Amazon SageMaker API 권한: 작업, 권한 및 리소스 참조 - Amazon SageMaker

기계 번역으로 제공되는 번역입니다. 제공된 번역과 원본 영어의 내용이 상충하는 경우에는 영어 버전이 우선합니다.

Amazon SageMaker API 권한: 작업, 권한 및 리소스 참조

액세스 제어를 설정하고 IAM 자격 증명에 연결할 수 있는 권한 정책(자격 증명 기반 정책)을 작성할 때는 다음 표를 참조로 사용합니다. 표에는 각 Amazon 작업, 작업을 수행할 수 있는 권한을 부여할 수 있는 해당 작업, 권한을 부여할 수 있는 리소스가 나열되어 있습니다. SageMaker API AWS 정책의 Action필드에서 작업을 지정하고, 정책의 Resource필드에서 리소스 값을 지정합니다.

참고

를 제외하고 ListTags API리소스 수준 제한은 List- 호출 에서 사용할 수 없습니다. 를 호출List-API하는 모든 사용자는 계정에서 해당 유형의 모든 리소스를 볼 수 있습니다.

Amazon SageMaker 정책에서 조건을 표현하려면 AWS-wide 조건 키를 사용할 수 있습니다. AWS전체 키의 전체 목록은 서비스 권한 부여 참조사용 가능한 키를 참조하세요.

주의

일부 SageMaker API 작업은 를 통해 계속 액세스할 수 있습니다Search API. 예를 들어 사용자에게 특정 SageMaker 리소스에 대한 Describe 호출에 대한 권한을 거부하는 IAM 정책이 있는 경우에도 해당 사용자는 검색을 통해 설명 정보에 액세스할 수 있습니다API. Describe 호출에 대한 사용자 액세스를 완전히 제한하려면 검색 에 대한 액세스도 제한해야 합니다API. 검색을 통해 액세스할 수 있는 SageMaker 리소스 목록은 SageMaker 검색 AWS CLI 명령 참조를 API참조하세요.

스크롤 막대를 사용하여 표의 나머지 부분을 확인합니다.

작업에 대한 Amazon SageMaker API 작업 및 필수 권한

Amazon SageMaker API 운영 필수 권한(API 작업) 리소스

DeleteEarthObservationJob

sagemaker-geospatial:DeleteEarthObservationJob

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

DeleteVectorEnrichmentJob

sagemaker-geospatial:DeleteVectorEnrichmentJob

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

ExportEarthObservationJob

sagemaker-geospatial:ExportEarthObservationJob

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

ExportVectorEnrichmentJob

sagemaker-geospatial:ExportVectorEnrichmentJob

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

GetEarthObservationJob

sagemaker-geospatial:GetEarthObservationJob

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

GetRasterDataCollection

sagemaker-geospatial:GetRasterDataCollection

arn:aws:sagemaker-geospatial:region:account-id:raster-data-collection/public/id

GetTile

sagemaker-geospatial:GetTile

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

GetVectorEnrichmentJob

sagemaker-geospatial:GetVectorEnrichmentJob

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

ListEarthObservationJobs

sagemaker-geospatial:ListEarthObservationJobs

*

ListRasterDataCollections

sagemaker-geospatial:ListRasterDataCollections

*

ListTagsForResource

sagemaker-geospatial:ListTagsForResource

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

ListVectorEnrichmentJobs

sagemaker-geospatial:ListVectorEnrichmentJobs

*

SearchRasterDataCollection

sagemaker-geospatial:SearchRasterDataCollection

arn:aws:sagemaker-geospatial:region:account-id:raster-data-collection/public/id

StartEarthObservationJob

sagemaker-geospatial:StartEarthObservationJob

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

StartVectorEnrichmentJob

sagemaker-geospatial:StartVectorEnrichmentJob

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

StopEarthObservationJob

sagemaker-geospatial:StopEarthObservationJob

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

StopVectorEnrichmentJob

sagemaker-geospatial:StopVectorEnrichmentJob

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

TagResource

sagemaker-geospatial:TagResource

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

UntagResource

sagemaker-geospatial:UntagResource

arn:aws:sagemaker-geospatial:region:account-id:earth-observation-job/id

arn:aws:sagemaker-geospatial:region:account-id:vector-enrichment-job/id

AddTags

sagemaker:AddTags

arn:aws:sagemaker:region:account-id:*

CreateApp

sagemaker:CreateApp

arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/app-type/appName

CreateAppImageConfig

sagemaker:CreateAppImageConfig

arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName

CreateAutoMLJob

sagemaker:CreateAutoMLJob

iam:PassRole

연결된 ResourceConfigVolumeKmsKeyId 가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 다음 권한이 필요합니다.

kms:CreateGrant

arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName

CreateAutoMLJobV2

sagemaker:CreateAutoMLJobV2

iam:PassRole

연결된 ResourceConfigVolumeKmsKeyId 가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 다음 권한이 필요합니다.

kms:CreateGrant

arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName

CreateDomain

sagemaker:CreateDomain

iam:CreateServiceLinkedRole

iam:PassRole

KMS 고객 관리형 키가 에 지정된 경우 필수KmsKeyId:

elasticfilesystem:CreateFileSystem

kms:CreateGrant

kms:Decrypt

kms:DescribeKey

kms:GenerateDataKeyWithoutPlainText

를 지원하는 도메인을 생성하는 데 필요합니다RStudio.

sagemaker:CreateApp

arn:aws:sagemaker:region:account-id:domain/domain-id

CreateEndpoint

sagemaker:CreateEndpoint

kms:CreateGrant(연결된 EndPointConfigKmsKeyId가 지정된 경우에만 필요함)

arn:aws:sagemaker:region:account-id:endpoint/endpointName

arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName

CreateEndpointConfig

sagemaker:CreateEndpointConfig

arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName

CreateFlowDefinition

sagemaker:CreateFlowDefinition

iam:PassRole

arn:aws:sagemaker:region:account-id:flow-definition/flowDefinitionName

CreateHumanTaskUi

sagemaker:CreateHumanTaskUi

arn:aws:sagemaker:region:account-id:human-task-ui/humanTaskUiName

CreateInferenceRecommendationsJob

sagemaker:CreateInferenceRecommendationsJob

iam:PassRole

다음 권한은 암호화 키를 지정한 경우에만 필요합니다.

kms:CreateGrant

kms:Decrypt

kms:DescribeKey

kms:GenerateDataKey

arn:aws:sagemaker:region:account-id:inference-recommendations-job/inferenceRecommendationsJobName

CreateHyperParameterTuningJob

sagemaker:CreateHyperParameterTuningJob

iam:PassRole

연결된 ResourceConfigVolumeKmsKeyId 가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 다음 권한이 필요합니다.

kms:CreateGrant

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJobName

CreateImage

sagemaker:CreateImage

iam:PassRole

arn:aws:sagemaker:region:account-id:image/*

CreateImageVersion

sagemaker:CreateImageVersion

arn:aws:sagemaker:region:account-id:image-version/imageName/*

CreateLabelingJob

sagemaker:CreateLabelingJob

iam:PassRole

arn:aws:sagemaker:region:account-id:labeling-job/labelingJobName

CreateModel

sagemaker:CreateModel

iam:PassRole

arn:aws:sagemaker:region:account-id:model/modelName

CreateModelPackage

sagemaker:CreateModelPackage

arn:aws:sagemaker:region:account-id:model-package/modelPackageName

CreateModelPackageGroup

sagemaker:CreateModelPackageGroup

arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName

CreateNotebookInstance

sagemaker:CreateNotebookInstance

iam:PassRole

노트북 인스턴스VPC에 를 지정하는 경우에만 다음 권한이 필요합니다.

ec2:CreateNetworkInterface

ec2:DescribeSecurityGroups

ec2:DescribeSubnets

ec2:DescribeVpcs

다음 권한은 암호화 키를 지정한 경우에만 필요합니다.

kms:DescribeKey

kms:CreateGrant

다음 권한은 프라이빗 Git 리포지토리에 액세스하기 위한 AWS Secrets Manager 암호를 지정한 경우에만 필요합니다.

secretsmanager:GetSecretValue

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

CreatePipeline

sagemaker:CreatePipeline

iam:PassRole

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name

arn:aws-partition:iam::account-id:role/role-name

CreatePresignedDomainUrl

sagemaker:CreatePresignedDomainUrl

arn:aws:sagemaker:region:account-id:app/domain-id/userProfileName/*

CreatePresignedNotebookInstanceUrl

sagemaker:CreatePresignedNotebookInstanceUrl

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

CreateProcessingJob

sagemaker:CreateProcessingJob

iam:PassRole

kms:CreateGrant(연결된 ProcessingResourcesVolumeKmsKeyId가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 필요함)

ec2:CreateNetworkInterface (를 지정하는 경우에만 필요VPC)

arn:aws:sagemaker:region:account-id:processing-job/processingJobName

CreateSpace

sagemaker:CreateSpace

arn:aws:sagemaker:region:account-id:space/domain-id/spaceName

CreateStudioLifecycleConfig

sagemaker:CreateStudioLifecycleConfig

arn:aws:sagemaker:region:account-id:studio-lifecycle-config/.*

CreateTrainingJob

sagemaker:CreateTrainingJob

iam:PassRole

kms:CreateGrant(연결된 ResourceConfigVolumeKmsKeyId가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 필요함)

arn:aws:sagemaker:region:account-id:training-job/trainingJobName

CreateTransformJob

sagemaker:CreateTransformJob

kms:CreateGrant(연결된 TransformResourcesVolumeKmsKeyId가 지정되고, 연결된 역할에 이 작업을 허용하는 정책이 없을 경우에만 필요함)

arn:aws:sagemaker:region:account-id:transform-job/transformJobName

CreateUserProfile

sagemaker:CreateUserProfile

iam:PassRole

arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName

CreateWorkforce

sagemaker:CreateWorkforce

cognito-idp:DescribeUserPoolClient

cognito-idp:UpdateUserPool

cognito-idp:DescribeUserPool

cognito-idp:UpdateUserPoolClient

arn:aws:sagemaker:region:account-id:workforce/*

CreateWorkteam

sagemaker:CreateWorkteam

cognito-idp:DescribeUserPoolClient

cognito-idp:UpdateUserPool

cognito-idp:DescribeUserPool

cognito-idp:UpdateUserPoolClient

arn:aws:sagemaker:region:account-id:workteam/private-crowd/work team name

DeleteApp

sagemaker:DeleteApp

arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/app-type/appName

DeleteAppImageConfig

sagemaker:DeleteAppImageConfig

arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName

DeleteDomain

sagemaker:DeleteDomain

arn:aws:sagemaker:region:account-id:domain/domainId

DeleteEndpoint

sagemaker:DeleteEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

DeleteEndpointConfig

sagemaker:DeleteEndpointConfig

arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName

DeleteFlowDefinition

sagemaker:DeleteFlowDefinition

arn:aws:sagemaker:region:account-id:flow-definition/flowDefinitionName

DeleteHumanLoop

sagemaker:DeleteHumanLoop

arn:aws:sagemaker:region:account-id:human-loop/humanLoopName

DeleteImage

sagemaker:DeleteImage

arn:aws:sagemaker:region:account-id:image/imageName

DeleteImageVersion

sagemaker:DeleteImageVersion

arn:aws:sagemaker:region:account-id:image-version/imageName/versionNumber

DeleteModel

sagemaker:DeleteModel

arn:aws:sagemaker:region:account-id:model/modelName

DeleteModelPackage

sagemaker:DeleteModelPackage

arn:aws:sagemaker:region:account-id:model-package/modelPackageName

DeleteModelPackageGroup

sagemaker:DeleteModelPackageGroup

arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName

DeleteModelPackageGroupPolicy

sagemaker:DeleteModelPackageGroupPolicy

arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName

DeleteNotebookInstance

sagemaker:DeleteNotebookInstance

노트북 인스턴스VPC에 대해 를 지정한 경우에만 다음 권한이 필요합니다.

ec2:DeleteNetworkInterface

다음 권한은 노트북 인스턴스를 생성할 때 암호화 키를 지정한 경우에만 필요합니다.

kms:DescribeKey

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

DeletePipeline

sagemaker:DeletePipeline

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name

DeleteSpace

sagemaker:DeleteSpace

arn:aws:sagemaker:region:account-id:space/domain-id/spaceName

DeleteTags

sagemaker:DeleteTags

arn:aws:sagemaker:region:account-id:*

DeleteUserProfile

sagemaker:DeleteUserProfile

arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName

DeleteWorkforce

sagemaker:DeleteWorkforce

arn:aws:sagemaker:region:account-id:workforce/*

DeleteWorkteam

sagemaker:DeleteWorkteam

arn:aws:sagemaker:region:account-id:workteam/private-crowd/*

DescribeApp

sagemaker:DescribeApp

arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/app-type/appName

DescribeAppImageConfig

sagemaker:DescribeAppImageConfig

arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName

DescribeAutoMLJob

sagemaker:DescribeAutoMLJob

arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName

DescribeAutoMLJobV2

sagemaker:DescribeAutoMLJobV2

arn:aws:sagemaker:region:account-id:automl-job/autoMLJobName

DescribeDomain

sagemaker:DescribeDomain

arn:aws:sagemaker:region:account-id:domain/domainId

DescribeEndpoint

sagemaker:DescribeEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

DescribeEndpointConfig

sagemaker:DescribeEndpointConfig

arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName

DescribeFlowDefinition

sagemaker:DescribeFlowDefinition

arn:aws:sagemaker:region:account-id:flow-definition/flowDefinitionName

DescribeHumanLoop

sagemaker:DescribeHumanLoop

arn:aws:sagemaker:region:account-id:human-loop/humanLoopName

DescribeHumanTaskUi

sagemaker:DescribeHumanTaskUi

arn:aws:sagemaker:region:account-id:human-task-ui/humanTaskUiName

DescribeHyperParameterTuningJob

sagemaker:DescribeHyperParameterTuningJob

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

DescribeImage

sagemaker:DescribeImage

arn:aws:sagemaker:region:account-id:image/imageName

DescribeImageVersion

sagemaker:DescribeImageVersion

arn:aws:sagemaker:region:account-id:image-version/imageName/versionNumber

DescribeLabelingJob

sagemaker:DescribeLabelingJob

arn:aws:sagemaker:region:account-id:labeling-job/labelingJobName

DescribeModel

sagemaker:DescribeModel

arn:aws:sagemaker:region:account-id:model/modelName

DescribeModelPackage

sagemaker:DescribeModelPackage

arn:aws:sagemaker:region:account-id:model-package/modelPackageName

DescribeModelPackageGroup

sagemaker:DescribeModelPackageGroup

arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName

DescribeNotebookInstance

sagemaker:DescribeNotebookInstance

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

DescribePipeline

sagemaker:DescribePipeline

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name

DescribePipelineDefinitionForExecution

sagemaker:DescribePipelineDefinitionForExecution

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id

DescribePipelineExecution

sagemaker:DescribePipelineExecution

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id

DescribeProcessingJob

sagemaker:DescribeProcessingJob

arn:aws:sagemaker:region:account-id:processing-job/processingjobname

DescribeSpace

sagemaker:DescribeSpace

arn:aws:sagemaker:region:account-id:space/domain-id/spaceName

DescribeSubscribedWorkteam

sagemaker:DescribeSubscribedWorkteam

aws-marketplace:ViewSubscriptions

arn:aws:sagemaker:region:account-id:workteam/vendor-crowd/*

DescribeTrainingJob

sagemaker:DescribeTrainingJob

arn:aws:sagemaker:region:account-id:training-job/trainingjobname

DescribeTransformJob

sagemaker:DescribeTransformJob

arn:aws:sagemaker:region:account-id:transform-job/transformjobname

DescribeUserProfile

sagemaker:DescribeUserProfile

arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName

DescribeWorkforce

sagemaker:DescribeWorkforce

arn:aws:sagemaker:region:account-id:workforce/*

DescribeWorkteam

sagemaker:DescribeWorkteam

arn:aws:sagemaker:region:account-id:workteam/private-crowd/*

GetModelPackageGroupPolicy

sagemaker:GetModelPackageGroupPolicy

arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName

InvokeEndpoint

sagemaker:InvokeEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

ListAppImageConfigs

sagemaker:ListAppImageConfigs

arn:aws:sagemaker:region:account-id:app-image-config/*

ListApps

sagemaker:ListApps

arn:aws:sagemaker:region:account-id:app/domain-id/user-profile-name/*

ListDomains

sagemaker:ListDomains

arn:aws:sagemaker:region:account-id:domain/*

ListEndpointConfigs

sagemaker:ListEndpointConfigs

*

ListEndpoints

sagemaker:ListEndpoints

*

ListFlowDefinitions

sagemaker:ListFlowDefinitions

*

ListHumanLoops

sagemaker:ListHumanLoops

*

ListHumanTaskUis

sagemaker:ListHumanTaskUis

*

ListHyperParameterTuningJobs

sagemaker:ListHyperParameterTuningJobs

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

ListImages

sagemaker:ListImages

*

ListImageVersions

sagemaker:ListImageVersions

arn:aws:sagemaker:region:account-id:image/*

ListLabelingJobs

sagemaker:ListLabelingJobs

*

ListLabelingJobsForWorkteam

sagemaker:ListLabelingJobForWorkteam

*

ListModelPackageGroups

sagemaker:ListModelPackageGroups

arn:aws:sagemaker:region:account-id :model-package-group/ModelPackageGroupName

ListModelPackages

sagemaker:ListModelPackages

arn:aws:sagemaker:region:account-id :model-package/ModelPackageName

ListModels

sagemaker:ListModels

*

ListNotebookInstances

sagemaker:ListNotebookInstances

*

ListPipelineExecutions

sagemaker:ListPipelineExecutions

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name

ListPipelineExecutionSteps

sagemaker:ListPipelineExecutionSteps

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id

ListPipelineParametersForExecution

sagemaker:ListPipelineParametersForExecution

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id

ListPipelines

sagemaker:ListPipelines

*

ListProcessingJobs

sagemaker:ListProcessingJobs

*

ListSpaces

sagemaker:ListSpaces

arn:aws:sagemaker:region:account-id:space/domain-id/*

ListSubscribedWorkteams

sagemaker:ListSubscribedWorkteams

aws-marketplace:ViewSubscriptions

*

ListTags

sagemaker:ListTags

arn:aws:sagemaker:region:account-id:*

ListTrainingJobs

sagemaker:ListTrainingJobs

*

ListTrainingJobsForHyperParameterTuningJob

sagemaker:ListTrainingJobsForHyperParameterTuningJob

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

ListTransformJobs

sagemaker:ListTransformJobs

*

ListUserProfiles

sagemaker:ListUserProfiles

arn:aws:sagemaker:region:account-id:user-profile/domain-id/*

ListWorkforces

sagemaker:ListWorkforces

*

ListWorkteams

sagemaker:ListWorkteams

*

PutModelPackageGroupPolicy

sagemaker:PutModelPackageGroupPolicy

arn:aws:sagemaker:region:account-id:model-package-group/modelPackageGroupName

RetryPipelineExecution

sagemaker:RetryPipelineExecution

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id

Search

sagemaker:Search

*

SendPipelineExecutionStepFailure

sagemaker:SendPipelineExecutionStepFailure

*

SendPipelineExecutionStepSuccess

sagemaker:SendPipelineExecutionStepSuccess

*

StartHumanLoop

sagemaker:StartHumanLoop

arn:aws:sagemaker:region:account-id:human-loop/humanLoopName

StartNotebookInstance

sagemaker:StartNotebookInstance

노트북 인스턴스를 생성할 VPC 때 를 지정한 경우에만 다음 권한이 필요합니다.

ec2:CreateNetworkInterface

ec2:DescribeNetworkInterfaces

ec2:DescribeSecurityGroups

ec2:DescribeSubnets

ec2:DescribeVpcs

다음 권한은 노트북 인스턴스를 생성할 때 암호화 키를 지정한 경우에만 필요합니다.

kms:DescribeKey

kms:CreateGrant

다음 권한은 노트북 인스턴스를 생성할 때 프라이빗 Git 리포지토리에 액세스하기 위한 AWS Secrets Manager 암호를 지정한 경우에만 필요합니다.

secretsmanager:GetSecretValue

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

StartPipelineExecution

sagemaker:StartPipelineExecution

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name

StopHumanLoop

sagemaker:StopHumanLoop

arn:aws:sagemaker:region:account-id:human-loop/humanLoopName

StopHyperParameterTuningJob

sagemaker:StopHyperParameterTuningJob

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

StopLabelingJob

sagemaker:StopLabelingJob

arn:aws:sagemaker:region:account-id:labeling-job/labelingJobName

StopNotebookInstance

sagemaker:StopNotebookInstance

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

StopPipelineExecution

sagemaker:StopPipelineExecution

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id

StopProcessingJob

sagemaker:StopProcessingJob

arn:aws:sagemaker:region:account-id:processing-job/processingJobName

StopTrainingJob

sagemaker:StopTrainingJob

arn:aws:sagemaker:region:account-id:training-job/trainingJobName

StopTransformJob

sagemaker:StopTransformJob

arn:aws:sagemaker:region:account-id:transform-job/transformJobName

UpdateAppImageConfig

sagemaker:UpdateAppImageConfig

arn:aws:sagemaker:region:account-id:app-image-config/appImageConfigName

UpdateDomain

sagemaker:UpdateDomain

arn:aws:sagemaker:region:account-id:domain/domainId

UpdateEndpoint

sagemaker:UpdateEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

UpdateEndpointWeightsAndCapacities

sagemaker:UpdateEndpointWeightsAndCapacities

arn:aws:sagemaker:region:account-id:endpoint/endpointName

UpdateImage

sagemaker:UpdateImage

iam:PassRole

arn:aws:sagemaker:region:account-id:image/imageName

UpdateModelPackage

sagemaker:UpdateModelPackage

arn:aws:sagemaker:region:account-id:model-package/modelPackageName

UpdateNotebookInstance

sagemaker:UpdateNotebookInstance

iam:PassRole

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

UpdatePipeline

sagemaker:UpdatePipeline

iam:PassRole

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name

arn:aws-partition:iam::account-id:role/role-name

UpdatePipelineExecution

sagemaker:UpdatePipelineExecution

arn:aws-partition:sagemaker:region:account-id:pipeline/pipeline-name/execution/execution-id

UpdateSpace

sagemaker:UpdateSpace

arn:aws:sagemaker:region:account-id:space/domain-id/spaceName

UpdateUserProfile

sagemaker:UpdateUserProfile

arn:aws:sagemaker:region:account-id:user-profile/domain-id/userProfileName

UpdateWorkforce

sagemaker:UpdateWorkforce

arn:aws:sagemaker:region:account-id:workforce/*

UpdateWorkteam

sagemaker:UpdateWorkteam

arn:aws:sagemaker:region:account-id:workteam/private-crowd/*