Le traduzioni sono generate tramite traduzione automatica. In caso di conflitto tra il contenuto di una traduzione e la versione originale in Inglese, quest'ultima prevarrà.
SageMakerStudioUserIAMDefaultExecutionPolicy
Descrizione: politica di esecuzione per l'utilizzo dei ruoli IAM con SageMaker Unified Studio. Consente agli utenti di accedere alle risorse dell'account locale (escluso l'accesso alle risorse di dati) per l'utilizzo basato su IAM di SageMaker Unified Studio.
SageMakerStudioUserIAMDefaultExecutionPolicyè una politica AWS gestita.
Utilizzo di questa politica
Puoi collegarti SageMakerStudioUserIAMDefaultExecutionPolicy ai tuoi utenti, gruppi e ruoli.
Dettagli della politica
-
Tipo: politica AWS gestita
-
Ora di creazione: 18 agosto 2025, 17:19 UTC
-
Ora modificata: 26 agosto 2025, 21:34 UTC
-
ARN:
arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy
Versione della politica
Versione della politica: v2 (predefinita)
La versione predefinita della politica è la versione che definisce le autorizzazioni per la politica. Quando un utente o un ruolo con la politica effettua una richiesta di accesso a una AWS risorsa, AWS controlla la versione predefinita della politica per determinare se consentire la richiesta.
Documento di policy JSON
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "DataZone", "Effect" : "Allow", "Action" : [ "datazone:CreateAsset*", "datazone:CreateConnection", "datazone:CreateProject", "datazone:DeleteAsset*", "datazone:DeleteConnection", "datazone:DeleteProject", "datazone:Get*", "datazone:List*", "datazone:PostLineageEvent", "datazone:Search", "datazone:SearchListings", "datazone:SearchUserProfiles", "datazone:UpdateAssetFilter", "datazone:UpdateConnection", "datazone:UpdateProject" ], "Resource" : "*" }, { "Sid" : "IamSts", "Effect" : "Allow", "Action" : [ "iam:GetRole", "iam:ListRoles", "sts:AssumeRole" ], "Resource" : "*" }, { "Sid" : "CreateSLR", "Effect" : "Allow", "Action" : "iam:CreateServiceLinkedRole", "Resource" : [ "arn:aws:iam::*:role/aws-service-role/neptune-graph.amazonaws.com/AWSServiceRoleForNeptuneGraph", "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift", "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks", "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless", "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA", "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup", "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint", "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless" ] }, { "Sid" : "TagSession", "Effect" : "Allow", "Action" : "sts:TagSession", "Resource" : "*", "Condition" : { "ForAllValues:StringLike" : { "aws:TagKeys" : [ "AmazonDataZone*" ] } } }, { "Sid" : "SourceIdentity", "Effect" : "Allow", "Action" : "sts:SetSourceIdentity", "Resource" : "*", "Condition" : { "StringLike" : { "sts:SourceIdentity" : "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid" : "Q", "Effect" : "Allow", "Action" : [ "glue:StartCompletion", "q:Get*", "q:List*", "q:PassRequest", "q:SendMessage", "q:StartConversation" ], "Resource" : "*" }, { "Sid" : "SSM", "Effect" : "Allow", "Action" : [ "ssm:GetParameter*" ], "Resource" : [ "arn:aws:ssm:*:*:parameter/amazon/datazone/q*", "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/*", "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*" ] }, { "Sid" : "SageMakerUserTagPermissions", "Effect" : "Allow", "Action" : [ "sagemaker:CreatePresignedDomainUrl", "sagemaker:CreateUserProfile", "sagemaker:DeleteUserProfile" ], "Resource" : "arn:aws:sagemaker:*:*:user-profile/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/AmazonDataZoneUser" : "${aws:PrincipalTag/datazone:userId}" } } }, { "Sid" : "SageMakerPrivateSpace", "Effect" : "Allow", "Action" : [ "sagemaker:CreateApp", "sagemaker:CreateSpace", "sagemaker:DeleteApp", "sagemaker:DeleteSpace", "sagemaker:UpdateSpace" ], "Resource" : [ "arn:aws:sagemaker:*:*:space/*", "arn:aws:sagemaker:*:*:app/*" ], "Condition" : { "StringEquals" : { "aws:ResourceTag/AmazonDataZoneUser" : "${aws:PrincipalTag/datazone:userId}", "sagemaker:SpaceSharingType" : [ "Private" ] } } }, { "Sid" : "ResourceGroupsPermissions", "Effect" : "Allow", "Action" : [ "resource-groups:GetGroupQuery", "resource-groups:ListGroupResources" ], "Resource" : "*" }, { "Sid" : "SageMakerPermissions", "Effect" : "Allow", "Action" : [ "sagemaker:Batch*", "sagemaker:Describe*", "sagemaker:List*", "sagemaker:Search", "sagemaker:*Endpoint*", "sagemaker:*Model*", "sagemaker:*InferenceComponent*", "sagemaker:*Job*" ], "Resource" : "*" }, { "Sid" : "SageMakerTagPermissions", "Effect" : "Allow", "Action" : [ "sagemaker:AddTags", "sagemaker:DeleteTags" ], "Resource" : "*", "Condition" : { "ForAllValues:StringNotLike" : { "aws:TagKeys" : [ "AmazonDataZone*", "sagemaker:shared-with:*" ] }, "ForAllValues:StringLike" : { "aws:TagKeys" : [ "ProjectUserTag*", "sagemaker*", "sm-jumpstart*", "endpoint-has-jumpstart-model" ] } } }, { "Sid" : "LogsAndMetrics", "Effect" : "Allow", "Action" : [ "cloudwatch:PutMetricData", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:Describe*", "logs:Get*", "logs:PutLogEvents", "logs:StopQuery" ], "Resource" : "*" }, { "Sid" : "Glue", "Effect" : "Allow", "Action" : [ "glue:CancelStatement", "glue:CreateSession", "glue:DeleteSession", "glue:CreateCatalog", "glue:Describe*", "glue:Get*", "glue:List*", "glue:NotifyEvent", "glue:RunStatement", "glue:StartCompletion", "glue:StopSession", "glue:UseGlueStudio", "glue:TagResource", "glue:*Job*" ], "Resource" : "*" }, { "Sid" : "GlueDatabase", "Effect" : "Allow", "Action" : [ "glue:*" ], "Resource" : [ "arn:aws:glue:*:*:database/*", "arn:aws:glue:*:*:table/*", "arn:aws:glue:*:*:catalog", "arn:aws:glue:*:*:catalog/*" ] }, { "Sid" : "GlueLakeFormation", "Effect" : "Allow", "Action" : [ "glue:*" ], "Resource" : "*", "Condition" : { "StringEquals" : { "glue:LakeFormationPermissions" : "Enabled" } } }, { "Sid" : "LFAccess", "Effect" : "Allow", "Action" : [ "lakeformation:DescribeResource", "lakeformation:GetDataAccess", "lakeformation:ListResources" ], "Resource" : "*" }, { "Sid" : "SQLWorkBench", "Effect" : "Allow", "Action" : [ "sqlworkbench:*" ], "Resource" : "*" }, { "Sid" : "RedshiftData", "Effect" : "Allow", "Action" : "redshift-data:*", "Resource" : "*", "Condition" : { "StringEquals" : { "redshift-data:statement-owner-iam-userid" : "${aws:userid}" } } }, { "Sid" : "RedShiftActions", "Effect" : "Allow", "Action" : [ "redshift-data:BatchExecuteStatement", "redshift-data:Describe*", "redshift-data:ExecuteStatement", "redshift-data:List*", "redshift-serverless:GetManagedWorkgroup", "redshift-serverless:GetNamespace", "redshift-serverless:GetWorkgroup", "redshift-serverless:List*", "redshift:Describe*" ], "Resource" : "*" }, { "Sid" : "Bedrock", "Effect" : "Allow", "Action" : "bedrock:*", "Resource" : "*" }, { "Sid" : "PassRole", "Effect" : "Allow", "Action" : [ "iam:PassRole" ], "Resource" : "arn:aws:iam::*:role/${aws:PrincipalTag/AmazonDataZonePassedRolePath}", "Condition" : { "StringEquals" : { "iam:PassedToService" : [ "bedrock.amazonaws.com", "glue.amazonaws.com", "lakeformation.amazonaws.com", "sagemaker.amazonaws.com", "scheduler.amazonaws.com" ], "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "S3List", "Effect" : "Allow", "Action" : [ "s3:GetBucketAcl", "s3:List*" ], "Resource" : "*" }, { "Sid" : "S3CrossAccount", "Effect" : "Allow", "Action" : [ "s3:GetObject*" ], "Resource" : "*", "Condition" : { "StringNotEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "Scheduler", "Effect" : "Allow", "Action" : [ "scheduler:CreateSchedule", "scheduler:DeleteSchedule", "scheduler:Get*", "scheduler:List*", "scheduler:UpdateSchedule" ], "Resource" : "*" }, { "Sid" : "FederatedConn", "Effect" : "Allow", "Action" : [ "dynamodb:List*", "dynamodb:Describe*", "dynamodb:Scan", "dynamodb:PartiQLSelect", "dynamodb:Query", "secretsmanager:ListSecrets" ], "Resource" : "*" }, { "Sid" : "Athena", "Effect" : "Allow", "Action" : [ "athena:BatchGet*", "athena:CreateNamedQuery", "athena:CreateNotebook", "athena:CreatePreparedStatement", "athena:CreatePresignedNotebookUrl", "athena:DeleteNamedQuery", "athena:DeleteNotebook", "athena:DeletePreparedStatement", "athena:ExportNotebook", "athena:Get*", "athena:ImportNotebook", "athena:List*", "athena:StartCalculationExecution", "athena:StartQueryExecution", "athena:StartSession", "athena:StopCalculationExecution", "athena:StopQueryExecution", "athena:TerminateSession", "athena:UpdateNamedQuery", "athena:UpdateNotebook", "athena:UpdateNotebookMetadata", "athena:UpdatePreparedStatement" ], "Resource" : "*" }, { "Sid" : "PrivateSecret", "Effect" : "Allow", "Action" : [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/AmazonDataZoneProject" : "${datazone:projectId}" } } }, { "Sid" : "SharedSecret", "Effect" : "Allow", "Action" : [ "secretsmanager:DescribeSecret", "secretsmanager:GetSecretValue" ], "Resource" : "*", "Condition" : { "StringEquals" : { "aws:ResourceTag/for-use-with-all-datazone-projects" : "true" } } }, { "Sid" : "GenerateRecommendations", "Effect" : "Allow", "Action" : [ "codewhisperer:GenerateRecommendations" ], "Resource" : "*" }, { "Sid" : "Ecr", "Effect" : "Allow", "Action" : [ "ecr:BatchCheckLayerAvailability", "ecr:BatchGetImage", "ecr:DescribeImages", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer" ], "Resource" : "*" } ] }
Ulteriori informazioni
