Created
May 6, 2022 05:09
-
-
Save yum-dev/c09aa27eb322b5ba75c1669c61d7c871 to your computer and use it in GitHub Desktop.
AmazonSageMakerFullAccess
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "Version": "2012-10-17", | |
| "Statement": [ | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "sagemaker:*" | |
| ], | |
| "NotResource": [ | |
| "arn:aws:sagemaker:*:*:domain/*", | |
| "arn:aws:sagemaker:*:*:user-profile/*", | |
| "arn:aws:sagemaker:*:*:app/*", | |
| "arn:aws:sagemaker:*:*:flow-definition/*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "sagemaker:CreatePresignedDomainUrl", | |
| "sagemaker:DescribeDomain", | |
| "sagemaker:ListDomains", | |
| "sagemaker:DescribeUserProfile", | |
| "sagemaker:ListUserProfiles", | |
| "sagemaker:*App", | |
| "sagemaker:ListApps" | |
| ], | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "sagemaker:*", | |
| "Resource": [ | |
| "arn:aws:sagemaker:*:*:flow-definition/*" | |
| ], | |
| "Condition": { | |
| "StringEqualsIfExists": { | |
| "sagemaker:WorkteamType": [ | |
| "private-crowd", | |
| "vendor-crowd" | |
| ] | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "application-autoscaling:DeleteScalingPolicy", | |
| "application-autoscaling:DeleteScheduledAction", | |
| "application-autoscaling:DeregisterScalableTarget", | |
| "application-autoscaling:DescribeScalableTargets", | |
| "application-autoscaling:DescribeScalingActivities", | |
| "application-autoscaling:DescribeScalingPolicies", | |
| "application-autoscaling:DescribeScheduledActions", | |
| "application-autoscaling:PutScalingPolicy", | |
| "application-autoscaling:PutScheduledAction", | |
| "application-autoscaling:RegisterScalableTarget", | |
| "aws-marketplace:ViewSubscriptions", | |
| "cloudformation:GetTemplateSummary", | |
| "cloudwatch:DeleteAlarms", | |
| "cloudwatch:DescribeAlarms", | |
| "cloudwatch:GetMetricData", | |
| "cloudwatch:GetMetricStatistics", | |
| "cloudwatch:ListMetrics", | |
| "cloudwatch:PutMetricAlarm", | |
| "cloudwatch:PutMetricData", | |
| "codecommit:BatchGetRepositories", | |
| "codecommit:CreateRepository", | |
| "codecommit:GetRepository", | |
| "codecommit:List*", | |
| "cognito-idp:AdminAddUserToGroup", | |
| "cognito-idp:AdminCreateUser", | |
| "cognito-idp:AdminDeleteUser", | |
| "cognito-idp:AdminDisableUser", | |
| "cognito-idp:AdminEnableUser", | |
| "cognito-idp:AdminRemoveUserFromGroup", | |
| "cognito-idp:CreateGroup", | |
| "cognito-idp:CreateUserPool", | |
| "cognito-idp:CreateUserPoolClient", | |
| "cognito-idp:CreateUserPoolDomain", | |
| "cognito-idp:DescribeUserPool", | |
| "cognito-idp:DescribeUserPoolClient", | |
| "cognito-idp:List*", | |
| "cognito-idp:UpdateUserPool", | |
| "cognito-idp:UpdateUserPoolClient", | |
| "ec2:CreateNetworkInterface", | |
| "ec2:CreateNetworkInterfacePermission", | |
| "ec2:CreateVpcEndpoint", | |
| "ec2:DeleteNetworkInterface", | |
| "ec2:DeleteNetworkInterfacePermission", | |
| "ec2:DescribeDhcpOptions", | |
| "ec2:DescribeNetworkInterfaces", | |
| "ec2:DescribeRouteTables", | |
| "ec2:DescribeSecurityGroups", | |
| "ec2:DescribeSubnets", | |
| "ec2:DescribeVpcEndpoints", | |
| "ec2:DescribeVpcs", | |
| "ecr:BatchCheckLayerAvailability", | |
| "ecr:BatchGetImage", | |
| "ecr:CreateRepository", | |
| "ecr:Describe*", | |
| "ecr:GetAuthorizationToken", | |
| "ecr:GetDownloadUrlForLayer", | |
| "ecr:StartImageScan", | |
| "elastic-inference:Connect", | |
| "elasticfilesystem:DescribeFileSystems", | |
| "elasticfilesystem:DescribeMountTargets", | |
| "fsx:DescribeFileSystems", | |
| "glue:CreateJob", | |
| "glue:DeleteJob", | |
| "glue:GetJob*", | |
| "glue:GetTable*", | |
| "glue:GetWorkflowRun", | |
| "glue:ResetJobBookmark", | |
| "glue:StartJobRun", | |
| "glue:StartWorkflowRun", | |
| "glue:UpdateJob", | |
| "groundtruthlabeling:*", | |
| "iam:ListRoles", | |
| "kms:DescribeKey", | |
| "kms:ListAliases", | |
| "lambda:ListFunctions", | |
| "logs:CreateLogDelivery", | |
| "logs:CreateLogGroup", | |
| "logs:CreateLogStream", | |
| "logs:DeleteLogDelivery", | |
| "logs:Describe*", | |
| "logs:GetLogDelivery", | |
| "logs:GetLogEvents", | |
| "logs:ListLogDeliveries", | |
| "logs:PutLogEvents", | |
| "logs:PutResourcePolicy", | |
| "logs:UpdateLogDelivery", | |
| "robomaker:CreateSimulationApplication", | |
| "robomaker:DescribeSimulationApplication", | |
| "robomaker:DeleteSimulationApplication", | |
| "robomaker:CreateSimulationJob", | |
| "robomaker:DescribeSimulationJob", | |
| "robomaker:CancelSimulationJob", | |
| "secretsmanager:ListSecrets", | |
| "servicecatalog:Describe*", | |
| "servicecatalog:List*", | |
| "servicecatalog:ScanProvisionedProducts", | |
| "servicecatalog:SearchProducts", | |
| "servicecatalog:SearchProvisionedProducts", | |
| "sns:ListTopics", | |
| "tag:GetResources" | |
| ], | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "ecr:SetRepositoryPolicy", | |
| "ecr:CompleteLayerUpload", | |
| "ecr:BatchDeleteImage", | |
| "ecr:UploadLayerPart", | |
| "ecr:DeleteRepositoryPolicy", | |
| "ecr:InitiateLayerUpload", | |
| "ecr:DeleteRepository", | |
| "ecr:PutImage" | |
| ], | |
| "Resource": [ | |
| "arn:aws:ecr:*:*:repository/*sagemaker*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "codecommit:GitPull", | |
| "codecommit:GitPush" | |
| ], | |
| "Resource": [ | |
| "arn:aws:codecommit:*:*:*sagemaker*", | |
| "arn:aws:codecommit:*:*:*SageMaker*", | |
| "arn:aws:codecommit:*:*:*Sagemaker*" | |
| ] | |
| }, | |
| { | |
| "Action": [ | |
| "codebuild:BatchGetBuilds", | |
| "codebuild:StartBuild" | |
| ], | |
| "Resource": [ | |
| "arn:aws:codebuild:*:*:project/sagemaker*", | |
| "arn:aws:codebuild:*:*:build/*" | |
| ], | |
| "Effect": "Allow" | |
| }, | |
| { | |
| "Action": [ | |
| "states:DescribeExecution", | |
| "states:GetExecutionHistory", | |
| "states:StartExecution", | |
| "states:StopExecution", | |
| "states:UpdateStateMachine" | |
| ], | |
| "Resource": [ | |
| "arn:aws:states:*:*:statemachine:*sagemaker*", | |
| "arn:aws:states:*:*:execution:*sagemaker*:*" | |
| ], | |
| "Effect": "Allow" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "secretsmanager:DescribeSecret", | |
| "secretsmanager:GetSecretValue", | |
| "secretsmanager:CreateSecret" | |
| ], | |
| "Resource": [ | |
| "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "secretsmanager:DescribeSecret", | |
| "secretsmanager:GetSecretValue" | |
| ], | |
| "Resource": "*", | |
| "Condition": { | |
| "StringEquals": { | |
| "secretsmanager:ResourceTag/SageMaker": "true" | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "servicecatalog:ProvisionProduct" | |
| ], | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "servicecatalog:TerminateProvisionedProduct", | |
| "servicecatalog:UpdateProvisionedProduct" | |
| ], | |
| "Resource": "*", | |
| "Condition": { | |
| "StringEquals": { | |
| "servicecatalog:userLevel": "self" | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "s3:GetObject", | |
| "s3:PutObject", | |
| "s3:DeleteObject", | |
| "s3:AbortMultipartUpload" | |
| ], | |
| "Resource": [ | |
| "arn:aws:s3:::*SageMaker*", | |
| "arn:aws:s3:::*Sagemaker*", | |
| "arn:aws:s3:::*sagemaker*", | |
| "arn:aws:s3:::*aws-glue*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "s3:GetObject" | |
| ], | |
| "Resource": "*", | |
| "Condition": { | |
| "StringEqualsIgnoreCase": { | |
| "s3:ExistingObjectTag/SageMaker": "true" | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "s3:GetObject" | |
| ], | |
| "Resource": "*", | |
| "Condition": { | |
| "StringEquals": { | |
| "s3:ExistingObjectTag/servicecatalog:provisioning": "true" | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "s3:CreateBucket", | |
| "s3:GetBucketLocation", | |
| "s3:ListBucket", | |
| "s3:ListAllMyBuckets", | |
| "s3:GetBucketCors", | |
| "s3:PutBucketCors" | |
| ], | |
| "Resource": "*" | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "s3:GetBucketAcl", | |
| "s3:PutObjectAcl" | |
| ], | |
| "Resource": [ | |
| "arn:aws:s3:::*SageMaker*", | |
| "arn:aws:s3:::*Sagemaker*", | |
| "arn:aws:s3:::*sagemaker*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "lambda:InvokeFunction" | |
| ], | |
| "Resource": [ | |
| "arn:aws:lambda:*:*:function:*SageMaker*", | |
| "arn:aws:lambda:*:*:function:*sagemaker*", | |
| "arn:aws:lambda:*:*:function:*Sagemaker*", | |
| "arn:aws:lambda:*:*:function:*LabelingFunction*" | |
| ] | |
| }, | |
| { | |
| "Action": "iam:CreateServiceLinkedRole", | |
| "Effect": "Allow", | |
| "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", | |
| "Condition": { | |
| "StringLike": { | |
| "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com" | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": "iam:CreateServiceLinkedRole", | |
| "Resource": "*", | |
| "Condition": { | |
| "StringEquals": { | |
| "iam:AWSServiceName": "robomaker.amazonaws.com" | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "sns:Subscribe", | |
| "sns:CreateTopic", | |
| "sns:Publish" | |
| ], | |
| "Resource": [ | |
| "arn:aws:sns:*:*:*SageMaker*", | |
| "arn:aws:sns:*:*:*Sagemaker*", | |
| "arn:aws:sns:*:*:*sagemaker*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "iam:PassRole" | |
| ], | |
| "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*", | |
| "Condition": { | |
| "StringEquals": { | |
| "iam:PassedToService": [ | |
| "glue.amazonaws.com", | |
| "robomaker.amazonaws.com", | |
| "states.amazonaws.com" | |
| ] | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "iam:PassRole" | |
| ], | |
| "Resource": "arn:aws:iam::*:role/*", | |
| "Condition": { | |
| "StringEquals": { | |
| "iam:PassedToService": "sagemaker.amazonaws.com" | |
| } | |
| } | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "athena:ListDataCatalogs", | |
| "athena:ListDatabases", | |
| "athena:ListTableMetadata", | |
| "athena:GetQueryExecution", | |
| "athena:GetQueryResults", | |
| "athena:StartQueryExecution", | |
| "athena:StopQueryExecution" | |
| ], | |
| "Resource": [ | |
| "*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "glue:CreateTable" | |
| ], | |
| "Resource": [ | |
| "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", | |
| "arn:aws:glue:*:*:table/sagemaker_featurestore/*", | |
| "arn:aws:glue:*:*:catalog", | |
| "arn:aws:glue:*:*:database/*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "glue:DeleteTable" | |
| ], | |
| "Resource": [ | |
| "arn:aws:glue:*:*:table/*/sagemaker_tmp_*", | |
| "arn:aws:glue:*:*:catalog", | |
| "arn:aws:glue:*:*:database/*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "glue:GetDatabases", | |
| "glue:GetTable", | |
| "glue:GetTables" | |
| ], | |
| "Resource": [ | |
| "arn:aws:glue:*:*:table/*", | |
| "arn:aws:glue:*:*:catalog", | |
| "arn:aws:glue:*:*:database/*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "glue:CreateDatabase", | |
| "glue:GetDatabase" | |
| ], | |
| "Resource": [ | |
| "arn:aws:glue:*:*:catalog", | |
| "arn:aws:glue:*:*:database/sagemaker_featurestore", | |
| "arn:aws:glue:*:*:database/sagemaker_processing", | |
| "arn:aws:glue:*:*:database/default", | |
| "arn:aws:glue:*:*:database/sagemaker_data_wrangler" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "redshift-data:ExecuteStatement", | |
| "redshift-data:DescribeStatement", | |
| "redshift-data:CancelStatement", | |
| "redshift-data:GetStatementResult", | |
| "redshift-data:ListSchemas", | |
| "redshift-data:ListTables" | |
| ], | |
| "Resource": [ | |
| "*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "redshift:GetClusterCredentials" | |
| ], | |
| "Resource": [ | |
| "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*", | |
| "arn:aws:redshift:*:*:dbname:*" | |
| ] | |
| }, | |
| { | |
| "Effect": "Allow", | |
| "Action": [ | |
| "cloudformation:ListStackResources" | |
| ], | |
| "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" | |
| } | |
| ] | |
| } |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment