws:sagemaker:*:*:context/*", "arn:aws:sagemaker:*:*:data-quality-job-definition/*", "arn:aws:sagemaker:*:*:device-fleet/*/device/*", "arn:aws:sagemaker:*:*:device-fleet/*", "arn:aws:sagemaker:*:*:edge-packaging-job/*", "arn:aws:sagemaker:*:*:endpoint/*", "arn:aws:sagemaker:*:*:endpoint-config/*", "arn:aws:sagemaker:*:*:experiment/*", "arn:aws:sagemaker:*:*:experiment-trial/*", "arn:aws:sagemaker:*:*:experiment-trial-component/*", "arn:aws:sagemaker:*:*:feature-group/*", "arn:aws:sagemaker:*:*:human-loop/*", "arn:aws:sagemaker:*:*:human-task-ui/*", "arn:aws:sagemaker:*:*:hyper-parameter-tuning-job/*", "arn:aws:sagemaker:*:*:image/*", "arn:aws:sagemaker:*:*:image-version/*/*", "arn:aws:sagemaker:*:*:inference-recommendations-job/*", "arn:aws:sagemaker:*:*:labeling-job/*", "arn:aws:sagemaker:*:*:model/*", "arn:aws:sagemaker:*:*:model-bias-job-definition/*", "arn:aws:sagemaker:*:*:model-explainability-job-definition/*", "arn:aws:sagemaker:*:*:model-package/*", "arn:aws:sagemaker:*:*:model-package-group/*", "arn:aws:sagemaker:*:*:model-quality-job-definition/*", "arn:aws:sagemaker:*:*:monitoring-schedule/*", "arn:aws:sagemaker:*:*:notebook-instance/*", "arn:aws:sagemaker:*:*:notebook-instance-lifecycle-config/*", "arn:aws:sagemaker:*:*:pipeline/*", "arn:aws:sagemaker:*:*:pipeline/*/execution/*", "arn:aws:sagemaker:*:*:processing-job/*", "arn:aws:sagemaker:*:*:project/*", "arn:aws:sagemaker:*:*:training-job/*", "arn:aws:sagemaker:*:*:transform-job/*", "arn:aws:sagemaker:*:*:workforce/*", "arn:aws:sagemaker:*:*:workteam/*" ] }, { "Sid" : "AmazonSageMakerLambdaPassRolePermission", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": [ "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole" ] }, { "Sid" : "AmazonSageMakerLambdaLogPermission", "Effect": "Allow", "Action": [ "logs:CreateLogDelivery", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DeleteLogDelivery", "logs:DescribeLogGroups", "logs:DescribeLogStreams", "logs:DescribeResourcePolicies", "logs:DescribeDestinations", "logs:DescribeExportTasks", "logs:DescribeMetricFilters", "logs:DescribeQueries", "logs:DescribeQueryDefinitions", "logs:DescribeSubscriptionFilters", "logs:GetLogDelivery", "logs:GetLogEvents", "logs:ListLogDeliveries", "logs:PutLogEvents", "logs:PutResourcePolicy", "logs:UpdateLogDelivery" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*" }, { "Sid" : "AmazonSageMakerLambdaCodeBuildPermission", "Effect": "Allow", "Action": [ "codebuild:StartBuild", "codebuild:BatchGetBuilds" ], "Resource": "arn:aws:codebuild:*:*:project/sagemaker-*", "Condition": { "StringLike": { "aws:ResourceTag/sagemaker:project-name": "*" } } } ] } ``` ------ ## AWS Service Catalog AWS 受管政策的 Amazon SageMaker AI 更新 檢視自此服務開始追蹤 Amazon SageMaker AI AWS 受管政策更新以來的詳細資訊。 | 政策 | 版本 | 變更 | Date | | --- | --- | --- | --- | | [AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy) - 更新的政策 | 10 | 已更新 `codestar-connections:PassConnection`和 `codeconnections:PassConnection`許可。 | 2025 年 9 月 27 日 | | [AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy) - 更新的政策 | 3 | 已更新 `codestar-connections:UseConnection`和 `codeconnections:UseConnection`許可。 | 2025 年 9 月 27 日 | | [AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy) - 更新的政策 | 3 | 已更新 `codestar-connections:UseConnection`和 `codeconnections:UseConnection`許可。 | 2025 年 9 月 27 日 | | [AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy) - 更新的政策 | 9 | 新增 `cloudformation:TagResource`、`cloudformation:UntagResource` 和 `codeconnections:PassConnection` 許可。 | 2024 年 7 月 1 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 7 | 將政策復原至版本 7 (v7)。移除 `cloudformation:TagResource`、`cloudformation:UntagResource` 和 `codeconnections:PassConnection` 許可。 | 2024 年 6 月 12 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 8 | 新增 `cloudformation:TagResource`、`cloudformation:UntagResource` 和 `codeconnections:PassConnection` 許可。 | 2024 年 6 月 11 日 | | [AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy) - 更新的政策 | 2 | 新增 `codestar-connections:UseConnection`和 `codeconnections:UseConnection` 許可。 | 2024 年 6 月 11 日 | | [AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy) - 更新的政策 | 2 | 新增 `cloudformation:TagResource`、`cloudformation:UntagResource`、`codestar-connections:UseConnection` 和 `codeconnections:UseConnection` 許可。 | 2024 年 6 月 11 日 | | [AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy) - 更新的政策 | 2 | 新增 `codebuild:StartBuild`和 `codebuild:BatchGetBuilds` 許可。 | 2024 年 6 月 11 日 | | [AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy) | 1 | 初始政策 | 2023 年 8 月 1 日 | | [AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy) | 1 | 初始政策 | 2023 年 8 月 1 日 | | [AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy) | 1 | 初始政策 | 2023 年 8 月 1 日 | | [AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy) - 更新的政策 | 2 | 新增許可至 `glue:GetUserDefinedFunctions`。 | 2022 年 8 月 26 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 7 | 新增許可至 `sagemaker:AddTags`。 | 2022 年 8 月 2 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 6 | 新增許可至 `lambda:TagResource`。 | 2022 年 7 月 14 日 | | AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy | 1 | 初始政策 | 2022 年 4 月 4 日 | | [AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy) | 1 | 初始政策 | 2022 年 3 月 24 日 | | [AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy) | 1 | 初始政策 | 2022 年 3 月 24 日 | | AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy | 1 | 初始政策 | 2022 年 3 月 24 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 5 | 新增許可至 `ecr-idp:TagResource`。 | 2022 年 3 月 21 日 | | AmazonSageMakerServiceCatalogProductsCodePipelineServiceRolePolicy | 1 | 初始政策 | 2022 年 2 月 22 日 | | [AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsEventsServiceRolePolicy) | 1 | 初始政策 | 2022 年 2 月 22 日 | | [AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy](#security-iam-awsmanpol-AmazonSageMakerServiceCatalogProductsFirehoseServiceRolePolicy) | 1 | 初始政策 | 2022 年 2 月 22 日 | | AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy | 1 | 初始政策 | 2022 年 2 月 22 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 4 | 新增 `cognito-idp:TagResource` 和 `s3:PutBucketCORS` 的許可。 | 2022 年 2 月 16 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 3 | 新增 `sagemaker` 的許可。 建立、讀取、更新和刪除 SageMaker 映像。 | 2021 年 9 月 15 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy - 更新的政策 | 2 | 新增 `sagemaker` 和 `codestar-connections` 的許可。 建立、讀取、更新和刪除程式碼儲存庫。 將 AWS CodeStar 連線傳遞至 AWS CodePipeline。 | 2021 年 7 月 1 日 | | AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy | 1 | 初始政策 | 2020 年 11 月 27 日 |