本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy
描述：允許 Amazon Bedrock 知識庫存取 SageMaker Studio 中的 Amazon Bedrock 模型和資料來源。
SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy 是 AWS 受管政策。
使用此政策
您可以SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy連接到您的使用者、群組和角色。
政策詳細資訊
-
類型：服務角色政策
-
建立時間：2025 年 2 月 25 日 02：52 UTC
-
編輯時間：2025 年 7 月 15 日 17：22 UTC
-
ARN:
arn:aws:iam::aws:policy/service-role/SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy
政策版本
政策版本： v3 （預設）
政策的預設版本是定義政策許可的版本。當具有 政策的使用者或角色提出存取 AWS 資源的請求時， 會 AWS 檢查政策的預設版本，以決定是否允許請求。
JSON 政策文件
{ "Version" : "2012-10-17", "Statement" : [ { "Sid" : "BedrockAppInferenceProfileInvocationPermissions", "Effect" : "Allow", "Action" : [ "bedrock:GetInferenceProfile", "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource" : "arn:aws:bedrock:*:*:application-inference-profile/*", "Condition" : { "StringEquals" : { "aws:ResourceTag/AmazonDataZoneProject" : "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid" : "BedrockModelInvocationPermission", "Effect" : "Allow", "Action" : [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource" : [ "arn:aws:bedrock:*::foundation-model/*", "arn:aws:bedrock:*:*:custom-model/*", "arn:aws:bedrock:*:*:provisioned-model/*" ], "Condition" : { "Null" : { "bedrock:InferenceProfileArn" : "false" } } }, { "Sid" : "OpenSearchServerlessPermissions", "Effect" : "Allow", "Action" : "aoss:APIAccessAll", "Resource" : "arn:aws:aoss:*:*:collection/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringLike" : { "aoss:collection" : "bedrock*" } } }, { "Sid" : "ListDomainS3BucketPermissions", "Effect" : "Allow", "Action" : "s3:ListBucket", "Resource" : "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringLike" : { "s3:prefix" : [ "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}", "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*" ] }, "StringNotEquals" : { "aws:PrincipalTag/DomainBucketName" : "", "aws:PrincipalTag/AmazonDataZoneDomain" : "", "aws:PrincipalTag/AmazonDataZoneProject" : "" } } }, { "Sid" : "AccessDomainS3BucketPermissions", "Effect" : "Allow", "Action" : [ "s3:GetObject", "s3:GetObjectVersion" ], "Resource" : "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringNotEquals" : { "aws:PrincipalTag/DomainBucketName" : "", "aws:PrincipalTag/AmazonDataZoneDomain" : "", "aws:PrincipalTag/AmazonDataZoneProject" : "" } } }, { "Sid" : "VectorStoresKms", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition" : { "StringLike" : { "kms:ViaService" : [ "neptune-graph.*.amazonaws.com", "s3vectors.*.amazonaws.com" ] }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "Null" : { "kms:EncryptionContextKeys" : "false" } } }, { "Sid" : "VectorStoresKmsDescribeKey", "Effect" : "Allow", "Action" : [ "kms:DescribeKey" ], "Resource" : "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition" : { "StringLike" : { "kms:ViaService" : [ "neptune-graph.*.amazonaws.com", "s3vectors.*.amazonaws.com" ] }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "NeptuneGraphDataAccess", "Effect" : "Allow", "Action" : [ "neptune-graph:GetGraph", "neptune-graph:DeleteDataViaQuery", "neptune-graph:WriteDataViaQuery", "neptune-graph:ReadDataViaQuery" ], "Resource" : "arn:aws:neptune-graph:*:*:graph/*", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}", "aws:ResourceTag/AmazonDataZoneProject" : "${aws:PrincipalTag/AmazonDataZoneProject}" } } }, { "Sid" : "S3VectorsDataAccess", "Effect" : "Allow", "Action" : [ "s3vectors:GetVectorBucket", "s3vectors:GetIndex", "s3vectors:PutVectors", "s3vectors:GetVectors", "s3vectors:ListVectors", "s3vectors:QueryVectors", "s3vectors:DeleteVectors" ], "Resource" : "arn:aws:s3vectors:*:*:bucket/amazon-bedrock-ide-${aws:PrincipalTag/AmazonDataZoneProject}*", "Condition" : { "StringNotEquals" : { "aws:PrincipalTag/AmazonDataZoneProject" : "" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" } } }, { "Sid" : "BedrockKnowledgeBaseKmsPermissions", "Effect" : "Allow", "Action" : [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource" : "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition" : { "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "StringLike" : { "kms:EncryptionContext:aws:bedrock:arn" : "arn:aws:bedrock:*:${aws:PrincipalAccount}:knowledge-base/*" } } }, { "Sid" : "S3KmsPermissions", "Effect" : "Allow", "Action" : "kms:Decrypt", "Resource" : "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", "Condition" : { "StringLike" : { "kms:ViaService" : "s3.*.amazonaws.com" }, "StringEquals" : { "aws:ResourceAccount" : "${aws:PrincipalAccount}" }, "ArnLike" : { "kms:EncryptionContext:aws:s3:arn" : [ "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" ] } } }, { "Sid" : "SqlWorkbenchAccessPermissions", "Effect" : "Allow", "Action" : [ "sqlworkbench:GetSqlRecommendations", "sqlworkbench:PutSqlGenerationContext", "sqlworkbench:GetSqlGenerationContext", "sqlworkbench:DeleteSqlGenerationContext" ], "Resource" : "*" }, { "Sid" : "BedrockGenerateQueryPermissions", "Effect" : "Allow", "Action" : [ "bedrock:GenerateQuery" ], "Resource" : "*" } ] }
進一步了解
