Le traduzioni sono generate tramite traduzione automatica. In caso di conflitto tra il contenuto di una traduzione e la versione originale in Inglese, quest'ultima prevarrà.
SageMakerStudioBedrockChatAgentUserRolePolicy
Descrizione: fornisce l'accesso alla configurazione di un'app di chat di Amazon Bedrock e all'agente Amazon Bedrock in SageMaker Studio.
SageMakerStudioBedrockChatAgentUserRolePolicyè una policy AWS gestita.
Utilizzo di questa politica
È possibile associare la policy SageMakerStudioBedrockChatAgentUserRolePolicy a utenti, gruppi e ruoli.
Dettagli della policy
-
Tipo: politica relativa al ruolo del servizio
-
Ora di creazione: 13 febbraio 2025, 23:52 UTC
-
Ora modificata: 12 febbraio 2026, 17:57 UTC
-
ARN:
arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockChatAgentUserRolePolicy
Versione della politica
Versione della politica: v3 (impostazione predefinita)
La versione predefinita della policy è la versione che definisce le autorizzazioni per la policy. Quando un utente o un ruolo con la policy effettua una richiesta di accesso a una AWS risorsa, AWS controlla la versione predefinita della policy per determinare se consentire la richiesta.
Documento sulla politica JSON
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "BedrockGetAgentAliasPermissions", "Effect" : "Allow", "Action" : "bedrock:GetAgentAlias", "Resource" : "arn:aws:bedrock:*:*:agent-alias/${aws:PrincipalTag/AgentId}/${aws:PrincipalTag/AgentAliasId}", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject" : "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid" : "BedrockInvokeAgentPermissions", "Effect" : "Allow", "Action" : "bedrock:InvokeAgent", "Resource" : "arn:aws:bedrock:*:*:agent-alias/${aws:PrincipalTag/AgentId}/${aws:PrincipalTag/AgentAliasId}", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject" : "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid" : "BedrockGetAndListAgentMetadataPermissions", "Effect" : "Allow", "Action" : [ "bedrock:GetAgent", "bedrock:GetAgentActionGroup", "bedrock:GetAgentKnowledgeBase", "bedrock:GetAgentVersion", "bedrock:ListAgentActionGroups", "bedrock:ListAgentAliases", "bedrock:ListAgentKnowledgeBases", "bedrock:ListAgentVersions" ], "Resource" : "arn:aws:bedrock:*:*:agent/${aws:PrincipalTag/AgentId}", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject" : "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid" : "S3ListAppDefinitionPermissions", "Effect" : "Allow", "Action" : "s3:ListBucket", "Resource" : "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition" : { "StringEquals" : { "s3:prefix" : "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AppDefinitionPath}", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringNotEquals" : { "aws:PrincipalTag/DomainBucketName" : "", "aws:PrincipalTag/AmazonDataZoneDomain" : "", "aws:PrincipalTag/AmazonDataZoneProject" : "", "aws:PrincipalTag/AppDefinitionPath" : "" } } }, { "Sid" : "S3GetAppDefinitionPermissions", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource" : "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AppDefinitionPath}", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringNotEquals" : { "aws:PrincipalTag/DomainBucketName" : "", "aws:PrincipalTag/AmazonDataZoneDomain" : "", "aws:PrincipalTag/AmazonDataZoneProject" : "", "aws:PrincipalTag/AppDefinitionPath" : "" } } }, { "Sid" : "S3ListDataSourcePermissions", "Effect" : "Allow", "Action" : "s3:ListBucket", "Resource" : "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition" : { "StringEquals" : { "s3:prefix" : "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/DataSourcePath}", "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringNotEquals" : { "aws:PrincipalTag/DomainBucketName" : "", "aws:PrincipalTag/AmazonDataZoneDomain" : "", "aws:PrincipalTag/AmazonDataZoneProject" : "", "aws:PrincipalTag/DataSourcePath" : "" } } }, { "Sid" : "S3GetDataSourcePermissions", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource" : "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/DataSourcePath}", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringNotEquals" : { "aws:PrincipalTag/DomainBucketName" : "", "aws:PrincipalTag/AmazonDataZoneDomain" : "", "aws:PrincipalTag/AmazonDataZoneProject" : "", "aws:PrincipalTag/DataSourcePath" : "" } } }, { "Sid" : "BedrockAgentKmsPermissions", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition" : { "StringLike" : { "kms:ViaService" : "bedrock.*.amazonaws.com", "kms:EncryptionContext:aws:bedrock:arn" : "arn:aws:bedrock:*:${aws:PrincipalAccount}:agent/${aws:PrincipalTag/AgentId}" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "S3KmsPermissions", "Effect" : "Allow", "Action" : "kms:Decrypt", "Resource" : "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition" : { "StringLike" : { "kms:ViaService" : "s3.*.amazonaws.com" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ArnLike" : { "kms:EncryptionContext:aws:s3:arn" : [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } } ] }
Ulteriori informazioni
