AI & Machine Learning policies

Provides full access to Amazon SageMaker via the AWS Management Console and SDK. Also provides select access to related services (e.g., S3, ECR, CloudWatch Logs).

This Amazon Managed Policy provides the necessary permissions for SageMaker HyperPod to access gated models in SageMaker Jumpstart. It allows creating presigned URLs for hub content in the SageMaker Public Hub.

This policy provides administrative permissions required to set up the SageMaker HyperPod training operator. It enables access to Amazon SageMaker HyperPod and EKS add-ons. The policy includes permissions to describe the SageMaker HyperPod …

Provides read only access to Amazon SageMaker via the AWS Management Console and SDK.

Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in your account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.

Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in the local account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.

Provides full access to Amazon Bedrock Web Search, including retrieval of content from external websites outside the AWS network boundary.

Provides read-only access to Amazon Bedrock Web Search, including retrieval of content from external websites outside the AWS network boundary.

Provides full access to Amazon Bedrock as well as limited access to related services that are required by it

Provides read only access to Amazon Bedrock

Provides full access to Amazon Lookout for Vision and scoped access to required service and console dependencies.

Provides read only access to Amazon Lookout for Vision and scoped access to required service and console dependencies.

Provides full access to Amazon Lookout for Vision and scoped access to required dependencies.

Provides read only access to Amazon Lookout for Vision and scoped access to required dependencies.

Provides full access to Amazon Lex via the AWS Management Console. Also provides access to create Lex Service Linked Roles and grant Lex permissions to invoke a limited set of Lambda functions.

Provides read-only access to Amazon Lex.

This policy may be attached to any User, Role, or Group, in order to grant users permission to list and view projects in AWS Mobile Hub. This also includes permissions to generate and download sample mobile app source code for each Mobile H…

Grants full access to Amazon AI Operations service and its required permissions via AWS console. It also includes permissions to use identity-aware console sessions.

Grants ReadOnly permissions to the Amazon AI Operations service and its required resources.

Provides full access to Amazon Bedrock Mantle as well as limited access to related services that are required by it

Provides read only access to Amazon Bedrock Mantle

Provides full access to Amazon Bedrock Web Search. Data remains within the AWS network boundary.

Provides read-only access to Amazon Bedrock Web Search. Data remains within the AWS network boundary.

Provides full access to Amazon Comprehend.

Provides read-only access to Amazon Comprehend.

Provides full access to Amazon Kendra via the AWS Management Console.

Provides read only access to Amazon Kendra via the AWS Management Console.

Provides full access to Amazon Lookout for Equipment operations

Provides read only access to Amazon Lookout for Equipments

Gives access to all actions for Amazon Lookout for Metrics

Gives access to all read-only actions for Amazon Lookout for Metrics

Provides full access to Amazon Machine Learning resources.

Provides read only access to Amazon Machine Learning resources.

Access to all Amazon Rekognition APIs

Access to all Read rekognition APIs

Provides full access to Amazon Transcribe operations

Provides access to read only operation for Amazon Transcribe

Provides full access to Amazon Translate.

Provides read-only access to Amazon Translate.

Policy for ReadOnly access to AWS Agent Registry

This policy defines the set of permissions allowed for unauthenticated identities for Cognito Identity Pools. This policy is not intended to be used as a stand alone permission policy. It is used as a guardrail against overly permissive pol…

Provides full access to Amazon Connect Voice ID

Gives access to all actions for Amazon Forecast

Gives access to all actions for Amazon Fraud Detector

Grants read-only access to Amazon Polly resources.

Access to all Amazon Textract APIs

Provides full access to Claude Platform on AWS

Provides full access to Amazon Comprehend Medical

Provides access to perform all operations Amazon Augmented AI resources, including FlowDefinitions, HumanTaskUis and HumanLoops. Does not allow access for creating FlowDefinitions against the public-crowd Workteam.

Provides access to perform all operations on HumanLoops.

Provides access to perform all operations Amazon Augmented AI resources, including FlowDefinitions, HumanTaskUis and HumanLoops. Also provides access to those operations of services that are integrated with Amazon Augmented AI.

The AmazonDataZoneSageMakerManageAccessRolePolicy policy grants Amazon DataZone the permissions required to grant user access to various resources in the SageMaker environment.

Provides permissions for Amazon SageMaker Canvas to use AI services to support ready to use AI solutions. This policy will add more mutating permissions for services as Amazon SageMaker Canvas adds support.

Provides full access to Amazon SageMaker Canvas resources and operations. The policy also provides select access to related services (e.g., S3, IAM, VPC, ECR, CloudWatch Logs, Redshift, Secrets Manager, and Forecast). This policy should be …

Provides permissions for Amazon SageMaker Canvas to use the SageMaker Data Science Assistant service. The Data Science Assistant currently uses both Amazon SageMaker and Amazon Q Developer to process user prompts.

This policy provides administrative privileges required for setting up the SageMaker HyperPod inference operator. It enables the inference operator to access AWS networking resources, Amazon S3, Amazon ECR, Amazon CloudWatch, AWS Certificat…

Provides permissions for Amazon SageMaker job execution roles to access data in Amazon S3, invoke agents through Amazon Bedrock AgentCore, track experiments with MLflow, publish model packages, write logs to Amazon CloudWatch, invoke AWS La…

Provides permissions for agent runtimes to invoke the Amazon SageMaker job runtime APIs used during model customization for sample generation, trajectory completion, and reward submission.

Grants permissions for SageMaker model customization workflows including serverless training, custom reward function for reinforcement learning, model evaluation, and deployment to SageMaker or Bedrock endpoints.

This AWS managed policy grants permissions needed to use all Amazon SageMaker Governance features. The policy also provides select access to related services (e.g., S3, KMS).

This is a new managed policy for Model Registry in Sagemaker. This policy is a standalone policy that can be attached to the user role to access Model Registry related functionalities in Sagemaker.

Enables Amazon SageMaker partner app users to access applications, list available applications, launch application web UIs, and connect via the application SDK.

This Amazon Managed Policy provides the necessary permissions to create and manage SageMaker Training Plans. It allows users to create Training Plans and Reserved Capacities, describe existing Training Plans, and perform search and listing …

Provides permissions for a caller identity to create and manage Amazon SageMaker training sessions, run training and sampling operations, use customer managed AWS KMS keys through SageMaker, pass an execution role to SageMaker, publish mode…

Provides Bedrock Model inference permission to Bedrock agent core memory

Provides limited access to Amazon Bedrock as well as to related services that are required by it

Defines the maximum permissions of IAM roles that Amazon Bedrock Studio creates for operating Amazon Bedrock Studio resources.

Provides full access to Bedrock AgentCore as well as limited access to related services

Default policy for the instance role of instances managed by Bedrock AgentCore Runtime Instances.

Grants users permission to request Amazon Machine Learning batch predictions.

Provides create access for non-prediction Amazon Machine Learning resources.

Grants users permission to create and delete the real-time endpoint for Amazon Machine Learning models.

Grants users permission to request Amazon Machine Learning real-time predictions.

Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to SageMaker.

Provides limited access to Claude Platform on AWS

Provides read only access to Claude Platform on AWS

Provides access to operate a self-hosted environment runner for Claude Managed Agents

Provides developer access to enable interactions with Amazon Q

Provides full access to enable interactions with Amazon Q

This managed policy grants permission to connect with Amazon Q and utilize the features in the GitLab Duo with Amazon Q integration.

Provides permissions required by the Amazon AI Operations Assistant to generate incident report of the investigation.

Grants access to the Amazon AI Operations APIs for creating, updating, and deleting investigations, investigation events, and investigation resources. It also includes ReadOnly access to all AI Operations APIs and to use identity-aware sess…

Provides ReadOnly permissions required by the Amazon AI Operations Assistant to do analysis on customer AWS resources during investigations.

Grants the AWS Well-Architected Agent read-only access to AWS resource configurations, security settings, and operational data to generate optimization recommendations

Service role policy used by the AWS service Catalog service to provision products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including CodePipeline, CodeBuild, CodeCommit, Glue, CloudFormati…

Service role policy used by the AWS CodeBuild within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including CodePipeline, CodeBuild and others.

Provides full access to AWS Agent Registry

Provides read and inference creation access to Amazon Bedrock Mantle

Provides limited access to Amazon Bedrock Marketplace as well as to related services that are required by it

Provides access to Amazon Lex conversational APIs.

Grants full access to Amazon Polly service and resources.

This policy specifies rekognition and s3 permissions required by Amazon Rekognition Custom Labels feature.

Provides access to create Amazon Augmented AI FlowDefinition resources against any Workteam.

This policy may be attached to any User, Role, or Group, in order to grant users permission to create, delete, and modify projects (and their associated AWS resources) in AWS Mobile Hub. This also includes permissions to generate and downlo…

Managed policy for customers to attach to CloudWatch Omni so that CloudWatch Omni features can make Bedrock Model Inference calls such as in Agent Playground or Evaluations

Allows Amazon SageMaker Canvas to create, manage and view endpoint details for endpoints created through Canvas. Allows Amazon SageMaker Canvas to retrieve endpoint invocation metrics from CloudWatch.

This policy grants permissions that allow full access to Amazon SageMaker Geospatial through the AWS Management Console and SDK.

Allows DeepRacer to create required resources and call AWS services on your behalf.

Allows Amazon Bedrock Agents to access Amazon Bedrock models and other resources attached to an agent in SageMaker Studio.

Provides access to an Amazon Bedrock chat agent app's configuration and Amazon Bedrock agent in SageMaker Studio.

Allows Amazon Bedrock Flows to access Amazon Bedrock models and other resources attached to a flow in SageMaker Studio.

Provides access to configure vector stores and Amazon Bedrock knowledge bases in SageMaker Studio.

Provides permissions to consume Amazon Bedrock models, including invoking Amazon Bedrock application inference profile created for particular Amazon DataZone domain.

Provides permissions to manage Amazon Bedrock model access, including creating, tagging and deleting application inference profiles.

Service role policy used by the AWS CloudFormation within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including SageMaker and others.

Service role policy used by the AWS Lambda within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a set of related services including ECR, S3 and others.

Provides full access to Amazon Personalize via the AWS Management Console and SDK. Also provides select access to related services (e.g., S3, CloudWatch).

Provides access to Amazon SageMaker resources from Amazon QuickSight