适用于模型注册表的 Amazon 托管式策略 - Amazon SageMaker
AmazonSageMakerModelRegistryFullAccess模型注册表策略更新
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

适用于模型注册表的 Amazon 托管式策略

这些 Amazon 托管式策略添加了使用模型注册表所需的权限。这些策略可在您的 Amazon 账户中提供，并由从 Amazon SageMaker 控制台创建的执行角色使用。

Amazon 托管式策略：AmazonSageMakerModelRegistryFullAccess

此 Amazon 托管式策略授予在 Amazon SageMaker 域中使用所有模型注册表特征所需的权限。配置模型注册表设置以启用模型注册表权限时，此策略会附加到执行角色中。

此策略包含以下权限。

  • ecr - 允许主体检索有关 Amazon Elastic Container Registry (Amazon ECR) 映像的信息，包括元数据。

  • iam - 允许主体将执行角色传递给 Amazon SageMaker 服务。

  • resource-groups - 允许主体创建、列出、标记和删除 Amazon Resource Groups。

  • s3 - 允许主体从存储模型版本的 Amazon Simple Storage Service (Amazon S3) 存储桶中检索对象。可检索的对象仅限于名称（不区分大小写）包含字符串 "sagemaker" 的对象。

  • sagemaker - 允许主体使用 SageMaker 模型注册表对模型进行编目、管理和部署。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:DescribeAction",
        "sagemaker:DescribeInferenceRecommendationsJob",
        "sagemaker:DescribeModelPackage",
        "sagemaker:DescribeModelPackageGroup",
        "sagemaker:DescribePipeline",
        "sagemaker:DescribePipelineExecution",
        "sagemaker:ListAssociations",
        "sagemaker:ListArtifacts",
        "sagemaker:ListModelMetadata",
        "sagemaker:ListModelPackages",
        "sagemaker:Search",
        "sagemaker:GetSearchSuggestions"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddTags",
        "sagemaker:CreateModel",
        "sagemaker:CreateModelPackage",
        "sagemaker:CreateModelPackageGroup",
        "sagemaker:CreateEndpoint",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateInferenceRecommendationsJob",
        "sagemaker:DeleteModelPackage",
        "sagemaker:DeleteModelPackageGroup",
        "sagemaker:DeleteTags",
        "sagemaker:UpdateModelPackage"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::*SageMaker*",
        "arn:aws:s3:::*Sagemaker*",
        "arn:aws:s3:::*sagemaker*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGetImage",
        "ecr:DescribeImages"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/*",
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": "sagemaker.amazonaws.com"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": [
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resource-groups:GetGroupQuery"
      ],
      "Resource": "arn:aws:resource-groups:*:*:group/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resource-groups:ListGroupResources"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "resource-groups:CreateGroup",
        "resource-groups:Tag"
      ],
      "Resource": "arn:aws:resource-groups:*:*:group/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:TagKeys": "sagemaker:collection"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "resource-groups:DeleteGroup",
      "Resource": "arn:aws:resource-groups:*:*:group/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/sagemaker:collection": "true"
        }
      }
    }
  ]
}

Amazon SageMaker 对模型注册表托管式策略的更新

查看有关适用于模型注册表的 Amazon 托管式策略更新的详细信息（从该服务开始跟踪这些更改开始）。有关此页面更改的自动提示，请订阅 SageMaker 文档历史记录页面上的 RSS 源。

策略 版本 更改 日期

AmazonSageMakerModelRegistryFullAccess – 新策略

1

初始策略

 2023 年 4 月 12 日