Amazon SageMaker
开发人员指南

Amazon SageMaker 角色

作为一项托管服务,Amazon SageMaker 代表您对 Amazon SageMaker 管理的 AWS 硬件执行操作。Amazon SageMaker 仅执行用户允许的操作。

Amazon SageMaker 用户可为这些权限授予 IAM 角色(称为执行角色)。进行以下 API 调用时,用户会传递该角色:CreateNotebookInstanceCreateHyperParameterTuningJobCreateTrainingJobCreateModel

您可以将以下信任策略附加到 IAM 角色,该角色可授予 Amazon SageMaker 委托人权限以代入该角色,并且对于所有执行角色均相同:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "sagemaker.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }

您需要授予该角色的权限有所不同,具体取决于您所调用的 API。以下几节解释了这些权限。

注意

您可以使用 AWS 托管的 AmazonSageMakerFullAccess 权限策略,而不用通过创建权限策略来管理权限。此策略中的权限相当广泛,以允许您执行您可能希望在 Amazon SageMaker 中执行的任何操作。有关此策略的列表,包括有关添加许多权限的原因的信息,请参阅 AmazonSageMakerFullAccess 策略。如果您更愿意创建自定义策略和管理权限以将权限限定于您需要使用执行角色执行的操作,请参阅以下主题。

有关 IAM 角色的更多信息,请参阅 IAM 用户指南 中的 IAM 角色

CreateNotebookInstance API:执行角色权限

您向执行角色授予调用 CreateNotebookInstance API 的权限取决于您计划对笔记本实例执行的操作。如果您计划用它来调用 Amazon SageMaker API,并在调用 CreateTrainingJobCreateModel API 时传递相同的角色,则将以下权限策略附加到该角色:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*", "ecr:GetAuthorizationToken", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage", "ecr:BatchCheckLayerAvailability", "ecr:SetRepositoryPolicy", "ecr:CompleteLayerUpload", "ecr:BatchDeleteImage", "ecr:UploadLayerPart", "ecr:DeleteRepositoryPolicy", "ecr:InitiateLayerUpload", "ecr:DeleteRepository", "ecr:PutImage", "ecr:CreateRepository", "cloudwatch:PutMetricData", "cloudwatch:GetMetricData", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents", "s3:CreateBucket", "s3:ListBucket", "s3:GetBucketLocation", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "robomaker:CreateSimulationApplication", "robomaker:DescribeSimulationApplication", "robomaker:DeleteSimulationApplication", "robomaker:CreateSimulationJob", "robomaker:DescribeSimulationJob", "robomaker:CancelSimulationJob", "ec2:CreateVpcEndpoint", "ec2:DescribeRouteTables", "fsx:DescribeFileSystem", "elasticfilesystem:DescribeMountTargets ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "codecommit:GitPull", "codecommit:GitPush" ], "Resource": [ "arn:aws:codecommit:*:*:*sagemaker*", "arn:aws:codecommit:*:*:*SageMaker*", "arn:aws:codecommit:*:*:*Sagemaker*" ] } { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } } ] }

要收紧权限,请替换 "Resource": "*" 以使权限仅限于特定的 Amazon S3 和 Amazon ECR 资源,如下所示:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "sagemaker:*", "ecr:GetAuthorizationToken", "cloudwatch:PutMetricData", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "sagemaker.amazonaws.com" } } }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::inputbucket" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::inputbucket/object1", "arn:aws:s3:::outputbucket/path", "arn:aws:s3:::inputbucket/object2", "arn:aws:s3:::inputbucket/object3" ] }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": [ "arn:aws:ecr:::repository/my-repo1", "arn:aws:ecr:::repository/my-repo2", "arn:aws:ecr:::repository/my-repo3" ] } ] }

如果您计划访问其他资源(如 Amazon DynamoDB 或 Amazon Relational Database Service),请向此策略添加相关权限。

在上一个策略中,您按如下方式确定策略范围:

  • 仅向您在 s3:ListBucket 请求中指定作为 InputDataConfig.DataSource.S3DataSource.S3Uri 的特定存储桶授予 CreateTrainingJob 权限。

  • 按如下方式确定 s3:GetObject s3:PutObjects3:DeleteObject 的权限范围:

    • 将范围限定为您在 CreateTrainingJob 请求中指定的以下值:

      InputDataConfig.DataSource.S3DataSource.S3Uri

      OutputDataConfig.S3OutputPath

    • 将范围限定为您在 CreateModel 请求中指定的以下值:

      PrimaryContainer.ModelDataUrl

      SuplementalContainers.ModelDataUrl

  • 按如下方式确定 ecr 权限的范围:

    • 将范围限定为您在 AlgorithmSpecification.TrainingImage 请求中指定的 CreateTrainingJob 值。

    • 将范围限定为您在 PrimaryContainer.Image 请求中指定的 CreateModel 值:

cloudwatchlogs 操作适用于“*”资源。有关更多信息,请参阅 Amazon CloudWatch 用户指南 中的 CloudWatch 资源和操作

CreateHyperParameterTuningJob API:执行角色权限

对于可在 CreateHyperParameterTuningJob API 请求中传递的执行角色,您可以将以下权限策略附加到该角色:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:DescribeLogStreams", "s3:GetObject", "s3:PutObject", "s3:ListBucket", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": "*" } ] }

您无需指定 "Resource": "*",而是可以将这些权限限制为特定的 Amazon S3 和 Amazon ECR 资源:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:DescribeLogStreams", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::inputbucket" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::inputbucket/object", "arn:aws:s3:::outputbucket/path" ] }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": "arn:aws:ecr:::repository/my-repo" } ] }

如果与超参数优化作业关联的训练容器需要访问其他数据源(如 DynamoDB 或 Amazon RDS 资源),则向此策略添加相关权限。

在上一个策略中,您按如下方式确定策略范围:

  • 仅向您在 s3:ListBucket 请求中指定作为 InputDataConfig.DataSource.S3DataSource.S3Uri 的特定存储桶授予 CreateTrainingJob 权限。

  • 仅向您在 s3:GetObject 请求的输入和输出数据配置中指定的以下对象授予 s3:PutObjectCreateHyperParameterTuningJob 权限:

    InputDataConfig.DataSource.S3DataSource.S3Uri

    OutputDataConfig.S3OutputPath

  • 仅向您在 CreateHyperParameterTuningJob 请求中指定的注册表路径 (AlgorithmSpecification.TrainingImage) 授予 Amazon ECR 权限。

cloudwatchlogs 操作适用于“*”资源。有关更多信息,请参阅 Amazon CloudWatch 用户指南 中的 CloudWatch 资源和操作

如果您为超参数优化作业指定一个私有 VPC,请添加以下权限:

{ "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups"

如果您的输入采用服务器端加密加 AWS KMS 托管密钥 (SSE-KMS) 进行加密,则添加以下权限:

{ "Effect": "Allow", "Action": [ "kms:Decrypt" ] }

如果在超参数优化作业的输出配置中指定一个 KMS 密钥,则添加以下权限:

{ "Effect": "Allow", "Action": [ "kms:Encrypt" ] }

如果在超参数优化作业的资源配置中指定一个批量 KMS 密钥,则添加以下权限:

{ "Effect": "Allow", "Action": [ "kms:CreateGrant" ] }

CreateTrainingJob API:执行角色权限

对于可在 CreateTrainingJob API 请求中传递的执行角色,您可以将以下权限策略附加到该角色:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:DescribeLogStreams", "s3:GetObject", "s3:PutObject", "s3:ListBucket", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": "*" } ] }

您无需指定 "Resource": "*",而是可以将这些权限限制为特定的 Amazon S3 和 Amazon ECR 资源:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:DescribeLogStreams", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::inputbucket" ] }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": [ "arn:aws:s3:::inputbucket/object", "arn:aws:s3:::outputbucket/path" ] }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": "arn:aws:ecr:::repository/my-repo" } ] }

如果 CreateTrainingJob.AlgorithSpecifications.TrainingImage 需要访问其他数据源(如 DynamoDB 或 Amazon RDS 资源),则向此策略添加相关权限。

在上一个策略中,您按如下方式确定策略范围:

  • 仅向您在 s3:ListBucket 请求中指定作为 InputDataConfig.DataSource.S3DataSource.S3Uri 的特定存储桶授予 CreateTrainingJob 权限。

  • 仅向您在 s3:GetObject 请求的输入和输出数据配置中指定的以下对象授予 s3:PutObjectCreateTrainingJob 权限:

    InputDataConfig.DataSource.S3DataSource.S3Uri

    OutputDataConfig.S3OutputPath

  • 仅向您在 CreateTrainingJob 请求中指定的注册表路径 (AlgorithmSpecification.TrainingImage) 授予 Amazon ECR 权限。

cloudwatchlogs 操作适用于“*”资源。有关更多信息,请参阅 Amazon CloudWatch 用户指南 中的 CloudWatch 资源和操作

如果您为训练作业指定一个私有 VPC,请添加以下权限:

{ "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups"

如果您的输入采用服务器端加密加 AWS KMS 托管密钥 (SSE-KMS) 进行加密,则添加以下权限:

{ "Effect": "Allow", "Action": [ "kms:Decrypt" ] }

如果在训练作业的输出配置中指定一个 KMS 密钥,则添加以下权限:

{ "Effect": "Allow", "Action": [ "kms:Encrypt" ] }

如果在训练作业的资源配置中指定一个批量 KMS 密钥,则添加以下权限:

{ "Effect": "Allow", "Action": [ "kms:CreateGrant" ] }

CreateModel API:执行角色权限

对于可在 CreateModel API 请求中传递的执行角色,您可以将以下权限策略附加到该角色:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:DescribeLogStreams", "s3:GetObject", "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": "*" } ] }

您无需指定 "Resource": "*",而是可以将这些权限限制为特定的 Amazon S3 和 Amazon ECR 资源:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "logs:CreateLogStream", "logs:PutLogEvents", "logs:CreateLogGroup", "logs:DescribeLogStreams", "ecr:GetAuthorizationToken" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "s3:GetObject" ], "Resource": [ "arn:aws:s3:::inputbucket/object", "arn:aws:s3:::inputbucket/object" ] }, { "Effect": "Allow", "Action": [ "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:BatchGetImage" ], "Resource": [ "arn:aws:ecr:::repository/my-repo", "arn:aws:ecr:::repository/my-repo" ] } ] }

如果 CreateModel.PrimaryContainer.Image 需要访问其他数据源 (如 Amazon DynamoDB 或 Amazon RDS 资源),则向此策略添加相关权限。

在上一个策略中,您按如下方式确定策略范围:

  • 仅向您在 PrimaryContainer.ModelDataUrl 请求的 CreateModel 中指定的对象授予 S3 权限。

  • 仅向您在 CreateModel 请求中指定作为 PrimaryContainer.ImageSecondaryContainer.Image 的特定注册表路径授予 Amazon ECR 权限。

cloudwatchlogs 操作适用于“*”资源。有关更多信息,请参阅 Amazon CloudWatch 用户指南 中的 CloudWatch 资源和操作

如果您为模型指定一个私有 VPC,请添加以下权限:

{ "Effect": "Allow", "Action": [ "ec2:CreateNetworkInterface", "ec2:CreateNetworkInterfacePermission", "ec2:DeleteNetworkInterface", "ec2:DeleteNetworkInterfacePermission", "ec2:DescribeNetworkInterfaces", "ec2:DescribeVpcs", "ec2:DescribeDhcpOptions", "ec2:DescribeSubnets", "ec2:DescribeSecurityGroups"

AmazonSageMakerFullAccess 策略

AmazonSageMakerFullAccess 托管策略包括在 Amazon SageMaker 中执行大多数操作的所有必需权限。您可以将此策略附加到您传递到 Amazon SageMaker 执行角色的任何角色。如果您希望更精细地控制您授予执行角色的权限,也可以创建作用域更窄的策略。

下表说明了为什么需要 AmazonSageMakerFullAccess 策略中某些类别的权限。

application-autoscaling

自动扩展一个 Amazon SageMaker 实时推导终端节点时所需。

aws-marketplace

查看 AWS AI Marketplace 订阅时所需。

cloudwatch

发布 CloudWatch 指标、与警报交互以及上传您账户中的 CloudWatch Logs 日志时所需。

codecommit

AWS CodeCommit 与 Amazon SageMaker 笔记本实例相集成时所需。

cognito

Amazon SageMaker Ground Truth 定义您的私有人力和工作团队时所需。

ec2

在您为您的 Amazon SageMaker 作业和笔记本实例指定一个 Amazon VPC 的情况下,管理弹性网络接口时所需。

ec2:DescribeVpcs

所有 Amazon SageMaker 服务启动 Amazon EC2 实例并需要此权限集。

ecr

提取和存储 Docker 项目以进行培训和推理时所需。仅当您要在 Amazon SageMaker 中使用您自己的容器时,才需要此权限。

elastic-inference

将 Amazon Elastic Inference 与 Amazon SageMaker 集成时所需。

glue

从 Amazon SageMaker 笔记本实例中预处理推理管道时所需。

groundtruthlabeling

Amazon SageMaker Ground Truth 所需。

iam:ListRoles

授予 Amazon SageMaker 控制台列出可用角色的访问权限时所需。

kms

授予 Amazon SageMaker 控制台列出可用 AWS KMS 键的访问权限时所需。

logs

允许 Amazon SageMaker 作业和终端节点发布日志流时所需。