Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions,
see Getting Started with Amazon Web Services in China
(PDF).
IAM policies for Amazon SageMaker calls in Step Functions
The following example templates show how Amazon Step Functions generates IAM policies based on the resources in your
state machine definition. For more information, see How Step Functions generates IAM policies for integrated
services and Discover service integration patterns in Step Functions.
For these examples, [[roleArn]]
refers to the
Amazon Resource Name (ARN) of the IAM role that SageMaker uses to access model artifacts and docker images
for deployment on ML compute instances, or for batch transform jobs. For more information, see
Amazon SageMaker Roles.
CreateTrainingJob
Static resources
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob",
"sagemaker:DescribeTrainingJob",
"sagemaker:StopTrainingJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:training-job/[[trainingJobName]]
*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:PutRule",
"events:DescribeRule"
],
"Resource": [
"arn:aws:events:[[region]]
:[[accountId]]
:rule/StepFunctionsGetEventsForSageMakerTrainingJobsRule"
]
}
]
}
- Request Response and Callback (.waitForTaskToken)
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:training-job/[[trainingJobName]]
*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
}
]
}
Dynamic resources
- .sync or .waitForTaskToken
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob",
"sagemaker:DescribeTrainingJob",
"sagemaker:StopTrainingJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:training-job/*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:PutRule",
"events:DescribeRule"
],
"Resource": [
"arn:aws:events:[[region]]
:[[accountId]]
:rule/StepFunctionsGetEventsForSageMakerTrainingJobsRule"
]
}
]
}
- Request Response and Callback (.waitForTaskToken)
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTrainingJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:training-job/*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
}
]
}
Amazon Step Functions will not automatically create a policy for CreateTransformJob
when you create a state machine that integrates with SageMaker. You must attach an inline policy
to the created role based on one of the following IAM examples.
Static resources
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTransformJob",
"sagemaker:DescribeTransformJob",
"sagemaker:StopTransformJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:transform-job/[[transformJobName]]
*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:PutRule",
"events:DescribeRule"
],
"Resource": [
"arn:aws:events:[[region]]
:[[accountId]]
:rule/StepFunctionsGetEventsForSageMakerTransformJobsRule"
]
}
]
}
- Request Response and Callback (.waitForTaskToken)
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTransformJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:transform-job/[[transformJobName]]
*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
}
]
}
Dynamic resources
- Run a Job (.sync)
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTransformJob",
"sagemaker:DescribeTransformJob",
"sagemaker:StopTransformJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:transform-job/*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
},
{
"Effect": "Allow",
"Action": [
"events:PutTargets",
"events:PutRule",
"events:DescribeRule"
],
"Resource": [
"arn:aws:events:[[region]]
:[[accountId]]
:rule/StepFunctionsGetEventsForSageMakerTransformJobsRule"
]
}
]
}
- Request Response and Callback (.waitForTaskToken)
-
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sagemaker:CreateTransformJob"
],
"Resource": [
"arn:aws:sagemaker:[[region]]
:[[accountId]]
:transform-job/*"
]
},
{
"Effect": "Allow",
"Action": [
"sagemaker:ListTags"
],
"Resource": [
"*"
]
},
{
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"[[roleArn]]
"
],
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
}
]
}