Amazon Bedrock Studio のプロビジョニングロールを作成する

Amazon Bedrock Studio は Amazon Bedrock のプレビューリリースであり、変更される可能性があります。

Amazon Bedrock Studio がガードレールコンポーネントなどのリソースをユーザーアカウントに作成できるようにするには、プロビジョニングロールを作成する必要があります。

Amazon Bedrock Studio のプロビジョニングロールを使用するには、IAMAWS 「 サービスにアクセス許可を委任するロールの作成」の手順に従って、 ロールを作成し、次のアクセス許可をアタッチします。

信頼関係

次のポリシーでは、Amazon Bedrock がこのロールを引き受け、Amazon Bedrock Studio がユーザーのアカウントで Bedrock Studio リソースを管理できるようにします。

• aws:SourceAccount の値をアカウント ID に設定します。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "datazone.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "account ID"
        }
      }
    }
  ]
}

Amazon Bedrock Studio ユーザーリソースを管理するアクセス許可

Amazon Bedrock Studio プロビジョニングロールのデフォルトポリシー。このポリシーは、プリンシパルが Amazon と を使用して Amazon Bedrock Studio で AWS リソースを作成、更新 DataZone 、削除することを許可します AWS CloudFormation。

このポリシーは、以下のアクセス許可のセットで構成されます。

• cloudformation — プリンシパルが Amazon Bedrock Studio リソースを Amazon DataZone 環境の一部としてプロビジョニングするための CloudFormation スタックを作成および管理できるようにします。

• iam — プリンシパルが を使用して Amazon Bedrock Studio のアクセス許可の境界を持つIAMロールを作成、管理、および渡すことを許可します AWS CloudFormation。

• s3 — プリンシパルが を使用して Amazon Bedrock Studio の Amazon S3 バケットを作成および管理できるようにします AWS CloudFormation。

• aoss — プリンシパルが を使用して Amazon Bedrock Studio の Amazon OpenSearch Serverless コレクションを作成および管理できるようにします AWS CloudFormation。

• bedrock — プリンシパルが を使用して Amazon Bedrock Studio の Amazon Bedrock エージェント、ナレッジベース、ガードレール、プロンプト、フローを作成および管理できるようにします AWS CloudFormation。

• lambda — プリンシパルが を使用して Amazon Bedrock Studio の AWS Lambda 関数を作成、管理、および呼び出すことを許可します AWS CloudFormation。

• logs — プリンシパルが を使用して Amazon Bedrock Studio の Amazon CloudWatch ロググループを作成および管理できるようにします AWS CloudFormation。

• secretsmanager — プリンシパルが を使用して Amazon Bedrock Studio の AWS Secrets Manager シークレットを作成および管理できるようにします AWS CloudFormation。

• kms — を使用して Amazon Bedrock 向けのカスタマーマネージドキーを使用してプロビジョニングされたリソースを暗号化 AWS KMS するための へのアクセスを許可します AWS CloudFormation。

このポリシーのサイズにより、ポリシーをインラインポリシーとしてアタッチする必要があります。手順については、ステップ 2: アクセス許可の境界、サービスロール、プロビジョニングロールを作成する を参照してください。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack",
        "cloudformation:TagResource"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/DataZone*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:TagKeys": "AmazonDataZoneEnvironment"
        },
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "ManageStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/DataZone*"
    },
    {
      "Sid": "DenyOtherActionsNotViaCloudFormation",
      "Effect": "Deny",
      "NotAction": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:CreateStack",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack",
        "cloudformation:TagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEqualsIfExists": {
          "aws:CalledViaFirst": "cloudformation.amazonaws.com"
        }
      }
    },
    {
      "Sid": "ListResources",
      "Effect": "Allow",
      "Action": [
        "iam:ListRoles",
        "s3:ListAllMyBuckets",
        "aoss:ListCollections",
        "aoss:BatchGetCollection",
        "aoss:ListAccessPolicies",
        "aoss:ListSecurityPolicies",
        "aoss:ListTagsForResource",
        "bedrock:ListAgents",
        "bedrock:ListKnowledgeBases",
        "bedrock:ListGuardrails",
        "bedrock:ListPrompts",
        "bedrock:ListFlows",
        "bedrock:ListTagsForResource",
        "lambda:ListFunctions",
        "logs:DescribeLogGroups",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GetRoles",
      "Effect": "Allow",
      "Action": "iam:GetRole",
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ]
    },
    {
      "Sid": "CreateRoles",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole",
        "iam:PutRolePolicy",
        "iam:AttachRolePolicy",
        "iam:DeleteRolePolicy",
        "iam:DetachRolePolicy"
      ],
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "ManageRoles",
      "Effect": "Allow",
      "Action": [
        "iam:UpdateRole",
        "iam:DeleteRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:ListAttachedRolePolicies"
      ],
      "Resource": [
        "arn:aws:iam::*:role/DataZoneBedrockProject*",
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "PassRoleToBedrockService",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/AmazonBedrockExecution*",
        "arn:aws:iam::*:role/BedrockStudio*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "bedrock.amazonaws.com"
        }
      }
    },
    {
      "Sid": "PassRoleToLambdaService",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::*:role/BedrockStudio*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "lambda.amazonaws.com"
        }
      }
    },
    {
      "Sid": "CreateRoleForOpenSearchServerless",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "iam:AWSServiceName": "observability.aoss.amazonaws.com"
        }
      }
    },
    {
      "Sid": "GetDataZoneBlueprintCfnTemplates",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "s3:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CreateAndAccessS3Buckets",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucketPolicy",
        "s3:PutBucketPolicy",
        "s3:DeleteBucketPolicy",
        "s3:PutBucketTagging",
        "s3:PutBucketCORS",
        "s3:PutBucketLogging",
        "s3:PutBucketVersioning",
        "s3:PutBucketPublicAccessBlock",
        "s3:PutEncryptionConfiguration",
        "s3:PutLifecycleConfiguration",
        "s3:GetObject",
        "s3:GetObjectVersion"
      ],
      "Resource": "arn:aws:s3:::br-studio-*"
    },
    {
      "Sid": "ManageOssAccessPolicies",
      "Effect": "Allow",
      "Action": [
        "aoss:GetAccessPolicy",
        "aoss:CreateAccessPolicy",
        "aoss:DeleteAccessPolicy",
        "aoss:UpdateAccessPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "StringLikeIfExists": {
          "aoss:collection": "br-studio-*",
          "aoss:index": "br-studio-*"
        }
      }
    },
    {
      "Sid": "ManageOssSecurityPolicies",
      "Effect": "Allow",
      "Action": [
        "aoss:GetSecurityPolicy",
        "aoss:CreateSecurityPolicy",
        "aoss:DeleteSecurityPolicy",
        "aoss:UpdateSecurityPolicy"
      ],
      "Resource": "*",
      "Condition": {
        "StringLikeIfExists": {
          "aoss:collection": "br-studio-*"
        }
      }
    },
    {
      "Sid": "ManageOssCollections",
      "Effect": "Allow",
      "Action": [
        "aoss:CreateCollection",
        "aoss:UpdateCollection",
        "aoss:DeleteCollection"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "GetBedrockResources",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetAgent",
        "bedrock:GetKnowledgeBase",
        "bedrock:GetGuardrail",
        "bedrock:GetPrompt",
        "bedrock:GetFlow",
        "bedrock:GetFlowAlias"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ManageBedrockResources",
      "Effect": "Allow",
      "Action": [
        "bedrock:CreateAgent",
        "bedrock:UpdateAgent",
        "bedrock:PrepareAgent",
        "bedrock:DeleteAgent",
        "bedrock:ListAgentAliases",
        "bedrock:GetAgentAlias",
        "bedrock:CreateAgentAlias",
        "bedrock:UpdateAgentAlias",
        "bedrock:DeleteAgentAlias",
        "bedrock:ListAgentActionGroups",
        "bedrock:GetAgentActionGroup",
        "bedrock:CreateAgentActionGroup",
        "bedrock:UpdateAgentActionGroup",
        "bedrock:DeleteAgentActionGroup",
        "bedrock:ListAgentKnowledgeBases",
        "bedrock:GetAgentKnowledgeBase",
        "bedrock:AssociateAgentKnowledgeBase",
        "bedrock:DisassociateAgentKnowledgeBase",
        "bedrock:UpdateAgentKnowledgeBase",
        "bedrock:CreateKnowledgeBase",
        "bedrock:UpdateKnowledgeBase",
        "bedrock:DeleteKnowledgeBase",
        "bedrock:ListDataSources",
        "bedrock:GetDataSource",
        "bedrock:CreateDataSource",
        "bedrock:UpdateDataSource",
        "bedrock:DeleteDataSource",
        "bedrock:CreateGuardrail",
        "bedrock:UpdateGuardrail",
        "bedrock:DeleteGuardrail",
        "bedrock:CreateGuardrailVersion",
        "bedrock:CreatePrompt",
        "bedrock:UpdatePrompt",
        "bedrock:DeletePrompt",
        "bedrock:CreatePromptVersion",
        "bedrock:CreateFlow",
        "bedrock:UpdateFlow",
        "bedrock:PrepareFlow",
        "bedrock:DeleteFlow",
        "bedrock:ListFlowAliases",
        "bedrock:GetFlowAlias",
        "bedrock:CreateFlowAlias",
        "bedrock:UpdateFlowAlias",
        "bedrock:DeleteFlowAlias",
        "bedrock:ListFlowVersions",
        "bedrock:GetFlowVersion",
        "bedrock:CreateFlowVersion",
        "bedrock:DeleteFlowVersion"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "TagBedrockAgentAliases",
      "Effect": "Allow",
      "Action": "bedrock:TagResource",
      "Resource": "arn:aws:bedrock:*:*:agent-alias/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/AmazonBedrockManaged": "true"
        }
      }
    },
    {
      "Sid": "TagBedrockFlowAliases",
      "Effect": "Allow",
      "Action": "bedrock:TagResource",
      "Resource": "arn:aws:bedrock:*:*:flow/*/alias/*",
      "Condition": {
        "Null": {
          "aws:RequestTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "CreateFunctions",
      "Effect": "Allow",
      "Action": [
        "lambda:GetFunction",
        "lambda:CreateFunction",
        "lambda:InvokeFunction",
        "lambda:DeleteFunction",
        "lambda:UpdateFunctionCode",
        "lambda:GetFunctionConfiguration",
        "lambda:UpdateFunctionConfiguration",
        "lambda:ListVersionsByFunction",
        "lambda:PublishVersion",
        "lambda:GetPolicy",
        "lambda:AddPermission",
        "lambda:RemovePermission",
        "lambda:ListTags"
      ],
      "Resource": "arn:aws:lambda:*:*:function:br-studio-*"
    },
    {
      "Sid": "ManageLogGroups",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:DeleteLogGroup",
        "logs:PutRetentionPolicy",
        "logs:DeleteRetentionPolicy",
        "logs:GetDataProtectionPolicy",
        "logs:PutDataProtectionPolicy",
        "logs:DeleteDataProtectionPolicy",
        "logs:AssociateKmsKey",
        "logs:DisassociateKmsKey",
        "logs:ListTagsLogGroup",
        "logs:ListTagsForResource"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/br-studio-*"
    },
    {
      "Sid": "GetRandomPasswordForSecret",
      "Effect": "Allow",
      "Action": "secretsmanager:GetRandomPassword",
      "Resource": "*"
    },
    {
      "Sid": "ManageSecrets",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:GetResourcePolicy",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:DeleteResourcePolicy"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:br-studio/*"
    },
    {
      "Sid": "UseCustomerManagedKmsKey",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Encrypt",
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "kms:CreateGrant",
        "kms:RetireGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/EnableBedrock": "true"
        }
      }
    },
    {
      "Sid": "TagResources",
      "Effect": "Allow",
      "Action": [
        "iam:TagRole",
        "iam:UntagRole",
        "aoss:TagResource",
        "aoss:UntagResource",
        "bedrock:TagResource",
        "bedrock:UntagResource",
        "lambda:TagResource",
        "lambda:UntagResource",
        "logs:TagLogGroup",
        "logs:UntagLogGroup",
        "logs:TagResource",
        "logs:UntagResource",
        "secretsmanager:TagResource",
        "secretsmanager:UntagResource"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonBedrockManaged": "true"
        }
      }
    }
  ]
}