Step 7: Create an IAM role for SageMaker notebooks
If you plan to use SageMaker notebooks with development endpoints, you need to grant the IAM role permissions. You provide those permissions by using Amazon Identity and Access Management (IAM), through an IAM role.
To create an IAM role for SageMaker notebooks
Sign in to the Amazon Web Services Management Console and open the IAM console at https://console.amazonaws.cn/iam/
. -
In the left navigation pane, choose Roles.
-
Choose Create role.
-
For role type, choose Amazon Service, find and choose SageMaker, and then choose the SageMaker - Execution use case. Then choose Next: Permissions.
-
On the Attach permissions policy page, choose the policies that contain the required permissions; for example, AmazonSageMakerFullAccess. Choose Next: Review.
If you plan to access Amazon S3 sources and targets that are encrypted with SSE-KMS, attach a policy that allows notebooks to decrypt the data, as shown in the following example. For more information, see Protecting Data Using Server-Side Encryption with Amazon KMS-Managed Keys (SSE-KMS).
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ "kms:Decrypt" ], "Resource":[ "arn:aws-cn:kms:*:
account-id-without-hyphens
:key/key-id
" ] } ] } -
For Role name, enter a name for your role. To allow the role to be passed from console users to SageMaker, use a name that is prefixed with the string
AWSGlueServiceSageMakerNotebookRole
. Amazon Glue provided policies expect IAM roles to begin withAWSGlueServiceSageMakerNotebookRole
. Otherwise you must add a policy to your users to allow theiam:PassRole
permission for IAM roles to match your naming convention.For example, enter
AWSGlueServiceSageMakerNotebookRole-Default
, and then choose Create role. -
After you create the role, attach the policy that allows additional permissions required to create SageMaker notebooks from Amazon Glue.
Open the role that you just created,
AWSGlueServiceSageMakerNotebookRole-Default
, and choose Attach policies. Attach the policy that you created namedAWSGlueSageMakerNotebook
to the role.