Set up Partner AI Apps

Grant permissions for Amazon Web Services Marketplace. Partner AI Apps administrators require these permissions to purchase subscriptions to Partner AI Apps from Amazon Web Services Marketplace. To get access to Amazon Web Services Marketplace, admins must attach the AWSMarketplaceManageSubscriptions managed policy to the IAM role that they're using to access the SageMaker AI console and purchase the app. For details about the AWSMarketplaceManageSubscriptions managed policy, see Amazon managed policies for Amazon Web Services Marketplace buyers. For information about attaching managed policies, see Adding and removing IAM identity permissions.

Grant permissions for SageMaker AI to run operations on the admins behalf using other Amazon Web Services services. Admins must grant SageMaker AI permissions to use these services and the resources that they act upon. The following policy definition demonstrates how to grant the required Partner AI Apps permissions. These permissions are needed in addition to the existing permissions for the admin role. For more information, see How to use SageMaker AI execution roles.

Partner AI Apps require an execution role to interact with resources in the Amazon Web Services account. Admins can create this execution role using the Amazon CLI. The Partner AI App uses this role to complete actions related to Partner AI App functionality.

aws iam create-role --role-name PartnerAiAppExecutionRole --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "sagemaker.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}'

Create the Amazon License Manager service-linked role by following the steps in Create a service-linked role for License Manager. 

Grant permissions for the Partner AI App to access License Manager using the Amazon CLI. These permissions are required to access the licenses for Partner AI App. This allows the Partner AI App to verify access to the Partner AI App license.

aws iam put-role-policy --role-name PartnerAiAppExecutionRole --policy-name LicenseManagerPolicy --policy-document '{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": [
      "license-manager:CheckoutLicense",
      "license-manager:CheckInLicense",
      "license-manager:ExtendLicenseConsumption",
      "license-manager:GetLicense",
      "license-manager:GetLicenseUsage"
    ],
    "Resource": "*"
  }
}'

If the Partner AI App requires access to an Amazon S3 bucket, then add Amazon S3 permissions to the execution role. For more information, see Required permissions for Amazon S3 API operations.

Grant permissions for SageMaker AI to run operations on your behalf using other Amazon Web Services services. Admins must grant SageMaker AI permissions to use these services and the resources that they act upon. Admins grant SageMaker AI these permissions using an IAM execution role. For more information about IAM roles, see IAM roles. The following policy definition demonstrates how to grant the required Partner AI Apps permissions. This policy can be added to the execution role of the user profile.  For more information, see How to use SageMaker AI execution roles.

(Optional) If launching Partner AI Apps from Studio, add the sts:TagSession trust policy to the role used to launch Studio or the Partner AI Apps directly as follows. This makes sure that the identity can be propagated properly.

{
    "Effect": "Allow",
    "Principal": {
        "Service": "sagemaker.amazonaws.com"
    },
    "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
             ]
}

(Optional) If using the SDK of a Partner AI App to access functionality in SageMaker AI, add the following CallPartnerAppApi permission to the role used to run the SDK code. If running the SDK code from Studio, add the permission to the Studio execution role. If running the code from anywhere other than Studio, add the permission to the IAM role used with the notebook. This gives the user access the Partner AI App functionality from the Partner AI App’s SDK.