Amazon SageMaker API 권한: 작업, 권한 및 리소스 참조

IAM 자격 증명에 연결할 수 있는 액세스 컨트롤 설정 및 권한 정책(자격 증명 기반 정책) 작성 시 다음 표를 참조하십시오. 표에는 각 Amazon SageMaker API 작업, 작업 수행 권한을 부여할 수 있는 해당 작업, 권한을 부여할 수 있는 AWS 리소스가 나열되어 있습니다. 정책의 Action필드에서 작업을 지정하고, 정책의 Resource필드에서 리소스 값을 지정합니다.

참고

ListTags API를 제외하고 리소스 수준 제한은 List-호출에서 사용할 수 없습니다. List- API를 호출하는 사용자는 계정 내에서 이러한 유형의 모든 리소스를 보게 됩니다.

Amazon SageMaker 정책에 조건을 표현하기 위해 AWS -wide 조건 키를 사용할 수 있습니다. AWS 전체 키의 전체 목록은 IAM 사용 설명서의 사용 가능한 키를 참조하세요.

주의

일부 SageMaker API 작업은 를 통해 계속 액세스할 수 있습니다. Search API 예를 들어 특정 SageMaker 리소스에 대한 Describe 호출 권한을 거부하는 IAM 정책이 있는 사용자라도 Search API를 통해 설명 정보에 계속 액세스할 수 있습니다. Describe 호출에 대한 사용자 액세스를 완전히 제한하려면 Search API에 대한 액세스도 제한해야 합니다. 검색 API를 통해 액세스할 수 있는 SageMaker 리소스 목록은 SageMaker 검색 AWS CLI 명령 참조를 참조하십시오.

스크롤 막대를 사용하여 표의 나머지 부분을 확인합니다.

Amazon SageMaker API 작업 및 작업에 필요한 권한
아마존 SageMaker API 오퍼레이션	필수 권한 (API 작업)	리소스
DeleteEarthObservationJob	sagemaker-geospatial:DeleteEarthObservationJob	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id
DeleteVectorEnrichmentJob	sagemaker-geospatial:DeleteVectorEnrichmentJob	arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
ExportEarthObservationJob	sagemaker-geospatial:ExportEarthObservationJob	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id
ExportVectorEnrichmentJob	sagemaker-geospatial:ExportVectorEnrichmentJob	arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
GetEarthObservationJob	sagemaker-geospatial:GetEarthObservationJob	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id
GetRasterDataCollection	sagemaker-geospatial:GetRasterDataCollection	arn:aws:sagemaker-geospatial:region:account-id:raster-data-collection/public/id
GetTile	sagemaker-geospatial:GetTile	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id
GetVectorEnrichmentJob	sagemaker-geospatial:GetVectorEnrichmentJob	arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
ListEarthObservationJobs	sagemaker-geospatial:ListEarthObservationJobs	*
ListRasterDataCollections	sagemaker-geospatial:ListRasterDataCollections	*
ListTagsForResource	sagemaker-geospatial:ListTagsForResource	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
ListVectorEnrichmentJobs	sagemaker-geospatial:ListVectorEnrichmentJobs	*
SearchRasterDataCollection	sagemaker-geospatial:SearchRasterDataCollection	arn:aws:sagemaker-geospatial:region:account-id:raster-data-collection/public/id
StartEarthObservationJob	sagemaker-geospatial:StartEarthObservationJob	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id
StartVectorEnrichmentJob	sagemaker-geospatial:StartVectorEnrichmentJob	arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
StopEarthObservationJob	sagemaker-geospatial:StopEarthObservationJob	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id
StopVectorEnrichmentJob	sagemaker-geospatial:StopVectorEnrichmentJob	arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
TagResource	sagemaker-geospatial:TagResource	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
UntagResource	sagemaker-geospatial:UntagResource	arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id
AddTags	sagemaker:AddTags	arn:aws:sagemaker:region:account-id:*
CreateApp	sagemaker:CreateApp	arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/app-type/appName
CreateAppImageConfig	sagemaker:CreateAppImageConfig	arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName
CreateAutoMLJob	sagemaker:CreateAutoMLJob iam:PassRole 연결된 ResourceConfig에 VolumeKmsKeyId 가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 다음 권한이 필요합니다. kms:CreateGrant	arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName
CreateAutoMLJobV2	sagemaker:CreateAutoMLJobV2 iam:PassRole 연결된 ResourceConfig에 VolumeKmsKeyId 가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 다음 권한이 필요합니다. kms:CreateGrant	arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName
CreateDomain	sagemaker:CreateDomain iam:CreateServiceLinkedRole iam:PassRole KMS 고객 관리형 키가 KmsKeyId에 대해 지정된 경우 필요합니다. elasticfilesystem:CreateFileSystem kms:CreateGrant kms:Decrypt kms:DescribeKey kms:GenerateDataKeyWithoutPlainText RStudio를 지원하는 도메인을 생성하는 데 필요합니다. sagemaker:CreateApp	arn:aws:sagemaker:region:account-id:domain/domain-id
CreateEndpoint	sagemaker:CreateEndpoint kms:CreateGrant(연결된 EndPointConfig에 KmsKeyId가 지정된 경우에만 필요함)	arn:aws:sagemaker:region:account-id:endpoint/endpointName arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName
CreateEndpointConfig	sagemaker:CreateEndpointConfig	arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName
CreateFlowDefinition	sagemaker:CreateFlowDefinition iam:PassRole	arn:aws:sagemaker:region:account-id:flow-definition/flowDefinitionName
CreateHumanTaskUi	sagemaker:CreateHumanTaskUi	arn:aws:sagemaker:region:account-id:human-task-ui/humanTaskUiName
CreateInferenceRecommendationsJob	sagemaker:CreateInferenceRecommendationsJob iam:PassRole 다음 권한은 암호화 키를 지정한 경우에만 필요합니다. kms:CreateGrant kms:Decrypt kms:DescribeKey kms:GenerateDataKey	arn:aws:sagemaker:region:account-id:inference-recommendations-job/inferenceRecommendationsJobName
CreateHyperParameterTuningJob	sagemaker:CreateHyperParameterTuningJob iam:PassRole 연결된 ResourceConfig에 VolumeKmsKeyId 가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 다음 권한이 필요합니다. kms:CreateGrant	arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJobName
CreateImage	sagemaker:CreateImage iam:PassRole	arn:aws:sagemaker:region:account-id:image/*
CreateImageVersion	sagemaker:CreateImageVersion	arn:aws:sagemaker:region:account-id:image-version/imageName/*
CreateLabelingJob	세이지메이커: CreateLabelingJob 잼: PassRole	arn:aws:sagemaker:region:account-id:labeling-job/labelingJobName
CreateModel	sagemaker:CreateModel iam:PassRole	arn:aws:sagemaker:region:account-id:model/modelName
CreateModelPackage	sagemaker:CreateModelPackage	arn:aws:sagemaker:region:account-id:model-package/modelPackageName
CreateModelPackageGroup	sagemaker:CreateModelPackageGroup	arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName
CreateNotebookInstance	sagemaker:CreateNotebookInstance iam:PassRole 다음 권한은 노트북 인스턴스에 VPC를 지정한 경우에만 필요합니다. ec2:CreateNetworkInterface ec2:DescribeSecurityGroups ec2:DescribeSubnets ec2:DescribeVpcs 다음 권한은 노트북 인스턴스에 VPC 및 Elastic Inference 가속기를 지정한 경우에만 필요합니다. ec2:DescribeVpcEndpoints 다음 권한은 암호화 키를 지정한 경우에만 필요합니다. kms:DescribeKey kms:CreateGrant 다음 권한은 프라이빗 Git 리포지토리에 액세스하기 위한 AWSSecrets Manager 암호를 지정한 경우에만 필요합니다. secretsmanager:GetSecretValue	arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName
CreatePipeline	sagemaker:CreatePipeline iam:PassRole	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name arn:aws-partition:iam::account-id:role/role-name
CreatePresignedDomainUrl	sagemaker:CreatePresignedDomainUrl	arn:aws:sagemaker:region:account-id:app/domain-id/userProfileName/*
CreatePresignedNotebookInstanceUrl	sagemaker:CreatePresignedNotebookInstanceUrl	arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName
CreateProcessingJob	sagemaker:CreateProcessingJob iam:PassRole kms:CreateGrant(연결된 ProcessingResources에 VolumeKmsKeyId가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 필요함)	arn:aws:sagemaker:region:account-id:processing-job/processingJobName
CreateSpace	sagemaker:CreateSpace	arn:aws:sagemaker:region:account-id:space/domain-id/spaceName
CreateStudioLifecycleConfig	sagemaker:CreateStudioLifecycleConfig	arn:aws:sagemaker:region:account-id:studio-lifecycle-config/.*
CreateTrainingJob	sagemaker:CreateTrainingJob iam:PassRole kms:CreateGrant(연결된 ResourceConfig에 VolumeKmsKeyId가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 필요함)	arn:aws:sagemaker:region:account-id:training-job/trainingJobName
CreateTransformJob	sagemaker:CreateTransformJob kms:CreateGrant(연결된 TransformResources에 VolumeKmsKeyId가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 필요함)	arn:aws:sagemaker:region:account-id:transform-job/transformJobName
CreateUserProfile	sagemaker:CreateUserProfile iam:PassRole	arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName
CreateWorkforce	sagemaker:CreateWorkforce cognito-idp:DescribeUserPoolClient cognito-idp:UpdateUserPool cognito-idp:DescribeUserPool cognito-idp:UpdateUserPoolClient	arn:aws:sagemaker:region:account-id:workforce/*
CreateWorkteam	sagemaker:CreateWorkteam cognito-idp:DescribeUserPoolClient cognito-idp:UpdateUserPool cognito-idp:DescribeUserPool cognito-idp:UpdateUserPoolClient	arn:aws:sagemaker:region:account-id:workteam/private-crowd/work team name
DeleteApp	sagemaker:DeleteApp	arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/app-type/appName
DeleteAppImageConfig	sagemaker:DeleteAppImageConfig	arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName
DeleteDomain	sagemaker:DeleteDomain	arn:aws:sagemaker:region:account-id:domain/domainId
DeleteEndpoint	sagemaker:DeleteEndpoint	arn:aws:sagemaker:region:account-id:endpoint/endpointName
DeleteEndpointConfig	sagemaker:DeleteEndpointConfig	arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName
DeleteFlowDefinition	sagemaker:DeleteFlowDefinition	arn:aws:sagemaker:region:account-id:flow-definition/flowDefinitionName
DeleteHumanLoop	sagemaker:DeleteHumanLoop	arn:aws:sagemaker:region:account-id:human-loop/humanLoopName
DeleteImage	sagemaker:DeleteImage	arn:aws:sagemaker:region:account-id:image/imageName
DeleteImageVersion	sagemaker:DeleteImageVersion	arn:aws:sagemaker:region:account-id:image-version/imageName/versionNumber
DeleteModel	sagemaker:DeleteModel	arn:aws:sagemaker:region:account-id:model/modelName
DeleteModelPackage	sagemaker:DeleteModelPackage	arn:aws:sagemaker:region:account-id:model-package/modelPackageName
DeleteModelPackageGroup	sagemaker:DeleteModelPackageGroup	arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName
DeleteModelPackageGroupPolicy	sagemaker:DeleteModelPackageGroupPolicy	arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName
DeleteNotebookInstance	sagemaker:DeleteNotebookInstance 다음 권한은 노트북 인스턴스에 VPC를 지정한 경우에만 필요합니다. ec2:DeleteNetworkInterface 다음 권한은 노트북 인스턴스를 생성할 때 암호화 키를 지정한 경우에만 필요합니다. kms:DescribeKey	arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName
DeletePipeline	sagemaker:DeletePipeline	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name
DeleteSpace	sagemaker:DeleteSpace	arn:aws:sagemaker:region:account-id:space/domain-id/spaceName
DeleteTags	sagemaker:DeleteTags	arn:aws:sagemaker:region:account-id:*
DeleteUserProfile	sagemaker:DeleteUserProfile	arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName
DeleteWorkforce	sagemaker:DeleteWorkforce	arn:aws:sagemaker:region:account-id:workforce/*
DeleteWorkteam	sagemaker:DeleteWorkteam	arn:aws:sagemaker:region:account-id:workteam/private-crowd/*
DescribeApp	sagemaker:DescribeApp	arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/app-type/appName
DescribeAppImageConfig	sagemaker:DescribeAppImageConfig	arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName
DescribeAutoMLJob	sagemaker:DescribeAutoMLJob	arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName
DescribeAutoMLJobV2	sagemaker:DescribeAutoMLJobV2	arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName
DescribeDomain	sagemaker:DescribeDomain	arn:aws:sagemaker:region:account-id:domain/domainId
DescribeEndpoint	sagemaker:DescribeEndpoint	arn:aws:sagemaker:region:account-id:endpoint/endpointName
DescribeEndpointConfig	sagemaker:DescribeEndpointConfig	arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName
DescribeFlowDefinition	sagemaker:DescribeFlowDefinition	arn:aws:sagemaker:region:account-id:flow-definition/flowDefinitionName
DescribeHumanLoop	sagemaker:DescribeHumanLoop	arn:aws:sagemaker:region:account-id:human-loop/humanLoopName
DescribeHumanTaskUi	sagemaker:DescribeHumanTaskUi	arn:aws:sagemaker:region:account-id:human-task-ui/humanTaskUiName
DescribeHyperParameterTuningJob	sagemaker:DescribeHyperParameterTuningJob	arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob
DescribeImage	sagemaker:DescribeImage	arn:aws:sagemaker:region:account-id:image/imageName
DescribeImageVersion	sagemaker:DescribeImageVersion	arn:aws:sagemaker:region:account-id:image-version/imageName/versionNumber
DescribeLabelingJob	sagemaker:DescribeLabelingJob	arn:aws:sagemaker:region:account-id:labeling-job/labelingJobName
DescribeModel	sagemaker:DescribeModel	arn:aws:sagemaker:region:account-id:model/modelName
DescribeModelPackage	sagemaker:DescribeModelPackage	arn:aws:sagemaker:region:account-id:model-package/modelPackageName
DescribeModelPackageGroup	sagemaker:DescribeModelPackageGroup	arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName
DescribeNotebookInstance	sagemaker:DescribeNotebookInstance	arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName
DescribePipeline	sagemaker:DescribePipeline	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name
DescribePipelineDefinitionForExecution	sagemaker:DescribePipelineDefinitionForExecution	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id
DescribePipelineExecution	sagemaker:DescribePipelineExecution	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id
DescribeProcessingJob	sagemaker:DescribeProcessingJob	arn:aws:sagemaker:region:account-id:processing-job/processingjobname
DescribeSpace	sagemaker:DescribeSpace	arn:aws:sagemaker:region:account-id:space/domain-id/spaceName
DescribeSubscribedWorkteam	sagemaker:DescribeSubscribedWorkteam aws-marketplace:ViewSubscriptions	arn:aws:sagemaker:region:account-id:workteam/vendor-crowd/*
DescribeTrainingJob	sagemaker:DescribeTrainingJob	arn:aws:sagemaker:region:account-id:training-job/trainingjobname
DescribeTransformJob	sagemaker:DescribeTransformJob	arn:aws:sagemaker:region:account-id:transform-job/transformjobname
DescribeUserProfile	sagemaker:DescribeUserProfile	arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName
DescribeWorkforce	sagemaker:DescribeWorkforce	arn:aws:sagemaker:region:account-id:workforce/*
DescribeWorkteam	sagemaker:DescribeWorkteam	arn:aws:sagemaker:region:account-id:workteam/private-crowd/*
GetModelPackageGroupPolicy	sagemaker:GetModelPackageGroupPolicy	arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName
InvokeEndpoint	sagemaker:InvokeEndpoint	arn:aws:sagemaker:region:account-id:endpoint/endpointName
ListAppImageConfigs	sagemaker:ListAppImageConfigs	arn:aws:sagemaker:region:account-id:app-image-config/*
ListApps	sagemaker:ListApps	arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/*
ListDomains	sagemaker:ListDomains	arn:aws:sagemaker:region:account-id:domain/*
ListEndpointConfigs	sagemaker:ListEndpointConfigs	*
ListEndpoints	sagemaker:ListEndpoints	*
ListFlowDefinitions	sagemaker:ListFlowDefinitions	*
ListHumanLoops	sagemaker:ListHumanLoops	*
ListHumanTaskUis	sagemaker:ListHumanTaskUis	*
ListHyperParameterTuningJobs	sagemaker:ListHyperParameterTuningJobs	arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob
ListImages	sagemaker:ListImages	*
ListImageVersions	sagemaker:ListImageVersions	arn:aws:sagemaker:region:account-id:image/*
ListLabelingJobs	sagemaker:ListLabelingJobs	*
ListLabelingJobsForWorkteam	sagemaker:ListLabelingJobForWorkteam	*
ListModelPackageGroups	sagemaker:ListModelPackageGroups	arn:aws:sagemaker:region:account-id :model-package-group/ModelPackageGroupName
ListModelPackages	sagemaker:ListModelPackages	arn:aws:sagemaker:region:account-id :model-package/ModelPackageName
ListModels	sagemaker:ListModels	*
ListNotebookInstances	sagemaker:ListNotebookInstances	*
ListPipelineExecutions	sagemaker:ListPipelineExecutions	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name
ListPipelineExecutionSteps	sagemaker:ListPipelineExecutionSteps	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id
ListPipelineParametersForExecution	sagemaker:ListPipelineParametersForExecution	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id
ListPipelines	sagemaker:ListPipelines	*
ListProcessingJobs	sagemaker:ListProcessingJobs	*
ListSpaces	sagemaker:ListSpaces	arn:aws:sagemaker:region:account-id:space/domain-id/*
ListSubscribedWorkteams	sagemaker:ListSubscribedWorkteams aws-marketplace:ViewSubscriptions	*
ListTags	sagemaker:ListTags	arn:aws:sagemaker:region:account-id:*
ListTrainingJobs	sagemaker:ListTrainingJobs	*
ListTrainingJobsForHyperParameterTuningJob	sagemaker:ListTrainingJobsForHyperParameterTuningJob	arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob
ListTransformJobs	sagemaker:ListTransformJobs	*
ListUserProfiles	sagemaker:ListUserProfiles	arn:aws:sagemaker:region:account-id:user-profile/domain-id/*
ListWorkforces	sagemaker:ListWorkforces	*
ListWorkteams	sagemaker:ListWorkteams	*
PutModelPackageGroupPolicy	sagemaker:PutModelPackageGroupPolicy	arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName
RetryPipelineExecution	sagemaker:RetryPipelineExecution	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id
Search	sagemaker:Search	*
SendPipelineExecutionStepFailure	sagemaker:SendPipelineExecutionStepFailure	*
SendPipelineExecutionStepSuccess	sagemaker:SendPipelineExecutionStepSuccess	*
StartHumanLoop	sagemaker:StartHumanLoop	arn:aws:sagemaker:region:account-id:human-loop/humanLoopName
StartNotebookInstance	sagemaker:StartNotebookInstance iam:PassRole 다음 권한은 노트북 인스턴스를 생성할 때 VPC를 지정한 경우에만 필요합니다. ec2:CreateNetworkInterface ec2:DescribeNetworkInterfaces ec2:DescribeSecurityGroups ec2:DescribeSubnets ec2:DescribeVpcs 다음 권한은 노트북 인스턴스에 VPC 및 Elastic Inference 가속기를 지정한 경우에만 필요합니다. ec2:DescribeVpcEndpoints 다음 권한은 노트북 인스턴스를 생성할 때 암호화 키를 지정한 경우에만 필요합니다. kms:DescribeKey kms:CreateGrant 다음 권한은 노트북 인스턴스를 생성할 때 프라이빗 Git 리포지토리에 액세스하기 위한 AWSSecrets Manager 암호를 지정한 경우에만 필요합니다. secretsmanager:GetSecretValue	arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName
StartPipelineExecution	sagemaker:StartPipelineExecution	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name
StopHumanLoop	sagemaker:StopHumanLoop	arn:aws:sagemaker:region:account-id:human-loop/humanLoopName
StopHyperParameterTuningJob	sagemaker:StopHyperParameterTuningJob	arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob
StopLabelingJob	sagemaker:StopLabelingJob	arn:aws:sagemaker:region:account-id:labeling-job/labelingJobName
StopNotebookInstance	sagemaker:StopNotebookInstance	arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName
StopPipelineExecution	sagemaker:StopPipelineExecution	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id
StopProcessingJob	sagemaker:StopProcessingJob	arn:aws:sagemaker:region:account-id:processing-job/processingJobName
StopTrainingJob	sagemaker:StopTrainingJob	arn:aws:sagemaker:region:account-id:training-job/trainingJobName
StopTransformJob	sagemaker:StopTransformJob	arn:aws:sagemaker:region:account-id:transform-job/transformJobName
UpdateAppImageConfig	sagemaker:UpdateAppImageConfig	arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName
UpdateDomain	sagemaker:UpdateDomain	arn:aws:sagemaker:region:account-id:domain/domainId
UpdateEndpoint	sagemaker:UpdateEndpoint	arn:aws:sagemaker:region:account-id:endpoint/endpointName
UpdateEndpointWeightsAndCapacities	sagemaker:UpdateEndpointWeightsAndCapacities	arn:aws:sagemaker:region:account-id:endpoint/endpointName
UpdateImage	sagemaker:UpdateImage iam:PassRole	arn:aws:sagemaker:region:account-id:image/imageName
UpdateModelPackage	sagemaker:UpdateModelPackage	arn:aws:sagemaker:region:account-id:model-package/modelPackageName
UpdateNotebookInstance	sagemaker:UpdateNotebookInstance iam:PassRole	arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName
UpdatePipeline	sagemaker:UpdatePipeline iam:PassRole	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name arn:aws-partition:iam::account-id:role/role-name
UpdatePipelineExecution	sagemaker:UpdatePipelineExecution	arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id
UpdateSpace	sagemaker:UpdateSpace	arn:aws:sagemaker:region:account-id:space/domain-id/spaceName
UpdateUserProfile	sagemaker:UpdateUserProfile	arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName
UpdateWorkforce	sagemaker:UpdateWorkforce	arn:aws:sagemaker:region:account-id:workforce/*
UpdateWorkteam	sagemaker:UpdateWorkteam	arn:aws:sagemaker:region:account-id:workteam/private-crowd/*