AWS managed policies for Amazon SageMaker geospatial

These AWS managed policies add permissions required to use SageMaker geospatial. The policies are available in your AWS account and are used by execution roles created from the SageMaker console.

AWS managed policy: AmazonSageMakerGeospatialFullAccess

This policy grants permissions that allow full access to Amazon SageMaker geospatial through the AWS Management Console and SDK.

Permissions details

This AWS managed policy includes the following permissions.

• sagemaker-geospatial – Allows principals full access to all SageMaker geospatial resources.

• iam – Allows principals to pass an IAM role to SageMaker geospatial.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sagemaker-geospatial:*",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["iam:PassRole"],
      "Resource": "arn:aws:iam::*:role/*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "sagemaker-geospatial.amazonaws.com"
           ]
        }
      }
    }
  ]
}

AWS managed policy: AmazonSageMakerGeospatialExecutionRole

This policy grants permissions commonly needed to use SageMaker geospatial.

Permissions details

This AWS managed policy includes the following permissions.

• s3 – Allows principals to add and retrieve objects from Amazon S3 buckets. These objects are limited to those whose name contains "SageMaker", "Sagemaker", or "sagemaker".

• sagemaker-geospatial – Allows principals to access Earth observation jobs through the GetEarthObservationJob API.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
          "s3:AbortMultipartUpload",
          "s3:PutObject",
          "s3:GetObject",
          "s3:ListBucketMultipartUploads"
      ],
      "Resource": [
        "arn:aws:s3:::*SageMaker*",
        "arn:aws:s3:::*Sagemaker*",
        "arn:aws:s3:::*sagemaker*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "sagemaker-geospatial:GetEarthObservationJob",
      "Resource": "arn:aws:sagemaker-geospatial:*:*:earth-observation-job/*"
    },
    {
      "Effect": "Allow",
      "Action": "sagemaker-geospatial:GetRasterDataCollection",
      "Resource": "arn:aws:sagemaker-geospatial:*:*:raster-data-collection/*"
    }
  ]
}

Amazon SageMaker updates to Amazon SageMaker geospatial managed policies

View details about updates to AWS managed policies for SageMaker geospatial since this service began tracking these changes.

Policy	Version	Change	Date
AmazonSageMakerGeospatialExecutionRole - Updated policy	2	Add sagemaker-geospatial:GetRasterDataCollection permission.	May 10, 2023
AmazonSageMakerGeospatialFullAccess - New policy	1	Initial policy	November 30, 2022
AmazonSageMakerGeospatialExecutionRole - New policy	1	Initial policy	November 30, 2022