AWS 的 Model Registry 受管政策

這些 AWS 受管政策新增使用 Model Registry 所需的許可。這些政策可在您的AWS帳戶中使用，並由從 Amazon SageMaker 主控台建立的執行角色使用。

AWS受管理的策略： AmazonSageMakerModelRegistryFullAccess

此AWS受管政策授予使用 Amazon SageMaker 網域內所有模型登錄功能所需的許可。設定 Model Registry 設定以啟用 Model Registry 許可時，此政策會附加至執行角色。

此政策包含以下許可。

• ecr - 讓主體擷取關於 Amazon Elastic Container Registry (Amazon ECR) 映像的資訊，包括中繼資料。

• iam— 允許主體將執行角色傳遞給 Amazon SageMaker 服務。

• resource-groups - 讓主體建立、列出、標籤及刪除 AWS Resource Groups。

• s3 - 讓主體從存放模型版本的 Amazon Simple Storage Service (Amazon S3) 儲存貯體擷取物件。可擷取的物件僅限於名稱包含字串 "sagemaker" 的物件 (不區分大小寫)。

• sagemaker-允許主參與者使用 SageMaker 模型登錄來編目、管理及部署模型。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:DescribeAction",
        "sagemaker:DescribeInferenceRecommendationsJob",
        "sagemaker:DescribeModelPackage",
        "sagemaker:DescribeModelPackageGroup",
        "sagemaker:DescribePipeline",
        "sagemaker:DescribePipelineExecution",
        "sagemaker:ListAssociations",
        "sagemaker:ListArtifacts",
        "sagemaker:ListModelMetadata",
        "sagemaker:ListModelPackages",
        "sagemaker:Search",
        "sagemaker:GetSearchSuggestions"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddTags",
        "sagemaker:CreateModel",
        "sagemaker:CreateModelPackage",
        "sagemaker:CreateModelPackageGroup",
        "sagemaker:CreateEndpoint",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateInferenceRecommendationsJob",
        "sagemaker:DeleteModelPackage",
        "sagemaker:DeleteModelPackageGroup",
        "sagemaker:DeleteTags",
        "sagemaker:UpdateModelPackage"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::*SageMaker*",
        "arn:aws:s3:::*Sagemaker*",
        "arn:aws:s3:::*sagemaker*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGetImage",
        "ecr:DescribeImages"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "sagemaker.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resource-groups:GetGroupQuery"
      ],
      "Resource": "arn:aws:resource-groups:*:*:group/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resource-groups:ListGroupResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resource-groups:CreateGroup",
        "resource-groups:Tag"
      ],
      "Resource": "arn:aws:resource-groups:*:*:group/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:TagKeys": "sagemaker:collection"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "resource-groups:DeleteGroup",
      "Resource": "arn:aws:resource-groups:*:*:group/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/sagemaker:collection": "true"
        }
      }
    }
  ]
}

模型登錄受管政策的 Amazon SageMaker 更新

檢視自 Model Registry 開始追蹤受管政策異動以來的 AWS 受管政策更新相關詳細資訊。如需有關此頁面變更的自動警示，請訂閱「 SageMaker 文件歷史記錄」頁面上的 RSS 摘要。

政策	版本	變更	日期
AmazonSageMakerModelRegistryFullAccess – 新政策	1	初始政策	2023 年 4 月 12 日