AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

Service role policy used by the AWS CodeBuild within the AWS ServiceCatalog provisioned products from Amazon SageMaker portfolio of products. Grants permissions to a subset of related services including CodePipeline, CodeBuild and others.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
Default version: v5
Created: 2022-03-25
Last edited: 2026-02-12
Services: codecommit, codeconnections, codestar-connections, ecr, iam, logs, s3, sagemaker

Control-plane actions (306)

By access level: 70 List, 1 Permissions management, 78 Read, 2 Tagging, 155 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
CodeCommit	5 of 91	4 Read, 1 Write; 5 restricted, 0 conditional	codecommit:CancelUploadArchive, codecommit:GetBranch, codecommit:GetCommit, codecommit:GetUploadArchiveStatus, codecommit:UploadArchive
CodeConnections	1 of 38	1 Read; 1 restricted, 1 conditional	codeconnections:UseConnection
CodeStar Connections	1 of 38	1 Read; 1 restricted, 1 conditional	codestar-connections:UseConnection
Elastic Container Registry	13 of 65	8 Read, 5 Write; 5 restricted, 0 conditional	ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, ecr:CompleteLayerUpload, ecr:CreateRepository, ecr:DescribeImageReplicationStatus, ecr:DescribeImageScanFindings, ecr:DescribeRegistry, ecr:DescribeRepositories, ecr:GetAuthorizationToken, ecr:GetDownloadUrlForLayer, ecr:InitiateLayerUpload, ecr:PutImage and 1 more
IAM	1 of 190	1 Write; 1 restricted, 1 conditional	iam:PassRole
CloudWatch Logs	19 of 133	10 List, 1 Permissions management, 2 Read, 6 Write; 19 restricted, 0 conditional	logs:CreateLogDelivery, logs:CreateLogGroup, logs:CreateLogStream, logs:DeleteLogDelivery, logs:DescribeDestinations, logs:DescribeExportTasks, logs:DescribeLogGroups, logs:DescribeLogStreams, logs:DescribeMetricFilters, logs:DescribeQueries, logs:DescribeQueryDefinitions, logs:DescribeResourcePolicies and 7 more
S3	8 of 155	2 List, 3 Read, 3 Write; 8 restricted, 0 conditional	s3:CreateBucket, s3:DeleteBucket, s3:GetBucketAcl, s3:GetBucketCors, s3:GetBucketLocation, s3:ListAllMyBuckets, s3:ListBucketMultipartUploads, s3:PutBucketCors
SageMaker	258 of 441	58 List, 59 Read, 2 Tagging, 139 Write; 258 restricted, 0 conditional	sagemaker:AddAssociation, sagemaker:AddTags, sagemaker:AssociateTrialComponent, sagemaker:BatchDescribeModelPackage, sagemaker:BatchGetMetrics, sagemaker:BatchPutMetrics, sagemaker:CreateAction, sagemaker:CreateAlgorithm, sagemaker:CreateApp, sagemaker:CreateAppImageConfig, sagemaker:CreateArtifact, sagemaker:CreateAutoMLJob and 246 more

CodeCommit: 5 actions

codecommit:CancelUploadArchive (Read)
codecommit:GetBranch (Read)
codecommit:GetCommit (Read)
codecommit:GetUploadArchiveStatus (Read)
codecommit:UploadArchive (Write)

CodeConnections: 1 actions

codeconnections:UseConnection (Read)

CodeStar Connections: 1 actions

codestar-connections:UseConnection (Read)

Elastic Container Registry: 13 actions

ecr:BatchCheckLayerAvailability (Read)
ecr:BatchGetImage (Read)
ecr:CompleteLayerUpload (Write)
ecr:CreateRepository (Write)
ecr:DescribeImageReplicationStatus (Read)
ecr:DescribeImageScanFindings (Read)
ecr:DescribeRegistry (Read)
ecr:DescribeRepositories (Read)
ecr:GetAuthorizationToken (Read)
ecr:GetDownloadUrlForLayer (Read)
ecr:InitiateLayerUpload (Write)
ecr:PutImage (Write)
ecr:UploadLayerPart (Write)

IAM: 1 actions

iam:PassRole (Write)

CloudWatch Logs: 19 actions

logs:CreateLogDelivery (Write)
logs:CreateLogGroup (Write)
logs:CreateLogStream (Write)
logs:DeleteLogDelivery (Write)
logs:DescribeDestinations (List)
logs:DescribeExportTasks (List)
logs:DescribeLogGroups (List)
logs:DescribeLogStreams (List)
logs:DescribeMetricFilters (List)
logs:DescribeQueries (List)
logs:DescribeQueryDefinitions (List)
logs:DescribeResourcePolicies (List)
logs:DescribeSubscriptionFilters (List)
logs:GetLogDelivery (Read)
logs:GetLogEvents (Read)
logs:ListLogDeliveries (List)
logs:PutLogEvents (Write)
logs:PutResourcePolicy (Permissions management)
logs:UpdateLogDelivery (Write)

S3: 8 actions

s3:CreateBucket (Write)
s3:DeleteBucket (Write)
s3:GetBucketAcl (Read)
s3:GetBucketCORS (Read)
s3:GetBucketLocation (Read)
s3:ListAllMyBuckets (List)
s3:ListBucketMultipartUploads (List)
s3:PutBucketCORS (Write)

SageMaker: 258 actions

sagemaker:AddAssociation (Write)
sagemaker:AddTags (Tagging)
sagemaker:AssociateTrialComponent (Write)
sagemaker:BatchDescribeModelPackage (Read)
sagemaker:BatchGetMetrics (Read)
sagemaker:BatchPutMetrics (Write)
sagemaker:CreateAction (Write)
sagemaker:CreateAlgorithm (Write)
sagemaker:CreateApp (Write)
sagemaker:CreateAppImageConfig (Write)
sagemaker:CreateArtifact (Write)
sagemaker:CreateAutoMLJob (Write)
sagemaker:CreateCodeRepository (Write)
sagemaker:CreateCompilationJob (Write)
sagemaker:CreateContext (Write)
sagemaker:CreateDataQualityJobDefinition (Write)
sagemaker:CreateDeviceFleet (Write)
sagemaker:CreateDomain (Write)
sagemaker:CreateEdgePackagingJob (Write)
sagemaker:CreateEndpoint (Write)
sagemaker:CreateEndpointConfig (Write)
sagemaker:CreateExperiment (Write)
sagemaker:CreateFeatureGroup (Write)
sagemaker:CreateFlowDefinition (Write)
sagemaker:CreateHumanTaskUi (Write)
sagemaker:CreateHyperParameterTuningJob (Write)
sagemaker:CreateImage (Write)
sagemaker:CreateImageVersion (Write)
sagemaker:CreateInferenceRecommendationsJob (Write)
sagemaker:CreateLabelingJob (Write)
sagemaker:CreateLineageGroupPolicy (Write)
sagemaker:CreateModel (Write)
sagemaker:CreateModelBiasJobDefinition (Write)
sagemaker:CreateModelExplainabilityJobDefinition (Write)
sagemaker:CreateModelPackage (Write)
sagemaker:CreateModelPackageGroup (Write)
sagemaker:CreateModelQualityJobDefinition (Write)
sagemaker:CreateMonitoringSchedule (Write)
sagemaker:CreateNotebookInstance (Write)
sagemaker:CreateNotebookInstanceLifecycleConfig (Write)
sagemaker:CreatePipeline (Write)
sagemaker:CreatePresignedDomainUrl (Write)
sagemaker:CreatePresignedNotebookInstanceUrl (Write)
sagemaker:CreateProcessingJob (Write)
sagemaker:CreateProject (Write)
sagemaker:CreateTrainingJob (Write)
sagemaker:CreateTransformJob (Write)
sagemaker:CreateTrial (Write)
sagemaker:CreateTrialComponent (Write)
sagemaker:CreateUserProfile (Write)
sagemaker:CreateWorkforce (Write)
sagemaker:CreateWorkteam (Write)
sagemaker:DeleteAction (Write)
sagemaker:DeleteAlgorithm (Write)
sagemaker:DeleteApp (Write)
sagemaker:DeleteAppImageConfig (Write)
sagemaker:DeleteArtifact (Write)
sagemaker:DeleteAssociation (Write)
sagemaker:DeleteCodeRepository (Write)
sagemaker:DeleteContext (Write)
sagemaker:DeleteDataQualityJobDefinition (Write)
sagemaker:DeleteDeviceFleet (Write)
sagemaker:DeleteDomain (Write)
sagemaker:DeleteEndpoint (Write)
sagemaker:DeleteEndpointConfig (Write)
sagemaker:DeleteExperiment (Write)
sagemaker:DeleteFeatureGroup (Write)
sagemaker:DeleteFlowDefinition (Write)
sagemaker:DeleteHumanLoop (Write)
sagemaker:DeleteHumanTaskUi (Write)
sagemaker:DeleteImage (Write)
sagemaker:DeleteImageVersion (Write)
sagemaker:DeleteLineageGroupPolicy (Write)
sagemaker:DeleteModel (Write)
sagemaker:DeleteModelBiasJobDefinition (Write)
sagemaker:DeleteModelExplainabilityJobDefinition (Write)
sagemaker:DeleteModelPackage (Write)
sagemaker:DeleteModelPackageGroup (Write)
sagemaker:DeleteModelPackageGroupPolicy (Write)
sagemaker:DeleteModelQualityJobDefinition (Write)
sagemaker:DeleteMonitoringSchedule (Write)
sagemaker:DeleteNotebookInstance (Write)
sagemaker:DeleteNotebookInstanceLifecycleConfig (Write)
sagemaker:DeletePipeline (Write)
sagemaker:DeleteProject (Write)
sagemaker:DeleteTags (Tagging)
sagemaker:DeleteTrial (Write)
sagemaker:DeleteTrialComponent (Write)
sagemaker:DeleteUserProfile (Write)
sagemaker:DeleteWorkforce (Write)
sagemaker:DeleteWorkteam (Write)
sagemaker:DeregisterDevices (Write)
sagemaker:DescribeAction (Read)
sagemaker:DescribeAlgorithm (Read)
sagemaker:DescribeApp (Read)
sagemaker:DescribeAppImageConfig (Read)
sagemaker:DescribeArtifact (Read)
sagemaker:DescribeAutoMLJob (Read)
sagemaker:DescribeCodeRepository (Read)
sagemaker:DescribeCompilationJob (Read)
sagemaker:DescribeContext (Read)
sagemaker:DescribeDataQualityJobDefinition (Read)
sagemaker:DescribeDevice (Read)
sagemaker:DescribeDeviceFleet (Read)
sagemaker:DescribeDomain (Read)
sagemaker:DescribeEdgePackagingJob (Read)
sagemaker:DescribeEndpoint (Read)
sagemaker:DescribeEndpointConfig (Read)
sagemaker:DescribeExperiment (Read)
sagemaker:DescribeFeatureGroup (Read)
sagemaker:DescribeFlowDefinition (Read)
sagemaker:DescribeHumanLoop (Read)
sagemaker:DescribeHumanTaskUi (Read)
sagemaker:DescribeHyperParameterTuningJob (Read)
sagemaker:DescribeImage (Read)
sagemaker:DescribeImageVersion (Read)
sagemaker:DescribeInferenceRecommendationsJob (Read)
sagemaker:DescribeLabelingJob (Read)
sagemaker:DescribeLineageGroup (Read)
sagemaker:DescribeModel (Read)
sagemaker:DescribeModelBiasJobDefinition (Read)
sagemaker:DescribeModelExplainabilityJobDefinition (Read)
sagemaker:DescribeModelPackage (Read)
sagemaker:DescribeModelPackageGroup (Read)
sagemaker:DescribeModelQualityJobDefinition (Read)
sagemaker:DescribeMonitoringSchedule (Read)
sagemaker:DescribeNotebookInstance (Read)
sagemaker:DescribeNotebookInstanceLifecycleConfig (Read)
sagemaker:DescribePipeline (Read)
sagemaker:DescribePipelineDefinitionForExecution (Read)
sagemaker:DescribePipelineExecution (Read)
sagemaker:DescribeProcessingJob (Read)
sagemaker:DescribeProject (Read)
sagemaker:DescribeSubscribedWorkteam (Read)
sagemaker:DescribeTrainingJob (Read)
sagemaker:DescribeTransformJob (Read)
sagemaker:DescribeTrial (Read)
sagemaker:DescribeTrialComponent (Read)
sagemaker:DescribeUserProfile (Read)
sagemaker:DescribeWorkforce (Read)
sagemaker:DescribeWorkteam (Read)
sagemaker:DisableSagemakerServicecatalogPortfolio (Write)
sagemaker:DisassociateTrialComponent (Write)
sagemaker:EnableSagemakerServicecatalogPortfolio (Write)
sagemaker:GetDeviceFleetReport (Read)
sagemaker:GetDeviceRegistration (Read)
sagemaker:GetLineageGroupPolicy (Read)
sagemaker:GetModelPackageGroupPolicy (Read)
sagemaker:GetSagemakerServicecatalogPortfolioStatus (Read)
sagemaker:GetSearchSuggestions (Read)
sagemaker:ListActions (List)
sagemaker:ListAlgorithms (List)
sagemaker:ListAppImageConfigs (List)
sagemaker:ListApps (List)
sagemaker:ListArtifacts (List)
sagemaker:ListAssociations (List)
sagemaker:ListAutoMLJobs (List)
sagemaker:ListCandidatesForAutoMLJob (List)
sagemaker:ListCodeRepositories (List)
sagemaker:ListCompilationJobs (List)
sagemaker:ListContexts (List)
sagemaker:ListDataQualityJobDefinitions (List)
sagemaker:ListDeviceFleets (List)
sagemaker:ListDevices (List)
sagemaker:ListDomains (List)
sagemaker:ListEdgePackagingJobs (List)
sagemaker:ListEndpointConfigs (List)
sagemaker:ListEndpoints (List)
sagemaker:ListExperiments (List)
sagemaker:ListFeatureGroups (List)
sagemaker:ListFlowDefinitions (List)
sagemaker:ListHumanLoops (List)
sagemaker:ListHumanTaskUis (List)
sagemaker:ListHyperParameterTuningJobs (List)
sagemaker:ListImageVersions (List)
sagemaker:ListImages (List)
sagemaker:ListInferenceRecommendationsJobs (List)
sagemaker:ListLabelingJobs (List)
sagemaker:ListLabelingJobsForWorkteam (List)
sagemaker:ListLineageGroups (List)
sagemaker:ListModelBiasJobDefinitions (List)
sagemaker:ListModelExplainabilityJobDefinitions (List)
sagemaker:ListModelMetadata (List)
sagemaker:ListModelPackageGroups (List)
sagemaker:ListModelPackages (List)
sagemaker:ListModelQualityJobDefinitions (List)
sagemaker:ListModels (List)
sagemaker:ListMonitoringExecutions (List)
sagemaker:ListMonitoringSchedules (List)
sagemaker:ListNotebookInstanceLifecycleConfigs (List)
sagemaker:ListNotebookInstances (List)
sagemaker:ListPipelineExecutionSteps (List)
sagemaker:ListPipelineExecutions (List)
sagemaker:ListPipelineParametersForExecution (List)
sagemaker:ListPipelines (List)
sagemaker:ListProcessingJobs (List)
sagemaker:ListProjects (List)
sagemaker:ListSubscribedWorkteams (List)
sagemaker:ListTags (List)
sagemaker:ListTrainingJobs (List)
sagemaker:ListTrainingJobsForHyperParameterTuningJob (List)
sagemaker:ListTransformJobs (List)
sagemaker:ListTrialComponents (List)
sagemaker:ListTrials (List)
sagemaker:ListUserProfiles (List)
sagemaker:ListWorkforces (List)
sagemaker:ListWorkteams (List)
sagemaker:PutLineageGroupPolicy (Write)
sagemaker:PutModelPackageGroupPolicy (Write)
sagemaker:QueryLineage (List)
sagemaker:RegisterDevices (Write)
sagemaker:RenderUiTemplate (Read)
sagemaker:Search (Read)
sagemaker:SendHeartbeat (Write)
sagemaker:SendPipelineExecutionStepFailure (Write)
sagemaker:SendPipelineExecutionStepSuccess (Write)
sagemaker:StartHumanLoop (Write)
sagemaker:StartMonitoringSchedule (Write)
sagemaker:StartNotebookInstance (Write)
sagemaker:StartPipelineExecution (Write)
sagemaker:StopAutoMLJob (Write)
sagemaker:StopCompilationJob (Write)
sagemaker:StopEdgePackagingJob (Write)
sagemaker:StopHumanLoop (Write)
sagemaker:StopHyperParameterTuningJob (Write)
sagemaker:StopInferenceRecommendationsJob (Write)
sagemaker:StopLabelingJob (Write)
sagemaker:StopMonitoringSchedule (Write)
sagemaker:StopNotebookInstance (Write)
sagemaker:StopPipelineExecution (Write)
sagemaker:StopProcessingJob (Write)
sagemaker:StopTrainingJob (Write)
sagemaker:StopTransformJob (Write)
sagemaker:UpdateAction (Write)
sagemaker:UpdateAppImageConfig (Write)
sagemaker:UpdateArtifact (Write)
sagemaker:UpdateCodeRepository (Write)
sagemaker:UpdateContext (Write)
sagemaker:UpdateDeviceFleet (Write)
sagemaker:UpdateDevices (Write)
sagemaker:UpdateDomain (Write)
sagemaker:UpdateEndpoint (Write)
sagemaker:UpdateEndpointWeightsAndCapacities (Write)
sagemaker:UpdateExperiment (Write)
sagemaker:UpdateImage (Write)
sagemaker:UpdateModelPackage (Write)
sagemaker:UpdateMonitoringSchedule (Write)
sagemaker:UpdateNotebookInstance (Write)
sagemaker:UpdateNotebookInstanceLifecycleConfig (Write)
sagemaker:UpdatePipeline (Write)
sagemaker:UpdatePipelineExecution (Write)
sagemaker:UpdateProject (Write)
sagemaker:UpdateTrainingJob (Write)
sagemaker:UpdateTrial (Write)
sagemaker:UpdateTrialComponent (Write)
sagemaker:UpdateUserProfile (Write)
sagemaker:UpdateWorkforce (Write)
sagemaker:UpdateWorkteam (Write)

Data-plane actions (12)

By access level: 1 List, 6 Read, 5 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
S3	6 of 25	1 List, 2 Read, 3 Write; 6 restricted, 0 conditional	s3:AbortMultipartUpload, s3:DeleteObject, s3:GetObject, s3:GetObjectVersion, s3:ListBucket, s3:PutObject
SageMaker	6 of 19	4 Read, 2 Write; 6 restricted, 0 conditional	sagemaker:BatchGetRecord, sagemaker:DeleteRecord, sagemaker:GetRecord, sagemaker:InvokeEndpoint, sagemaker:InvokeEndpointAsync, sagemaker:PutRecord

S3: 6 actions

s3:AbortMultipartUpload (Write)
s3:DeleteObject (Write)
s3:GetObject (Read)
s3:GetObjectVersion (Read)
s3:ListBucket (List)
s3:PutObject (Write)

SageMaker: 6 actions

sagemaker:BatchGetRecord (Read)
sagemaker:DeleteRecord (Write)
sagemaker:GetRecord (Read)
sagemaker:InvokeEndpoint (Read)
sagemaker:InvokeEndpointAsync (Read)
sagemaker:PutRecord (Write)

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 163 write, tagging or permissions-management actions, short of full control of any service.
Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AmazonSageMakerCodeBuildCodeCommitPermission",
      "Effect": "Allow",
      "Action": [
        "codecommit:CancelUploadArchive",
        "codecommit:GetBranch",
        "codecommit:GetCommit",
        "codecommit:GetUploadArchiveStatus",
        "codecommit:UploadArchive"
      ],
      "Resource": "arn:aws:codecommit:*:*:sagemaker-*"
    },
    {
      "Sid": "AmazonSageMakerCodeBuildECRReadPermission",
      "Effect": "Allow",
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:DescribeImageScanFindings",
        "ecr:DescribeRegistry",
        "ecr:DescribeImageReplicationStatus",
        "ecr:DescribeRepositories",
        "ecr:DescribeImageReplicationStatus",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AmazonSageMakerCodeBuildECRWritePermission",
      "Effect": "Allow",
      "Action": [
        "ecr:CompleteLayerUpload",
        "ecr:CreateRepository",
        "ecr:InitiateLayerUpload",
        "ecr:PutImage",
        "ecr:UploadLayerPart"
      ],
      "Resource": [
        "arn:aws:ecr:*:*:repository/sagemaker-*"
      ]
    },
    {
      "Sid": "AmazonSageMakerCodeBuildPassRoletPermission",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsEventsRole",
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodePipelineRole",
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCloudformationRole",
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsCodeBuildRole",
        "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsExecutionRole"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "events.amazonaws.com",
            "codepipeline.amazonaws.com",
            "cloudformation.amazonaws.com",
            "codebuild.amazonaws.com",
            "sagemaker.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "AmazonSageMakerCodeBuildLogPermission",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogDelivery",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DeleteLogDelivery",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:DescribeResourcePolicies",
        "logs:DescribeDestinations",
        "logs:DescribeExportTasks",
        "logs:DescribeMetricFilters",
        "logs:DescribeQueries",
        "logs:DescribeQueryDefinitions",
        "logs:DescribeSubscriptionFilters",
        "logs:GetLogDelivery",
        "logs:GetLogEvents",
        "logs:ListLogDeliveries",
        "logs:PutLogEvents",
        "logs:PutResourcePolicy",
        "logs:UpdateLogDelivery"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/codebuild/*"
    },
    {
      "Sid": "AmazonSageMakerCodeBuildS3Permission",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucket",
        "s3:GetBucketAcl",
        "s3:GetBucketCors",
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:PutBucketCors",
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::aws-glue-*",
        "arn:aws:s3:::sagemaker-*"
      ]
    },
    {
      "Sid": "AmazonSageMakerCodeBuildSageMakerPermission",
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddAssociation",
        "sagemaker:AddTags",
        "sagemaker:AssociateTrialComponent",
        "sagemaker:BatchDescribeModelPackage",
        "sagemaker:BatchGetMetrics",
        "sagemaker:BatchGetRecord",
        "sagemaker:BatchPutMetrics",
        "sagemaker:CreateAction",
        "sagemaker:CreateAlgorithm",
        "sagemaker:CreateApp",
        "sagemaker:CreateAppImageConfig",
        "sagemaker:CreateArtifact",
        "sagemaker:CreateAutoMLJob",
        "sagemaker:CreateCodeRepository",
        "sagemaker:CreateCompilationJob",
        "sagemaker:CreateContext",
        "sagemaker:CreateDataQualityJobDefinition",
        "sagemaker:CreateDeviceFleet",
        "sagemaker:CreateDomain",
        "sagemaker:CreateEdgePackagingJob",
        "sagemaker:CreateEndpoint",
        "sagemaker:CreateEndpointConfig",
        "sagemaker:CreateExperiment",
        "sagemaker:CreateFeatureGroup",
        "sagemaker:CreateFlowDefinition",
        "sagemaker:CreateHumanTaskUi",
        "sagemaker:CreateHyperParameterTuningJob",
        "sagemaker:CreateImage",
        "sagemaker:CreateImageVersion",
        "sagemaker:CreateInferenceRecommendationsJob",
        "sagemaker:CreateLabelingJob",
        "sagemaker:CreateLineageGroupPolicy",
        "sagemaker:CreateModel",
        "sagemaker:CreateModelBiasJobDefinition",
        "sagemaker:CreateModelExplainabilityJobDefinition",
        "sagemaker:CreateModelPackage",
        "sagemaker:CreateModelPackageGroup",
        "sagemaker:CreateModelQualityJobDefinition",
        "sagemaker:CreateMonitoringSchedule",
        "sagemaker:CreateNotebookInstance",
        "sagemaker:CreateNotebookInstanceLifecycleConfig",
        "sagemaker:CreatePipeline",
        "sagemaker:CreatePresignedDomainUrl",
        "sagemaker:CreatePresignedNotebookInstanceUrl",
        "sagemaker:CreateProcessingJob",
        "sagemaker:CreateProject",
        "sagemaker:CreateTrainingJob",
        "sagemaker:CreateTransformJob",
        "sagemaker:CreateTrial",
        "sagemaker:CreateTrialComponent",
        "sagemaker:CreateUserProfile",
        "sagemaker:CreateWorkforce",
        "sagemaker:CreateWorkteam",
        "sagemaker:DeleteAction",
        "sagemaker:DeleteAlgorithm",
        "sagemaker:DeleteApp",
        "sagemaker:DeleteAppImageConfig",
        "sagemaker:DeleteArtifact",
        "sagemaker:DeleteAssociation",
        "sagemaker:DeleteCodeRepository",
        "sagemaker:DeleteContext",
        "sagemaker:DeleteDataQualityJobDefinition",
        "sagemaker:DeleteDeviceFleet",
        "sagemaker:DeleteDomain",
        "sagemaker:DeleteEndpoint",
        "sagemaker:DeleteEndpointConfig",
        "sagemaker:DeleteExperiment",
        "sagemaker:DeleteFeatureGroup",
        "sagemaker:DeleteFlowDefinition",
        "sagemaker:DeleteHumanLoop",
        "sagemaker:DeleteHumanTaskUi",
        "sagemaker:DeleteImage",
        "sagemaker:DeleteImageVersion",
        "sagemaker:DeleteLineageGroupPolicy",
        "sagemaker:DeleteModel",
        "sagemaker:DeleteModelBiasJobDefinition",
        "sagemaker:DeleteModelExplainabilityJobDefinition",
        "sagemaker:DeleteModelPackage",
        "sagemaker:DeleteModelPackageGroup",
        "sagemaker:DeleteModelPackageGroupPolicy",
        "sagemaker:DeleteModelQualityJobDefinition",
        "sagemaker:DeleteMonitoringSchedule",
        "sagemaker:DeleteNotebookInstance",
        "sagemaker:DeleteNotebookInstanceLifecycleConfig",
        "sagemaker:DeletePipeline",
        "sagemaker:DeleteProject",
        "sagemaker:DeleteRecord",
        "sagemaker:DeleteTags",
        "sagemaker:DeleteTrial",
        "sagemaker:DeleteTrialComponent",
        "sagemaker:DeleteUserProfile",
        "sagemaker:DeleteWorkforce",
        "sagemaker:DeleteWorkteam",
        "sagemaker:DeregisterDevices",
        "sagemaker:DescribeAction",
        "sagemaker:DescribeAlgorithm",
        "sagemaker:DescribeApp",
        "sagemaker:DescribeAppImageConfig",
        "sagemaker:DescribeArtifact",
        "sagemaker:DescribeAutoMLJob",
        "sagemaker:DescribeCodeRepository",
        "sagemaker:DescribeCompilationJob",
        "sagemaker:DescribeContext",
        "sagemaker:DescribeDataQualityJobDefinition",
        "sagemaker:DescribeDevice",
        "sagemaker:DescribeDeviceFleet",
        "sagemaker:DescribeDomain",
        "sagemaker:DescribeEdgePackagingJob",
        "sagemaker:DescribeEndpoint",
        "sagemaker:DescribeEndpointConfig",
        "sagemaker:DescribeExperiment",
        "sagemaker:DescribeFeatureGroup",
        "sagemaker:DescribeFlowDefinition",
        "sagemaker:DescribeHumanLoop",
        "sagemaker:DescribeHumanTaskUi",
        "sagemaker:DescribeHyperParameterTuningJob",
        "sagemaker:DescribeImage",
        "sagemaker:DescribeImageVersion",
        "sagemaker:DescribeInferenceRecommendationsJob",
        "sagemaker:DescribeLabelingJob",
        "sagemaker:DescribeLineageGroup",
        "sagemaker:DescribeModel",
        "sagemaker:DescribeModelBiasJobDefinition",
        "sagemaker:DescribeModelExplainabilityJobDefinition",
        "sagemaker:DescribeModelPackage",
        "sagemaker:DescribeModelPackageGroup",
        "sagemaker:DescribeModelQualityJobDefinition",
        "sagemaker:DescribeMonitoringSchedule",
        "sagemaker:DescribeNotebookInstance",
        "sagemaker:DescribeNotebookInstanceLifecycleConfig",
        "sagemaker:DescribePipeline",
        "sagemaker:DescribePipelineDefinitionForExecution",
        "sagemaker:DescribePipelineExecution",
        "sagemaker:DescribeProcessingJob",
        "sagemaker:DescribeProject",
        "sagemaker:DescribeSubscribedWorkteam",
        "sagemaker:DescribeTrainingJob",
        "sagemaker:DescribeTransformJob",
        "sagemaker:DescribeTrial",
        "sagemaker:DescribeTrialComponent",
        "sagemaker:DescribeUserProfile",
        "sagemaker:DescribeWorkforce",
        "sagemaker:DescribeWorkteam",
        "sagemaker:DisableSagemakerServicecatalogPortfolio",
        "sagemaker:DisassociateTrialComponent",
        "sagemaker:EnableSagemakerServicecatalogPortfolio",
        "sagemaker:GetDeviceFleetReport",
        "sagemaker:GetDeviceRegistration",
        "sagemaker:GetLineageGroupPolicy",
        "sagemaker:GetModelPackageGroupPolicy",
        "sagemaker:GetRecord",
        "sagemaker:GetSagemakerServicecatalogPortfolioStatus",
        "sagemaker:GetSearchSuggestions",
        "sagemaker:InvokeEndpoint",
        "sagemaker:InvokeEndpointAsync",
        "sagemaker:ListActions",
        "sagemaker:ListAlgorithms",
        "sagemaker:ListAppImageConfigs",
        "sagemaker:ListApps",
        "sagemaker:ListArtifacts",
        "sagemaker:ListAssociations",
        "sagemaker:ListAutoMLJobs",
        "sagemaker:ListCandidatesForAutoMLJob",
        "sagemaker:ListCodeRepositories",
        "sagemaker:ListCompilationJobs",
        "sagemaker:ListContexts",
        "sagemaker:ListDataQualityJobDefinitions",
        "sagemaker:ListDeviceFleets",
        "sagemaker:ListDevices",
        "sagemaker:ListDomains",
        "sagemaker:ListEdgePackagingJobs",
        "sagemaker:ListEndpointConfigs",
        "sagemaker:ListEndpoints",
        "sagemaker:ListExperiments",
        "sagemaker:ListFeatureGroups",
        "sagemaker:ListFlowDefinitions",
        "sagemaker:ListHumanLoops",
        "sagemaker:ListHumanTaskUis",
        "sagemaker:ListHyperParameterTuningJobs",
        "sagemaker:ListImageVersions",
        "sagemaker:ListImages",
        "sagemaker:ListInferenceRecommendationsJobs",
        "sagemaker:ListLabelingJobs",
        "sagemaker:ListLabelingJobsForWorkteam",
        "sagemaker:ListLineageGroups",
        "sagemaker:ListModelBiasJobDefinitions",
        "sagemaker:ListModelExplainabilityJobDefinitions",
        "sagemaker:ListModelMetadata",
        "sagemaker:ListModelPackageGroups",
        "sagemaker:ListModelPackages",
        "sagemaker:ListModelQualityJobDefinitions",
        "sagemaker:ListModels",
        "sagemaker:ListMonitoringExecutions",
        "sagemaker:ListMonitoringSchedules",
        "sagemaker:ListNotebookInstanceLifecycleConfigs",
        "sagemaker:ListNotebookInstances",
        "sagemaker:ListPipelineExecutionSteps",
        "sagemaker:ListPipelineExecutions",
        "sagemaker:ListPipelineParametersForExecution",
        "sagemaker:ListPipelines",
        "sagemaker:ListProcessingJobs",
        "sagemaker:ListProjects",
        "sagemaker:ListSubscribedWorkteams",
        "sagemaker:ListTags",
        "sagemaker:ListTrainingJobs",
        "sagemaker:ListTrainingJobsForHyperParameterTuningJob",
        "sagemaker:ListTransformJobs",
        "sagemaker:ListTrialComponents",
        "sagemaker:ListTrials",
        "sagemaker:ListUserProfiles",
        "sagemaker:ListWorkforces",
        "sagemaker:ListWorkteams",
        "sagemaker:PutLineageGroupPolicy",
        "sagemaker:PutModelPackageGroupPolicy",
        "sagemaker:PutRecord",
        "sagemaker:QueryLineage",
        "sagemaker:RegisterDevices",
        "sagemaker:RenderUiTemplate",
        "sagemaker:Search",
        "sagemaker:SendHeartbeat",
        "sagemaker:SendPipelineExecutionStepFailure",
        "sagemaker:SendPipelineExecutionStepSuccess",
        "sagemaker:StartHumanLoop",
        "sagemaker:StartMonitoringSchedule",
        "sagemaker:StartNotebookInstance",
        "sagemaker:StartPipelineExecution",
        "sagemaker:StopAutoMLJob",
        "sagemaker:StopCompilationJob",
        "sagemaker:StopEdgePackagingJob",
        "sagemaker:StopHumanLoop",
        "sagemaker:StopHyperParameterTuningJob",
        "sagemaker:StopInferenceRecommendationsJob",
        "sagemaker:StopLabelingJob",
        "sagemaker:StopMonitoringSchedule",
        "sagemaker:StopNotebookInstance",
        "sagemaker:StopPipelineExecution",
        "sagemaker:StopProcessingJob",
        "sagemaker:StopTrainingJob",
        "sagemaker:StopTransformJob",
        "sagemaker:UpdateAction",
        "sagemaker:UpdateAppImageConfig",
        "sagemaker:UpdateArtifact",
        "sagemaker:UpdateCodeRepository",
        "sagemaker:UpdateContext",
        "sagemaker:UpdateDeviceFleet",
        "sagemaker:UpdateDevices",
        "sagemaker:UpdateDomain",
        "sagemaker:UpdateEndpoint",
        "sagemaker:UpdateEndpointWeightsAndCapacities",
        "sagemaker:UpdateExperiment",
        "sagemaker:UpdateImage",
        "sagemaker:UpdateModelPackage",
        "sagemaker:UpdateMonitoringSchedule",
        "sagemaker:UpdateNotebookInstance",
        "sagemaker:UpdateNotebookInstanceLifecycleConfig",
        "sagemaker:UpdatePipeline",
        "sagemaker:UpdatePipelineExecution",
        "sagemaker:UpdateProject",
        "sagemaker:UpdateTrainingJob",
        "sagemaker:UpdateTrial",
        "sagemaker:UpdateTrialComponent",
        "sagemaker:UpdateUserProfile",
        "sagemaker:UpdateWorkforce",
        "sagemaker:UpdateWorkteam"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:endpoint/*",
        "arn:aws:sagemaker:*:*:endpoint-config/*",
        "arn:aws:sagemaker:*:*:model/*",
        "arn:aws:sagemaker:*:*:pipeline/*",
        "arn:aws:sagemaker:*:*:project/*",
        "arn:aws:sagemaker:*:*:model-package/*"
      ]
    },
    {
      "Sid": "AmazonSageMakerCodeBuildCodeStarConnectionPermission",
      "Effect": "Allow",
      "Action": [
        "codestar-connections:UseConnection"
      ],
      "Resource": [
        "arn:aws:codestar-connections:*:*:connection/*",
        "arn:aws:codeconnections:*:*:connection/*"
      ],
      "Condition": {
        "StringEqualsIgnoreCase": {
          "aws:ResourceTag/sagemaker": "true"
        }
      }
    },
    {
      "Sid": "AmazonSageMakerCodeBuildCodeConnectionPermission",
      "Effect": "Allow",
      "Action": [
        "codeconnections:UseConnection"
      ],
      "Resource": [
        "arn:aws:codeconnections:*:*:connection/*",
        "arn:aws:codestar-connections:*:*:connection/*"
      ],
      "Condition": {
        "StringEqualsIgnoreCase": {
          "aws:ResourceTag/sagemaker": "true"
        }
      }
    }
  ]
}

Version history

Current version v5, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy

Terraform

resource "aws_iam_role_policy_attachment" "amazonsagemakerservicecatalogproductscodebuildservicerolepolicy" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy"),
);

Sources

Pending editorial review. No editorial sources are listed yet.