AWS kebijakan terkelola: AmazonDataZoneSageMakerAccess

Kebijakan ini memberikan DataZone izin Amazon untuk memublikasikan SageMaker aset Amazon ke katalog. Ini juga memberikan DataZone izin Amazon untuk memberikan akses atau mencabut akses ke aset yang SageMaker diterbitkan Amazon dalam katalog.

Kebijakan ini mencakup izin untuk melakukan hal berikut:

• cloudtrail — mengambil informasi tentang jalur. CloudTrail

• cloudwatch — mengambil alarm saat ini. CloudWatch

• log — mengambil filter metrik untuk CloudWatch log.

• sns - mengambil daftar langganan ke suatu topik. SNS

• config — mengambil informasi tentang perekam konfigurasi, sumber daya, dan aturan Config AWS . Juga memungkinkan peran terkait layanan untuk membuat dan menghapus aturan AWS Config, dan menjalankan evaluasi terhadap aturan.

• iam — dapatkan dan buat laporan kredensi untuk akun.

• organisasi — mengambil informasi akun dan unit organisasi (OU) untuk suatu organisasi.

• securityhub — mengambil informasi tentang bagaimana layanan, standar, dan kontrol Security Hub dikonfigurasi.

• tag — mengambil informasi tentang tag sumber daya.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AmazonSageMakerReadPermission",
			"Effect": "Allow",
			"Action": [
				"sagemaker:DescribeFeatureGroup",
				"sagemaker:ListModelPackages",
				"sagemaker:DescribeModelPackage",
				"sagemaker:DescribeModelPackageGroup",
				"sagemaker:DescribeAlgorithm",
				"sagemaker:ListTags",
				"sagemaker:DescribeDomain",
				"sagemaker:GetModelPackageGroupPolicy",
				"sagemaker:Search"
			],
			"Resource": "*"
		},
		{
			"Sid": "AmazonSageMakerTaggingPermission",
			"Effect": "Allow",
			"Action": [
				"sagemaker:AddTags",
				"sagemaker:DeleteTags"
			],
			"Resource": "*",
			"Condition": {
				"ForAnyValue:StringLike": {
					"aws:TagKeys": [
						"sagemaker:shared-with:*"
					]
				}
			}
		},
		{
			"Sid": "AmazonSageMakerModelPackageGroupPolicyPermission",
			"Effect": "Allow",
			"Action": [
				"sagemaker:PutModelPackageGroupPolicy",
				"sagemaker:DeleteModelPackageGroupPolicy"
			],
			"Resource": [
				"arn:*:sagemaker:*:*:model-package-group/*"
			]
		},
		{
			"Sid": "AmazonSageMakerRAMPermission",
			"Effect": "Allow",
			"Action": [
				"ram:GetResourceShares",
				"ram:GetResourceShareInvitations",
				"ram:GetResourceShareAssociations"
			],
			"Resource": "*"
		},
		{
			"Sid": "AmazonSageMakerRAMResourcePolicyPermission",
			"Effect": "Allow",
			"Action": [
				"sagemaker:PutResourcePolicy",
				"sagemaker:GetResourcePolicy",
				"sagemaker:DeleteResourcePolicy"
			],
			"Resource": [
				"arn:*:sagemaker:*:*:feature-group/*"
			]
		},
		{
			"Sid": "AmazonSageMakerRAMTagResourceSharePermission",
			"Effect": "Allow",
			"Action": [
				"ram:TagResource"
			],
			"Resource": "arn:*:ram:*:*:resource-share/*",
			"Condition": {
				"Null": {
					"aws:RequestTag/AwsDataZoneDomainId": "false"
				}
			}
		},
		{
			"Sid": "AmazonSageMakerRAMDeleteResourceSharePermission",
			"Effect": "Allow",
			"Action": [
				"ram:DeleteResourceShare"
			],
			"Resource": "arn:*:ram:*:*:resource-share/*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AwsDataZoneDomainId": "false"
				}
			}
		},
		{
			"Sid": "AmazonSageMakerRAMCreateResourceSharePermission",
			"Effect": "Allow",
			"Action": [
				"ram:CreateResourceShare"
			],
			"Resource": "*",
			"Condition": {
				"StringLikeIfExists": {
					"ram:RequestedResourceType": [
						"sagemaker:*"
					]
				},
				"Null": {
					"aws:RequestTag/AwsDataZoneDomainId": "false"
				}
			}
		},
		{
			"Sid": "AmazonSageMakerS3BucketPolicyPermission",
			"Effect": "Allow",
			"Action": [
				"s3:DeleteBucketPolicy",
				"s3:PutBucketPolicy",
				"s3:GetBucketPolicy"
			],
			"Resource": [
				"arn:aws:s3:::sagemaker-datazone*",
				"arn:aws:s3:::SageMaker-DataZone*",
				"arn:aws:s3:::datazone-sagemaker*",
				"arn:aws:s3:::DataZone-SageMaker*",
				"arn:aws:s3:::amazon-datazone*"
			]
		},
		{
			"Sid": "AmazonSageMakerS3Permission",
			"Effect": "Allow",
			"Action": [
				"s3:GetObject",
				"s3:ListBucket"
			],
			"Resource": [
				"arn:aws:s3:::sagemaker-datazone*",
				"arn:aws:s3:::SageMaker-DataZone*",
				"arn:aws:s3:::datazone-sagemaker*",
				"arn:aws:s3:::DataZone-SageMaker*",
				"arn:aws:s3:::amazon-datazone*"
			]
		},
		{
			"Sid": "AmazonSageMakerECRPermission",
			"Effect": "Allow",
			"Action": [
				"ecr:GetRepositoryPolicy",
				"ecr:SetRepositoryPolicy",
				"ecr:DeleteRepositoryPolicy"
			],
			"Resource": "*",
			"Condition": {
				"Null": {
					"aws:ResourceTag/AmazonDataZoneEnvironment": "false"
				}
			}
		},
		{
			"Sid": "AmazonSageMakerKMSReadPermission",
			"Effect": "Allow",
			"Action": [
				"kms:DescribeKey"
			],
			"Resource": "*",
			"Condition": {
				"ForAnyValue:StringEquals": {
					"aws:TagKeys": [
						"AmazonDataZoneEnvironment"
					]
				}
			}
		},
		{
			"Sid": "AmazonSageMakerKMSGrantPermission",
			"Effect": "Allow",
			"Action": [
				"kms:CreateGrant"
			],
			"Resource": "*",
			"Condition": {
				"ForAnyValue:StringEquals": {
					"aws:TagKeys": [
						"AmazonDataZoneEnvironment"
					]
				},
				"ForAllValues:StringEquals": {
					"kms:GrantOperations": [
						"Decrypt"
					]
				}
			}
		}
	]
}