AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy

OperatorService roleActivePermissions reviewedShow on map Compare

Summary

Service role policy used by the AWS CloudFormation within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including SageMaker and others.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy
Default version: v1
Created: 2022-03-25
Last edited: 2022-03-25
Services: iam, sagemaker

Control-plane actions (259)

By access level: 58 List, 59 Read, 2 Tagging, 140 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
IAM	1 of 190	1 Write; 1 restricted, 0 conditional	iam:PassRole
SageMaker	258 of 441	58 List, 59 Read, 2 Tagging, 139 Write; 0 restricted, 0 conditional	sagemaker:AddAssociation, sagemaker:AddTags, sagemaker:AssociateTrialComponent, sagemaker:BatchDescribeModelPackage, sagemaker:BatchGetMetrics, sagemaker:BatchPutMetrics, sagemaker:CreateAction, sagemaker:CreateAlgorithm, sagemaker:CreateApp, sagemaker:CreateAppImageConfig, sagemaker:CreateArtifact, sagemaker:CreateAutoMLJob and 246 more

IAM: 1 actions

iam:PassRole (Write)

SageMaker: 258 actions

sagemaker:AddAssociation (Write)
sagemaker:AddTags (Tagging)
sagemaker:AssociateTrialComponent (Write)
sagemaker:BatchDescribeModelPackage (Read)
sagemaker:BatchGetMetrics (Read)
sagemaker:BatchPutMetrics (Write)
sagemaker:CreateAction (Write)
sagemaker:CreateAlgorithm (Write)
sagemaker:CreateApp (Write)
sagemaker:CreateAppImageConfig (Write)
sagemaker:CreateArtifact (Write)
sagemaker:CreateAutoMLJob (Write)
sagemaker:CreateCodeRepository (Write)
sagemaker:CreateCompilationJob (Write)
sagemaker:CreateContext (Write)
sagemaker:CreateDataQualityJobDefinition (Write)
sagemaker:CreateDeviceFleet (Write)
sagemaker:CreateDomain (Write)
sagemaker:CreateEdgePackagingJob (Write)
sagemaker:CreateEndpoint (Write)
sagemaker:CreateEndpointConfig (Write)
sagemaker:CreateExperiment (Write)
sagemaker:CreateFeatureGroup (Write)
sagemaker:CreateFlowDefinition (Write)
sagemaker:CreateHumanTaskUi (Write)
sagemaker:CreateHyperParameterTuningJob (Write)
sagemaker:CreateImage (Write)
sagemaker:CreateImageVersion (Write)
sagemaker:CreateInferenceRecommendationsJob (Write)
sagemaker:CreateLabelingJob (Write)
sagemaker:CreateLineageGroupPolicy (Write)
sagemaker:CreateModel (Write)
sagemaker:CreateModelBiasJobDefinition (Write)
sagemaker:CreateModelExplainabilityJobDefinition (Write)
sagemaker:CreateModelPackage (Write)
sagemaker:CreateModelPackageGroup (Write)
sagemaker:CreateModelQualityJobDefinition (Write)
sagemaker:CreateMonitoringSchedule (Write)
sagemaker:CreateNotebookInstance (Write)
sagemaker:CreateNotebookInstanceLifecycleConfig (Write)
sagemaker:CreatePipeline (Write)
sagemaker:CreatePresignedDomainUrl (Write)
sagemaker:CreatePresignedNotebookInstanceUrl (Write)
sagemaker:CreateProcessingJob (Write)
sagemaker:CreateProject (Write)
sagemaker:CreateTrainingJob (Write)
sagemaker:CreateTransformJob (Write)
sagemaker:CreateTrial (Write)
sagemaker:CreateTrialComponent (Write)
sagemaker:CreateUserProfile (Write)
sagemaker:CreateWorkforce (Write)
sagemaker:CreateWorkteam (Write)
sagemaker:DeleteAction (Write)
sagemaker:DeleteAlgorithm (Write)
sagemaker:DeleteApp (Write)
sagemaker:DeleteAppImageConfig (Write)
sagemaker:DeleteArtifact (Write)
sagemaker:DeleteAssociation (Write)
sagemaker:DeleteCodeRepository (Write)
sagemaker:DeleteContext (Write)
sagemaker:DeleteDataQualityJobDefinition (Write)
sagemaker:DeleteDeviceFleet (Write)
sagemaker:DeleteDomain (Write)
sagemaker:DeleteEndpoint (Write)
sagemaker:DeleteEndpointConfig (Write)
sagemaker:DeleteExperiment (Write)
sagemaker:DeleteFeatureGroup (Write)
sagemaker:DeleteFlowDefinition (Write)
sagemaker:DeleteHumanLoop (Write)
sagemaker:DeleteHumanTaskUi (Write)
sagemaker:DeleteImage (Write)
sagemaker:DeleteImageVersion (Write)
sagemaker:DeleteLineageGroupPolicy (Write)
sagemaker:DeleteModel (Write)
sagemaker:DeleteModelBiasJobDefinition (Write)
sagemaker:DeleteModelExplainabilityJobDefinition (Write)
sagemaker:DeleteModelPackage (Write)
sagemaker:DeleteModelPackageGroup (Write)
sagemaker:DeleteModelPackageGroupPolicy (Write)
sagemaker:DeleteModelQualityJobDefinition (Write)
sagemaker:DeleteMonitoringSchedule (Write)
sagemaker:DeleteNotebookInstance (Write)
sagemaker:DeleteNotebookInstanceLifecycleConfig (Write)
sagemaker:DeletePipeline (Write)
sagemaker:DeleteProject (Write)
sagemaker:DeleteTags (Tagging)
sagemaker:DeleteTrial (Write)
sagemaker:DeleteTrialComponent (Write)
sagemaker:DeleteUserProfile (Write)
sagemaker:DeleteWorkforce (Write)
sagemaker:DeleteWorkteam (Write)
sagemaker:DeregisterDevices (Write)
sagemaker:DescribeAction (Read)
sagemaker:DescribeAlgorithm (Read)
sagemaker:DescribeApp (Read)
sagemaker:DescribeAppImageConfig (Read)
sagemaker:DescribeArtifact (Read)
sagemaker:DescribeAutoMLJob (Read)
sagemaker:DescribeCodeRepository (Read)
sagemaker:DescribeCompilationJob (Read)
sagemaker:DescribeContext (Read)
sagemaker:DescribeDataQualityJobDefinition (Read)
sagemaker:DescribeDevice (Read)
sagemaker:DescribeDeviceFleet (Read)
sagemaker:DescribeDomain (Read)
sagemaker:DescribeEdgePackagingJob (Read)
sagemaker:DescribeEndpoint (Read)
sagemaker:DescribeEndpointConfig (Read)
sagemaker:DescribeExperiment (Read)
sagemaker:DescribeFeatureGroup (Read)
sagemaker:DescribeFlowDefinition (Read)
sagemaker:DescribeHumanLoop (Read)
sagemaker:DescribeHumanTaskUi (Read)
sagemaker:DescribeHyperParameterTuningJob (Read)
sagemaker:DescribeImage (Read)
sagemaker:DescribeImageVersion (Read)
sagemaker:DescribeInferenceRecommendationsJob (Read)
sagemaker:DescribeLabelingJob (Read)
sagemaker:DescribeLineageGroup (Read)
sagemaker:DescribeModel (Read)
sagemaker:DescribeModelBiasJobDefinition (Read)
sagemaker:DescribeModelExplainabilityJobDefinition (Read)
sagemaker:DescribeModelPackage (Read)
sagemaker:DescribeModelPackageGroup (Read)
sagemaker:DescribeModelQualityJobDefinition (Read)
sagemaker:DescribeMonitoringSchedule (Read)
sagemaker:DescribeNotebookInstance (Read)
sagemaker:DescribeNotebookInstanceLifecycleConfig (Read)
sagemaker:DescribePipeline (Read)
sagemaker:DescribePipelineDefinitionForExecution (Read)
sagemaker:DescribePipelineExecution (Read)
sagemaker:DescribeProcessingJob (Read)
sagemaker:DescribeProject (Read)
sagemaker:DescribeSubscribedWorkteam (Read)
sagemaker:DescribeTrainingJob (Read)
sagemaker:DescribeTransformJob (Read)
sagemaker:DescribeTrial (Read)
sagemaker:DescribeTrialComponent (Read)
sagemaker:DescribeUserProfile (Read)
sagemaker:DescribeWorkforce (Read)
sagemaker:DescribeWorkteam (Read)
sagemaker:DisableSagemakerServicecatalogPortfolio (Write)
sagemaker:DisassociateTrialComponent (Write)
sagemaker:EnableSagemakerServicecatalogPortfolio (Write)
sagemaker:GetDeviceFleetReport (Read)
sagemaker:GetDeviceRegistration (Read)
sagemaker:GetLineageGroupPolicy (Read)
sagemaker:GetModelPackageGroupPolicy (Read)
sagemaker:GetSagemakerServicecatalogPortfolioStatus (Read)
sagemaker:GetSearchSuggestions (Read)
sagemaker:ListActions (List)
sagemaker:ListAlgorithms (List)
sagemaker:ListAppImageConfigs (List)
sagemaker:ListApps (List)
sagemaker:ListArtifacts (List)
sagemaker:ListAssociations (List)
sagemaker:ListAutoMLJobs (List)
sagemaker:ListCandidatesForAutoMLJob (List)
sagemaker:ListCodeRepositories (List)
sagemaker:ListCompilationJobs (List)
sagemaker:ListContexts (List)
sagemaker:ListDataQualityJobDefinitions (List)
sagemaker:ListDeviceFleets (List)
sagemaker:ListDevices (List)
sagemaker:ListDomains (List)
sagemaker:ListEdgePackagingJobs (List)
sagemaker:ListEndpointConfigs (List)
sagemaker:ListEndpoints (List)
sagemaker:ListExperiments (List)
sagemaker:ListFeatureGroups (List)
sagemaker:ListFlowDefinitions (List)
sagemaker:ListHumanLoops (List)
sagemaker:ListHumanTaskUis (List)
sagemaker:ListHyperParameterTuningJobs (List)
sagemaker:ListImageVersions (List)
sagemaker:ListImages (List)
sagemaker:ListInferenceRecommendationsJobs (List)
sagemaker:ListLabelingJobs (List)
sagemaker:ListLabelingJobsForWorkteam (List)
sagemaker:ListLineageGroups (List)
sagemaker:ListModelBiasJobDefinitions (List)
sagemaker:ListModelExplainabilityJobDefinitions (List)
sagemaker:ListModelMetadata (List)
sagemaker:ListModelPackageGroups (List)
sagemaker:ListModelPackages (List)
sagemaker:ListModelQualityJobDefinitions (List)
sagemaker:ListModels (List)
sagemaker:ListMonitoringExecutions (List)
sagemaker:ListMonitoringSchedules (List)
sagemaker:ListNotebookInstanceLifecycleConfigs (List)
sagemaker:ListNotebookInstances (List)
sagemaker:ListPipelineExecutionSteps (List)
sagemaker:ListPipelineExecutions (List)
sagemaker:ListPipelineParametersForExecution (List)
sagemaker:ListPipelines (List)
sagemaker:ListProcessingJobs (List)
sagemaker:ListProjects (List)
sagemaker:ListSubscribedWorkteams (List)
sagemaker:ListTags (List)
sagemaker:ListTrainingJobs (List)
sagemaker:ListTrainingJobsForHyperParameterTuningJob (List)
sagemaker:ListTransformJobs (List)
sagemaker:ListTrialComponents (List)
sagemaker:ListTrials (List)
sagemaker:ListUserProfiles (List)
sagemaker:ListWorkforces (List)
sagemaker:ListWorkteams (List)
sagemaker:PutLineageGroupPolicy (Write)
sagemaker:PutModelPackageGroupPolicy (Write)
sagemaker:QueryLineage (List)
sagemaker:RegisterDevices (Write)
sagemaker:RenderUiTemplate (Read)
sagemaker:Search (Read)
sagemaker:SendHeartbeat (Write)
sagemaker:SendPipelineExecutionStepFailure (Write)
sagemaker:SendPipelineExecutionStepSuccess (Write)
sagemaker:StartHumanLoop (Write)
sagemaker:StartMonitoringSchedule (Write)
sagemaker:StartNotebookInstance (Write)
sagemaker:StartPipelineExecution (Write)
sagemaker:StopAutoMLJob (Write)
sagemaker:StopCompilationJob (Write)
sagemaker:StopEdgePackagingJob (Write)
sagemaker:StopHumanLoop (Write)
sagemaker:StopHyperParameterTuningJob (Write)
sagemaker:StopInferenceRecommendationsJob (Write)
sagemaker:StopLabelingJob (Write)
sagemaker:StopMonitoringSchedule (Write)
sagemaker:StopNotebookInstance (Write)
sagemaker:StopPipelineExecution (Write)
sagemaker:StopProcessingJob (Write)
sagemaker:StopTrainingJob (Write)
sagemaker:StopTransformJob (Write)
sagemaker:UpdateAction (Write)
sagemaker:UpdateAppImageConfig (Write)
sagemaker:UpdateArtifact (Write)
sagemaker:UpdateCodeRepository (Write)
sagemaker:UpdateContext (Write)
sagemaker:UpdateDeviceFleet (Write)
sagemaker:UpdateDevices (Write)
sagemaker:UpdateDomain (Write)
sagemaker:UpdateEndpoint (Write)
sagemaker:UpdateEndpointWeightsAndCapacities (Write)
sagemaker:UpdateExperiment (Write)
sagemaker:UpdateImage (Write)
sagemaker:UpdateModelPackage (Write)
sagemaker:UpdateMonitoringSchedule (Write)
sagemaker:UpdateNotebookInstance (Write)
sagemaker:UpdateNotebookInstanceLifecycleConfig (Write)
sagemaker:UpdatePipeline (Write)
sagemaker:UpdatePipelineExecution (Write)
sagemaker:UpdateProject (Write)
sagemaker:UpdateTrainingJob (Write)
sagemaker:UpdateTrial (Write)
sagemaker:UpdateTrialComponent (Write)
sagemaker:UpdateUserProfile (Write)
sagemaker:UpdateWorkforce (Write)
sagemaker:UpdateWorkteam (Write)

Data-plane actions (6)

By access level: 4 Read, 2 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
SageMaker	6 of 19	4 Read, 2 Write; 0 restricted, 0 conditional	sagemaker:BatchGetRecord, sagemaker:DeleteRecord, sagemaker:GetRecord, sagemaker:InvokeEndpoint, sagemaker:InvokeEndpointAsync, sagemaker:PutRecord

SageMaker: 6 actions

sagemaker:BatchGetRecord (Read)
sagemaker:DeleteRecord (Write)
sagemaker:GetRecord (Read)
sagemaker:InvokeEndpoint (Read)
sagemaker:InvokeEndpointAsync (Read)
sagemaker:PutRecord (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 144 write, tagging or permissions-management actions, short of full control of any service.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddAssociation",
        "sagemaker:AddTags",
        "sagemaker:AssociateTrialComponent",
        "sagemaker:BatchDescribeModelPackage",
        "sagemaker:BatchGetMetrics",
        "sagemaker:BatchGetRecord",
        "sagemaker:BatchPutMetrics",
        "sagemaker:CreateAction",
        "sagemaker:CreateAlgorithm",
        "sagemaker:CreateApp",
        "sagemaker:CreateAppImageConfig",
        "sagemaker:CreateArtifact",
        "sagemaker:CreateAutoMLJob",
        "sagemaker:CreateCodeRepository",
        "sagemaker:CreateCompilationJob",
        "sagemaker:CreateContext",
        "sagemaker:CreateDataQualityJobDefinition",
        "sagemaker:CreateDeviceFleet",
        "sagemaker:CreateDomain",
        "sagemaker:CreateEdgePackagingJob",
        "sagemaker:CreateEndpoint",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateExperiment",
        "sagemaker:CreateFeatureGroup",
        "sagemaker:CreateFlowDefinition",
        "sagemaker:CreateHumanTaskUi",
        "sagemaker:CreateHyperParameterTuningJob",
        "sagemaker:CreateImage",
        "sagemaker:CreateImageVersion",
        "sagemaker:CreateInferenceRecommendationsJob",
        "sagemaker:CreateLabelingJob",
        "sagemaker:CreateLineageGroupPolicy",
        "sagemaker:CreateModel",
        "sagemaker:CreateModelBiasJobDefinition",
        "sagemaker:CreateModelExplainabilityJobDefinition",
        "sagemaker:CreateModelPackage",
        "sagemaker:CreateModelPackageGroup",
        "sagemaker:CreateModelQualityJobDefinition",
        "sagemaker:CreateMonitoringSchedule",
        "sagemaker:CreateNotebookInstance",
        "sagemaker:CreateNotebookInstanceLifecycleConfig",
        "sagemaker:CreatePipeline",
        "sagemaker:CreatePresignedDomainUrl",
        "sagemaker:CreatePresignedNotebookInstanceUrl",
        "sagemaker:CreateProcessingJob",
        "sagemaker:CreateProject",
        "sagemaker:CreateTrainingJob",
        "sagemaker:CreateTransformJob",
        "sagemaker:CreateTrial",
        "sagemaker:CreateTrialComponent",
        "sagemaker:CreateUserProfile",
        "sagemaker:CreateWorkforce",
        "sagemaker:CreateWorkteam",
        "sagemaker:DeleteAction",
        "sagemaker:DeleteAlgorithm",
        "sagemaker:DeleteApp",
        "sagemaker:DeleteAppImageConfig",
        "sagemaker:DeleteArtifact",
        "sagemaker:DeleteAssociation",
        "sagemaker:DeleteCodeRepository",
        "sagemaker:DeleteContext",
        "sagemaker:DeleteDataQualityJobDefinition",
        "sagemaker:DeleteDeviceFleet",
        "sagemaker:DeleteDomain",
        "sagemaker:DeleteEndpoint",
        "sagemaker:DeleteEndpointConfig",
        "sagemaker:DeleteExperiment",
        "sagemaker:DeleteFeatureGroup",
        "sagemaker:DeleteFlowDefinition",
        "sagemaker:DeleteHumanLoop",
        "sagemaker:DeleteHumanTaskUi",
        "sagemaker:DeleteImage",
        "sagemaker:DeleteImageVersion",
        "sagemaker:DeleteLineageGroupPolicy",
        "sagemaker:DeleteModel",
        "sagemaker:DeleteModelBiasJobDefinition",
        "sagemaker:DeleteModelExplainabilityJobDefinition",
        "sagemaker:DeleteModelPackage",
        "sagemaker:DeleteModelPackageGroup",
        "sagemaker:DeleteModelPackageGroupPolicy",
        "sagemaker:DeleteModelQualityJobDefinition",
        "sagemaker:DeleteMonitoringSchedule",
        "sagemaker:DeleteNotebookInstance",
        "sagemaker:DeleteNotebookInstanceLifecycleConfig",
        "sagemaker:DeletePipeline",
        "sagemaker:DeleteProject",
        "sagemaker:DeleteRecord",
        "sagemaker:DeleteTags",
        "sagemaker:DeleteTrial",
        "sagemaker:DeleteTrialComponent",
        "sagemaker:DeleteUserProfile",
        "sagemaker:DeleteWorkforce",
        "sagemaker:DeleteWorkteam",
        "sagemaker:DeregisterDevices",
        "sagemaker:DescribeAction",
        "sagemaker:DescribeAlgorithm",
        "sagemaker:DescribeApp",
        "sagemaker:DescribeAppImageConfig",
        "sagemaker:DescribeArtifact",
        "sagemaker:DescribeAutoMLJob",
        "sagemaker:DescribeCodeRepository",
        "sagemaker:DescribeCompilationJob",
        "sagemaker:DescribeContext",
        "sagemaker:DescribeDataQualityJobDefinition",
        "sagemaker:DescribeDevice",
        "sagemaker:DescribeDeviceFleet",
        "sagemaker:DescribeDomain",
        "sagemaker:DescribeEdgePackagingJob",
        "sagemaker:DescribeEndpoint",
        "sagemaker:DescribeEndpointConfig",
        "sagemaker:DescribeExperiment",
        "sagemaker:DescribeFeatureGroup",
        "sagemaker:DescribeFlowDefinition",
        "sagemaker:DescribeHumanLoop",
        "sagemaker:DescribeHumanTaskUi",
        "sagemaker:DescribeHyperParameterTuningJob",
        "sagemaker:DescribeImage",
        "sagemaker:DescribeImageVersion",
        "sagemaker:DescribeInferenceRecommendationsJob",
        "sagemaker:DescribeLabelingJob",
        "sagemaker:DescribeLineageGroup",
        "sagemaker:DescribeModel",
        "sagemaker:DescribeModelBiasJobDefinition",
        "sagemaker:DescribeModelExplainabilityJobDefinition",
        "sagemaker:DescribeModelPackage",
        "sagemaker:DescribeModelPackageGroup",
        "sagemaker:DescribeModelQualityJobDefinition",
        "sagemaker:DescribeMonitoringSchedule",
        "sagemaker:DescribeNotebookInstance",
        "sagemaker:DescribeNotebookInstanceLifecycleConfig",
        "sagemaker:DescribePipeline",
        "sagemaker:DescribePipelineDefinitionForExecution",
        "sagemaker:DescribePipelineExecution",
        "sagemaker:DescribeProcessingJob",
        "sagemaker:DescribeProject",
        "sagemaker:DescribeSubscribedWorkteam",
        "sagemaker:DescribeTrainingJob",
        "sagemaker:DescribeTransformJob",
        "sagemaker:DescribeTrial",
        "sagemaker:DescribeTrialComponent",
        "sagemaker:DescribeUserProfile",
        "sagemaker:DescribeWorkforce",
        "sagemaker:DescribeWorkteam",
        "sagemaker:DisableSagemakerServicecatalogPortfolio",
        "sagemaker:DisassociateTrialComponent",
        "sagemaker:EnableSagemakerServicecatalogPortfolio",
        "sagemaker:GetDeviceFleetReport",
        "sagemaker:GetDeviceRegistration",
        "sagemaker:GetLineageGroupPolicy",
        "sagemaker:GetModelPackageGroupPolicy",
        "sagemaker:GetRecord",
        "sagemaker:GetSagemakerServicecatalogPortfolioStatus",
        "sagemaker:GetSearchSuggestions",
        "sagemaker:InvokeEndpoint",
        "sagemaker:InvokeEndpointAsync",
        "sagemaker:ListActions",
        "sagemaker:ListAlgorithms",
        "sagemaker:ListAppImageConfigs",
        "sagemaker:ListApps",
        "sagemaker:ListArtifacts",
        "sagemaker:ListAssociations",
        "sagemaker:ListAutoMLJobs",
        "sagemaker:ListCandidatesForAutoMLJob",
        "sagemaker:ListCodeRepositories",
        "sagemaker:ListCompilationJobs",
        "sagemaker:ListContexts",
        "sagemaker:ListDataQualityJobDefinitions",
        "sagemaker:ListDeviceFleets",
        "sagemaker:ListDevices",
        "sagemaker:ListDomains",
        "sagemaker:ListEdgePackagingJobs",
        "sagemaker:ListEndpointConfigs",
        "sagemaker:ListEndpoints",
        "sagemaker:ListExperiments",
        "sagemaker:ListFeatureGroups",
        "sagemaker:ListFlowDefinitions",
        "sagemaker:ListHumanLoops",
        "sagemaker:ListHumanTaskUis",
        "sagemaker:ListHyperParameterTuningJobs",
        "sagemaker:ListImageVersions",
        "sagemaker:ListImages",
        "sagemaker:ListInferenceRecommendationsJobs",
        "sagemaker:ListLabelingJobs",
        "sagemaker:ListLabelingJobsForWorkteam",
        "sagemaker:ListLineageGroups",
        "sagemaker:ListModelBiasJobDefinitions",
        "sagemaker:ListModelExplainabilityJobDefinitions",
        "sagemaker:ListModelMetadata",
        "sagemaker:ListModelPackageGroups",
        "sagemaker:ListModelPackages",
        "sagemaker:ListModelQualityJobDefinitions",
        "sagemaker:ListModels",
        "sagemaker:ListMonitoringExecutions",
        "sagemaker:ListMonitoringSchedules",
        "sagemaker:ListNotebookInstanceLifecycleConfigs",
        "sagemaker:ListNotebookInstances",
        "sagemaker:ListPipelineExecutionSteps",
        "sagemaker:ListPipelineExecutions",
        "sagemaker:ListPipelineParametersForExecution",
        "sagemaker:ListPipelines",
        "sagemaker:ListProcessingJobs",
        "sagemaker:ListProjects",
        "sagemaker:ListSubscribedWorkteams",
        "sagemaker:ListTags",
        "sagemaker:ListTrainingJobs",
        "sagemaker:ListTrainingJobsForHyperParameterTuningJob",
        "sagemaker:ListTransformJobs",
        "sagemaker:ListTrialComponents",
        "sagemaker:ListTrials",
        "sagemaker:ListUserProfiles",
        "sagemaker:ListWorkforces",
        "sagemaker:ListWorkteams",
        "sagemaker:PutLineageGroupPolicy",
        "sagemaker:PutModelPackageGroupPolicy",
        "sagemaker:PutRecord",
        "sagemaker:QueryLineage",
        "sagemaker:RegisterDevices",
        "sagemaker:RenderUiTemplate",
        "sagemaker:Search",
        "sagemaker:SendHeartbeat",
        "sagemaker:SendPipelineExecutionStepFailure",
        "sagemaker:SendPipelineExecutionStepSuccess",
        "sagemaker:StartHumanLoop",
        "sagemaker:StartMonitoringSchedule",
        "sagemaker:StartNotebookInstance",
        "sagemaker:StartPipelineExecution",
        "sagemaker:StopAutoMLJob",
        "sagemaker:StopCompilationJob",
        "sagemaker:StopEdgePackagingJob",
        "sagemaker:StopHumanLoop",
        "sagemaker:StopHyperParameterTuningJob",
        "sagemaker:StopInferenceRecommendationsJob",
        "sagemaker:StopLabelingJob",
        "sagemaker:StopMonitoringSchedule",
        "sagemaker:StopNotebookInstance",
        "sagemaker:StopPipelineExecution",
        "sagemaker:StopProcessingJob",
        "sagemaker:StopTrainingJob",
        "sagemaker:StopTransformJob",
        "sagemaker:UpdateAction",
        "sagemaker:UpdateAppImageConfig",
        "sagemaker:UpdateArtifact",
        "sagemaker:UpdateCodeRepository",
        "sagemaker:UpdateContext",
        "sagemaker:UpdateDeviceFleet",
        "sagemaker:UpdateDevices",
        "sagemaker:UpdateDomain",
        "sagemaker:UpdateEndpoint",
        "sagemaker:UpdateEndpointWeightsAndCapacities",
        "sagemaker:UpdateExperiment",
        "sagemaker:UpdateImage",
        "sagemaker:UpdateModelPackage",
        "sagemaker:UpdateMonitoringSchedule",
        "sagemaker:UpdateNotebookInstance",
        "sagemaker:UpdateNotebookInstanceLifecycleConfig",
        "sagemaker:UpdatePipeline",
        "sagemaker:UpdatePipelineExecution",
        "sagemaker:UpdateProject",
        "sagemaker:UpdateTrainingJob",
        "sagemaker:UpdateTrial",
        "sagemaker:UpdateTrialComponent",
        "sagemaker:UpdateUserProfile",
        "sagemaker:UpdateWorkforce",
        "sagemaker:UpdateWorkteam"
      ],
      "NotResource": [
        "arn:aws:sagemaker:*:*:domain/*",
        "arn:aws:sagemaker:*:*:user-profile/*",
        "arn:aws:sagemaker:*:*:app/*",
        "arn:aws:sagemaker:*:*:flow-definition/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole",
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole"
      ]
    }
  ]
}

Version history

Current version v1, edited by AWS on 2022-03-25. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy

Terraform

resource "aws_iam_role_policy_attachment" "service_role_amazonsagemakerservicecatalogproductscloudformationservicerolepolicy" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AmazonSageMakerServiceCatalogProductsCloudformationServiceRolePolicy"),
);

Sources

Pending editorial review. No editorial sources are listed yet.