Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon managed policies for SageMaker AI job runtime

Attach this policy to the IAM role that your agent runtime uses. It grants your agent runtime the permissions needed to invoke Amazon SageMaker AI job runtime APIs during model customization for sample generation, trajectory completion, and reward submission.

Amazon managed policy: AmazonSageMakerJobRuntimeAccess

Use this policy to give your agent runtime the permissions to invoke SageMaker AI job runtime APIs during model customization for sample generation, trajectory completion, and reward submission. This policy restricts all permissions to resources within your Amazon account.

Permissions details

This policy includes the following permissions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SageMakerJobRuntimePermissions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:Sample",
                "sagemaker:SampleWithResponseStream",
                "sagemaker:CompleteRollout",
                "sagemaker:UpdateReward"
            ],
            "Resource": "arn:aws:sagemaker:*:*:job/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "BearerTokenPermissions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:CallWithBearerToken"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "KMSPermissionsForMTRLRuntime",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "arn:aws:kms:*:*:key/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                },
                "StringLike": {
                    "kms:ViaService": "sagemaker.*.amazonaws.com"
                }
            }
        }
    ]
}

For more information about this policy, see AmazonSageMakerJobRuntimeAccess in the Amazon Managed Policy Reference Guide.

Amazon SageMaker AI updates to SageMaker AI job runtime managed policies

View details about updates to Amazon managed policies for Amazon SageMaker AI since Amazon SageMaker AI began tracking these changes.