Amazon SageMaker (sagemaker)

Additions

Actions

• CreateHub
  
  • Description:  Grants permission to create a hub
  • Access:  Write
  • Resources: 

    Name: hub

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

    aws:RequestTag/${TagKey}

    aws:TagKeys

  • Dependents: 

    sagemaker:AddTags

• CreateInferenceExperiment
  
  • Description:  Grants permission to create an inference experiment
  • Access:  Write
  • Resources: 

    Name: inference-experiment

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

    aws:RequestTag/${TagKey}

    aws:TagKeys

  • Dependents: 

    iam:PassRole

    sagemaker:AddTags

• CreateModelCard
  
  • Description:  Grants permission to create a model card
  • Access:  Write
  • Resources: 

    Name: model-card

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

    aws:RequestTag/${TagKey}

    aws:TagKeys

  • Dependents: 

    sagemaker:AddTags

• CreateModelCardExportJob
  
  • Description:  Grants permission to create an export job for a model card
  • Access:  Write
  • Resources: 

    Name: model-card

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• CreateSpace
  
  • Description:  Grants permission to create a Space for a SageMaker Domain
  • Access:  Write
  • Resources: 

    Name: space

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

    aws:RequestTag/${TagKey}

    aws:TagKeys

    sagemaker:InstanceTypes

    sagemaker:ImageArns

    sagemaker:ImageVersionArns

  • Dependents: 

    sagemaker:AddTags

• DeleteHub
  
  • Description:  Grants permission to delete hubs
  • Access:  Write
  • Resources: 

    Name: hub

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DeleteHubContent
  
  • Description:  Grants permission to delete hub content
  • Access:  Write
  • Resources: 

    Name: hub

    Required: Yes

    Name: hub-content

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DeleteInferenceExperiment
  
  • Description:  Grants permission to delete an inference experiment
  • Access:  Write
  • Resources: 

    Name: inference-experiment

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DeleteModelCard
  
  • Description:  Grants permission to delete a model card
  • Access:  Write
  • Resources: 

    Name: model-card

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DeleteSpace
  
  • Description:  Grants permission to delete a Space
  • Access:  Write
  • Resources: 

    Name: space

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DescribeHub
  
  • Description:  Grants permission to describe hubs
  • Access:  Read
  • Resources: 

    Name: hub

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DescribeHubContent
  
  • Description:  Grants permission to describe hub content
  • Access:  Read
  • Resources: 

    Name: hub

    Required: Yes

    Name: hub-content

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DescribeInferenceExperiment
  
  • Description:  Grants permission to get information about an inference experiment
  • Access:  Read
  • Resources: 

    Name: inference-experiment

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DescribeModelCard
  
  • Description:  Grants permission to get information about a model card
  • Access:  Read
  • Resources: 

    Name: model-card

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• DescribeModelCardExportJob
  
  • Description:  Grants permission to get information about a model card export job
  • Access:  Read
  • Resources: 

    Name: model-card-export-job

    Required: Yes

• DescribeSpace
  
  • Description:  Grants permission to describe a Space
  • Access:  Read
  • Resources: 

    Name: space

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ImportHubContent
  
  • Description:  Grants permission to import hub content
  • Access:  Write
  • Resources: 

    Name: hub

    Required: Yes

    Name: hub-content

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

    aws:RequestTag/${TagKey}

    aws:TagKeys

  • Dependents: 

    sagemaker:AddTags

• ListHubContentVersions
  
  • Description:  Grants permission to list all versions of hub content
  • Access:  List
  • Resources: 

    Name: hub

    Required: Yes

    Name: hub-content

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ListHubContents
  
  • Description:  Grants permission to list newest versions of hub content
  • Access:  List
  • Resources: 

    Name: hub

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ListHubs
  
  • Description:  Grants permission to list hubs
  • Access:  List
• ListInferenceExperiments
  
  • Description:  Grants permission to list inference experiments
  • Access:  List
• ListModelCardExportJobs
  
  • Description:  Grants permission to list export jobs for a model card
  • Access:  List
  • Resources: 

    Name: model-card

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ListModelCardVersions
  
  • Description:  Grants permission to list versions of a model card
  • Access:  List
  • Resources: 

    Name: model-card

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• ListModelCards
  
  • Description:  Grants permission to list model cards
  • Access:  List
• ListMonitoringAlertHistory
  
  • Description:  Grants permission to list the history of a monitoring alert
  • Access:  List
• ListMonitoringAlerts
  
  • Description:  Grants permission to list monitoring alerts
  • Access:  List
• ListSpaces
  
  • Description:  Grants permission to list the Spaces in your account
  • Access:  List
• StartInferenceExperiment
  
  • Description:  Grants permission to start an inference experiment
  • Access:  Write
  • Resources: 

    Name: inference-experiment

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• StopInferenceExperiment
  
  • Description:  Grants permission to stop an inference experiment
  • Access:  Write
  • Resources: 

    Name: inference-experiment

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• UpdateHub
  
  • Description:  Grants permission to update hubs
  • Access:  Write
  • Resources: 

    Name: hub

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• UpdateInferenceExperiment
  
  • Description:  Grants permission to update an inference experiment
  • Access:  Write
  • Resources: 

    Name: inference-experiment

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• UpdateModelCard
  
  • Description:  Grants permission to update a model card
  • Access:  Write
  • Resources: 

    Name: model-card

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• UpdateMonitoringAlert
  
  • Description:  Grants permission to update a monitoring alert
  • Access:  Write
  • Resources: 

    Name: monitoring-schedule

    Required: Yes

    Name: monitoring-schedule-alert

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• UpdateSpace
  
  • Description:  Grants permission to update a Space
  • Access:  Write
  • Resources: 

    Name: space

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

    sagemaker:InstanceTypes

    sagemaker:ImageArns

    sagemaker:ImageVersionArns

Resources

• hub
  
  • Arn:  arn:${Partition}:sagemaker:${Region}:${Account}:hub/${HubName}
• hub-content
  
  • Arn:  arn:${Partition}:sagemaker:${Region}:${Account}:hub-content/${HubName}/${HubContentType}/${HubContentName}
• inference-experiment
  
  • Arn:  arn:${Partition}:sagemaker:${Region}:${Account}:inference-experiment/${InferenceExperimentName}
  • Conditions: 

    aws:ResourceTag/${TagKey}

    sagemaker:ResourceTag/${TagKey}

• space
  
  • Arn:  arn:${Partition}:sagemaker:${Region}:${Account}:space/${DomainId}/${SpaceName}
  • Conditions: 

    aws:ResourceTag/${TagKey}

    sagemaker:ResourceTag/${TagKey}

• monitoring-schedule-alert
  
  • Arn:  arn:${Partition}:sagemaker:${Region}:${Account}:monitoring-schedule/${MonitoringScheduleName}/alert/${MonitoringScheduleAlertName}
• model-card
  
  • Arn:  arn:${Partition}:sagemaker:${Region}:${Account}:model-card/${ModelCardName}
  • Conditions: 

    aws:ResourceTag/${TagKey}

    sagemaker:ResourceTag/${TagKey}

• model-card-export-job
  
  • Arn:  arn:${Partition}:sagemaker:${Region}:${Account}:model-card/${ModelCardName}/export-job/${ExportJobName}
  • Conditions: 

    aws:ResourceTag/${TagKey}

    sagemaker:ResourceTag/${TagKey}

Updates

Actions

• AddTags
  
  Resources
  
  • ＋ model-card
• DeleteTags
  
  Resources
  
  • ＋ model-card
• ListTags
  
  Resources
  
  • ＋ model-card