Amazon SageMaker
Developer Guide

Amazon SageMaker API Permissions: Actions, Permissions, and Resources Reference

When you are setting up Access Control and writing a permissions policy that you can attach to an IAM identity (an identity-based policy), use the following table as a reference. The table lists each Amazon SageMaker API operation, the corresponding actions for which you can grant permissions to perform the action, and the AWS resource for which you can grant the permissions. You specify the actions in the policy's Action field, and you specify the resource value in the policy's Resource field.

Note

Except for the ListTags API, resource-level restrictions are not available on List- calls . Any user calling a List- API will see all resources of that type in the account.

To express conditions in your Amazon SageMaker policies, you can use AWS-wide condition keys. For a complete list of AWS-wide keys, see Available Keys in the IAM User Guide.

If you see an expand arrow () in the upper-right corner of the table, you can open the table in a new window. To close the window, choose the close button (X) in the lower-right corner.

Amazon SageMaker API Operations and Required Permissions for Actions

Amazon SageMaker API Operations Required Permissions (API Actions) Resources

AddTags

sagemaker:AddTags

arn:aws:sagemaker:region:account-id:*

CreateEndpoint

sagemaker:CreateEndpoint

kms:CreateGrant (required only if the associated EndPointConfig has a KmsKeyId specified)

arn:aws:sagemaker:region:account-id:endpoint/endpointName

CreateEndpointConfig

sagemaker:CreateEndpointConfig

arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName

CreateHyperParameterTuningJob

sagemaker:CreateHyperParameterTuningJob

iam:PassRole

kms:CreateGrant (required only if the associated HyperParameterTuningJob has a KmsKeyId specified)

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJobName

CreatePresignedNotebookInstanceUrl

sagemaker:CreatePresignedNotebookInstanceUrl

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

CreateModel

sagemaker:CreateModel

iam:PassRole

arn:aws:sagemaker:region:account-id:model/modelName

CreateNotebookInstance

sagemaker:CreateNotebookInstance

iam:PassRole

ec2:CreateNetworkInterface

ec2:AttachNetworkInterface

ec2:ModifyNetworkInterfaceAttribute

ec2:DeleteNetworkInterface

ec2:DescribeAvailabilityZones

ec2:DescribeInternetGateways

ec2:DescribeNetworkInterfaces

ec2:DescribeSecurityGroups

ec2:DescribeSubnets

ec2:DescribeVpcs

kms:CreateGrant (required only if you specify a KmsKeyId)

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

CreateTrainingJob

sagemaker:CreateTrainingJob

iam:PassRole

kms:CreateGrant (required only if you specify a KmsKeyId)

arn:aws:sagemaker:region:account-id:training-job/trainingJobName

CreateTransformJob

sagemaker:CreateTransformJob

iam:PassRole

kms:CreateGrant (required only if you specify a KmsKeyId)

arn:aws:sagemaker:region:account-id:transform-job/transformJobName

DeleteEndpoint

sagemaker:DeleteEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

DeleteEndpointConfig

sagemaker:DeleteEndpointConfig

arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName

DeleteModel

sagemaker:DeleteModel

arn:aws:sagemaker:region:account-id:model/modelName

DeleteNotebookInstance

sagemaker:DeleteNotebookInstance

ec2:DeleteNetworkInterface

ec2:DetachNetworkInterface

ec2:DescribeAvailabilityZones

ec2:DescribeInternetGateways

ec2:DescribeSecurityGroups

ec2:DescribeSubnets

ec2:DescribeVpcs

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

DeleteTags

sagemaker:DeleteTags

arn:aws:sagemaker:region:account-id:*

DescribeEndpoint

sagemaker:DescribeEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

DescribeEndpointConfig

sagemaker:DescribeEndpointConfig

arn:aws:sagemaker:region:account-id:endpoint-config/endpointConfigName

DescribeHyperParameterTuningJob

sagemaker:DescribeHyperParameterTuningJob

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

DescribeModel

sagemaker:DescribeModel

arn:aws:sagemaker:region:account-id:model/modelName

DescribeNotebookInstance

sagemaker:DescribeNotebookInstance

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

DescribeTrainingJob

sagemaker:DescribeTrainingJob

arn:aws:sagemaker:region:account-id:training-job/trainingjobname

DescribeTransformJob

sagemaker:DescribeTransformJob

arn:aws:sagemaker:region:account-id:transform-job/transformjobname

InvokeEndpoint

sagemaker:InvokeEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

ListEndpointConfigs

sagemaker:ListEndpointConfigs

*

ListEndpoints

sagemaker:ListEndpoints

*

ListHyperParameterTuningJobs

sagemaker:ListHyperParameterTuningJobs

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

ListModels

sagemaker:ListModels

*

ListNotebookInstances

sagemaker:ListNotebookInstances

*

ListTags

sagemaker:ListTags

arn:aws:sagemaker:region:account-id:*

ListTrainingJobs

sagemaker:ListTrainingJobs

*

ListTransformJobs

sagemaker:ListTransformJobs

*

ListTrainingJobsForHyperParameterTuningJob

sagemaker:ListTrainingJobsForHyperParameterTuningJob

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

StartNotebookInstance

sagemaker:StartNotebookInstance

iam:PassRole

ec2:CreateNetworkInterface

ec2:AttachNetworkInterface

ec2:ModifyNetworkInterfaceAttribute

ec2:DescribeAvailabilityZones

ec2:DescribeInternetGateways

ec2:DescribeSecurityGroups

ec2:DescribeSubnets

ec2:DescribeVpcs

kms:CreateGrant

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

StopHyperParameterTuningJob

sagemaker:StopHyperParameterTuningJob

arn:aws:sagemaker:region:account-id:hyper-parameter-tuning-job/hyperParameterTuningJob

StopNotebookInstance

sagemaker:StopNotebookInstance

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName

StopTrainingJob

sagemaker:StopTrainingJob

arn:aws:sagemaker:region:account-id:training-job/trainingJobName

StopTransformJob

sagemaker:StopTransformJob

arn:aws:sagemaker:region:account-id:transform-job/transformJobName

UpdateEndpoint

sagemaker:UpdateEndpoint

arn:aws:sagemaker:region:account-id:endpoint/endpointName

UpdateEndpointWeightsAndCapacities

sagemaker:UpdateEndpointWeightsAndCapacities

arn:aws:sagemaker:region:account-id:endpoint/endpointName

UpdateNotebookInstance

sagemaker:UpdateNotebookInstance

iam:PassRole

arn:aws:sagemaker:region:account-id:notebook-instance/notebookInstanceName