AWS Documentation » AWS Identity and Access Management » User Guide » Reference Information for AWS Identity and Access Management » IAM JSON Policy Reference » Actions, Resources, and Condition Keys for AWS Services » Actions, Resources, and Condition Keys for Amazon SageMaker

Actions, Resources, and Condition Keys for Amazon SageMaker

Amazon SageMaker (service prefix: sagemaker) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to protect this service and its resources by using IAM permission policies.

Actions Defined by Amazon SageMaker

You can specify the following actions in the Action element of an IAM policy statement. By using policies, you define the permissions for anyone performing an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions. For details about the columns in the following table, see The Actions Table.

Actions	Description	Access Level	Resource Types (*required)	Condition Keys	Dependent Actions
AddTags	Adds or overwrites one or more tags for the specified Amazon SageMaker resource.	Tagging	endpoint*
			endpoint-config*
			hyper-parameter-tuning-job*
			model*
			notebook-instance*
			notebook-instance-lifecycle-config*
			training-job*
			transform-job*
CreateEndpoint	Creates an endpoint using the endpoint configuration specified in the request.	Write	endpoint*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
CreateEndpointConfig	Creates an endpoint configuration that can be deployed using Amazon SageMaker hosting services.	Write	endpoint-config*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
CreateHyperParameterTuningJob	Creates hyper parameter tuning job that can be deployed using Amazon SageMaker.	Write	hyper-parameter-tuning-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
CreateModel	Creates a model in Amazon SageMaker. In the request, you specify a name for the model and describe one or more containers.	Write	model*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
CreateNotebookInstance	Creates an Amazon SageMaker notebook instance. A notebook instance is an Amazon EC2 instance running on a Jupyter Notebook.	Write	notebook-instance*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
CreateNotebookInstanceLifecycleConfig	Creates an notebook instance lifecycle configuration that can be deployed using Amazon SageMaker.	Write	notebook-instance-lifecycle-config*
CreatePresignedNotebookInstanceUrl	Returns a URL that you can use from your browser to connect to the Notebook Instance.	Read	notebook-instance*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
CreateTrainingJob	Starts a model training job. After training completes, Amazon SageMaker saves the resulting model artifacts and other optional output to an Amazon S3 location that you specify.	Write	training-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
CreateTransformJob	Starts a transform job. After the results are obtained, Amazon SageMaker saves them to an Amazon S3 location that you specify.	Write	transform-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DeleteEndpoint	Deletes an endpoint. Amazon SageMaker frees up all the resources that were deployed when the endpoint was created.	Write	endpoint*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DeleteEndpointConfig	Deletes the endpoint configuration created using the CreateEndpointConfig API. The DeleteEndpointConfig API deletes only the specified configuration. It does not delete any endpoints created using the configuration.	Write	endpoint-config*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DeleteModel	Deletes a model created using the CreateModel API. The DeleteModel API deletes only the model entry in Amazon SageMaker that you created by calling the CreateModel API. It does not delete model artifacts, inference code, or the IAM role that you specified when creating the model.	Write	model*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DeleteNotebookInstance	Deletes an Amazon SageMaker notebook instance. Before you can delete a notebook instance, you must call the StopNotebookInstance API.	Write	notebook-instance*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DeleteNotebookInstanceLifecycleConfig	Deletes an notebook instance lifecycle configuration that can be deployed using Amazon SageMaker.	Write	notebook-instance-lifecycle-config*
DeleteTags	Deletes the specified set of tags from an Amazon SageMaker resource.	Tagging	endpoint*
			endpoint-config*
			hyper-parameter-tuning-job*
			model*
			notebook-instance*
			notebook-instance-lifecycle-config*
			training-job*
			transform-job*
DescribeEndpoint	Returns the description of an endpoint.	Read	endpoint*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DescribeEndpointConfig	Returns the description of an endpoint configuration, which was created using the CreateEndpointConfig API.	Read	endpoint-config*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DescribeHyperParameterTuningJob	Describes a hyper parameter tuning job that was created via CreateHyperParameterTuningJob API.	Read	hyper-parameter-tuning-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DescribeModel	Describes a model that you created using the CreateModel API.	Read	model*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DescribeNotebookInstance	Returns information about a notebook instance.	Read	notebook-instance*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DescribeNotebookInstanceLifecycleConfig	Describes an notebook instance lifecycle configuration that was created via CreateNotebookInstanceLifecycleConfig API.	Read	notebook-instance-lifecycle-config*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DescribeTrainingJob	Returns information about a training job.	Read	training-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
DescribeTransformJob	Returns information about a transform job.	Read	transform-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
InvokeEndpoint	After you deploy a model into production using Amazon SageMaker hosting services, your client applications use this API to get inferences from the model hosted at the specified endpoint.	Read	endpoint*
ListEndpointConfigs	Lists endpoint configurations.	List
ListEndpoints	Lists endpoints.	List
ListHyperParameterTuningJobs	Lists hyper parameter tuning jobs that was created using Amazon SageMaker.	List
ListModels	Lists the models created with the CreateModel API.	List
ListNotebookInstanceLifecycleConfigs	Lists notebook instance lifecycle configurations that can be deployed using Amazon SageMaker.	List
ListNotebookInstances	Returns a list of the Amazon SageMaker notebook instances in the requester's account in an AWS Region.	List
ListTags	Returns the tag set associated with the specified resource.	List
ListTrainingJobs	Lists training jobs.	List
ListTrainingJobsForHyperParameterTuningJob	Lists training jobs for a hyper parameter tuning job that was created using Amazon SageMaker.	List	hyper-parameter-tuning-job*
ListTransformJobs	Lists transform jobs.	List
StartNotebookInstance	Launches an EC2 instance with the latest version of the libraries and attaches your EBS volume.	Write	notebook-instance*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
StopHyperParameterTuningJob	Stops a running hyper parameter tuning job create via the CreateHyperParameterTuningJob.	Write	hyper-parameter-tuning-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
StopNotebookInstance	Terminates the EC2 instance. Before terminating the instance, Amazon SageMaker disconnects the EBS volume from it. Amazon SageMaker preserves the EBS volume.	Write	notebook-instance*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
StopTrainingJob	Stops a training job. To stop a job, Amazon SageMaker sends the algorithm the SIGTERM signal, which delays job termination for 120 seconds.	Write	training-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
StopTransformJob	Stops a transform job. When Amazon SageMaker receives a StopTransformJob request, the status of the job changes to Stopping. After Amazon SageMaker stops the job, the status is set to Stopped	Write	transform-job*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
UpdateEndpoint	Updates an endpoint to use the endpoint configuration specified in the request.	Write	endpoint*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
UpdateEndpointWeightsAndCapacities	Updates variant weight, capacity, or both of one or more variants associated with an endpoint.	Write	endpoint*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key
UpdateNotebookInstance	Updates a notebook instance. Notebook instance updates include upgrading or downgrading the EC2 instance used for your notebook instance to accommodate changes in your workload requirements. You can also update the VPC security groups.	Write	notebook-instance*
				aws:RequestTag/tag-key aws:TagKeys sagemaker:ResourceTag/tag-key

Resources Defined by SageMaker

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table.

Resource Types	ARN	Condition Keys
notebook-instance	arn:${Partition}:sagemaker:${Region}:${Account}:notebook-instance/${NotebookInstanceName}
training-job	arn:${Partition}:sagemaker:${Region}:${Account}:training-job/${TrainingJobName}
model	arn:${Partition}:sagemaker:${Region}:${Account}:model/${ModelName}
endpoint-config	arn:${Partition}:sagemaker:${Region}:${Account}:endpoint-config/${EndpointConfigName}
endpoint	arn:${Partition}:sagemaker:${Region}:${Account}:endpoint/${EndpointName}
notebook-instance-lifecycle-config	arn:${Partition}:sagemaker:${Region}:${Account}:notebook-instance-lifecycle-config/${NotebookInstanceLifecycleConfigName}
hyper-parameter-tuning-job	arn:${Partition}:sagemaker:${Region}:${Account}:hyper-parameter-tuning-job/${HyperParameterTuningJobName}
transform-job	arn:${Partition}:sagemaker:${Region}:${Account}:transform-job/${TransformJobName}

Condition Keys for Amazon SageMaker

Amazon SageMaker defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table.

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference.

Condition Keys	Description	Type
aws:RequestTag/tag-key	A key that is present in the request the user makes to the SageMaker service.	String
aws:TagKeys	The list of all the tag key names associated with the resource in the request.	String
sagemaker:ResourceTag/	The preface string for a tag key and value pair attached to a resource.	String
sagemaker:ResourceTag/tag-key	A tag key and value pair.	String