updated docs

awslabs · Nov 19, 2024 · 07a643a · 07a643a
1 parent f205e65
commit 07a643a
Show file tree

Hide file tree

Showing 4 changed files with 84 additions and 12 deletions.
diff --git a/frontend/docs/admin-guide/security/policies/project-policy-raw.json b/frontend/docs/admin-guide/security/policies/project-policy-raw.json
@@ -39,7 +39,25 @@
                 "sagemaker:CreateProcessingJob",
                 "sagemaker:CreateHyperParameterTuningJob",
                 "sagemaker:CreateTransformJob",
-
+                "sagemaker:DeleteModel",
+                "sagemaker:DescribeModel",
+                "sagemaker:DeleteEndpoint",
+                "sagemaker:DescribeEndpoint",
+                "sagemaker:InvokeEndpoint",
+                "sagemaker:DeleteEndpointConfig",
+                "sageamker:DescribeEndpointConfig",
+                "sagemaker:DescribeLabelingJob",
+                "sagemaker:StopLabelingJob",
+                "sagemaker:DescribeTrainingJob",
+                "sagemaker:StopTrainingJob",
+                "sagemaker:DescribeProcessingJob",
+                "sageamker:StopProcessingJob",
+                "sagemaker:DescribeHyperParameterTuningJob",
+                "sagemaker:StopHyperParameterTuningJob",
+                "sagemaker:DescribeTransformJob",
+                "sagemaker:StopTransformJob",
+                "sagemaker:UpdateEndpoint",
+                "sagemaker:UpdateEndpointWeightsAndCapacities",
                 "bedrock:Associate*",
                 "bedrock:Create*",
                 "bedrock:BatchDelete*",
@@ -48,7 +66,6 @@
                 "bedrock:Retrieve*",
                 "bedrock:Start*",
                 "bedrock:Update*",  
-
                 "bedrock:Apply*",
                 "bedrock:Detect*",
                 "bedrock:List*",
@@ -59,7 +76,8 @@
             "Resource": "*",
             "Condition": {
                 "StringNotEqualsIgnoreCase": {
-                    "aws:RequestTag/project": "Project001v20241002"
+                    "aws:RequestTag/project": "Project001v20241002",
+                    "aws:ResourceTag/project": "Project001v20241002"
                 }
             }
         },

diff --git a/frontend/docs/admin-guide/security/policies/project-policy.md b/frontend/docs/admin-guide/security/policies/project-policy.md
@@ -73,15 +73,32 @@ These actions grants a role the ability to create the specified SageMaker and Be
             "sagemaker:CreateProcessingJob",
             "sagemaker:CreateHyperParameterTuningJob",
             "sagemaker:CreateTransformJob",
-
+            "sagemaker:DeleteModel",
+            "sagemaker:DescribeModel",
+            "sagemaker:DeleteEndpoint",
+            "sagemaker:DescribeEndpoint",
+            "sagemaker:InvokeEndpoint",
+            "sagemaker:DeleteEndpointConfig",
+            "sageamker:DescribeEndpointConfig",
+            "sagemaker:DescribeLabelingJob",
+            "sagemaker:StopLabelingJob",
+            "sagemaker:DescribeTrainingJob",
+            "sagemaker:StopTrainingJob",
+            "sagemaker:DescribeProcessingJob",
+            "sageamker:StopProcessingJob",
+            "sagemaker:DescribeHyperParameterTuningJob",
+            "sagemaker:StopHyperParameterTuningJob",
+            "sagemaker:DescribeTransformJob",
+            "sagemaker:StopTransformJob",
+            "sagemaker:UpdateEndpoint",
+            "sagemaker:UpdateEndpointWeightsAndCapacities",
             "bedrock:Associate*",
             "bedrock:Create*",
             "bedrock:BatchDelete*",
             "bedrock:Delete*",
             "bedrock:Put*",
             "bedrock:Start*",
             "bedrock:Update*",  
-
             "bedrock:Apply*",
             "bedrock:Detect*",
             "bedrock:List*",
@@ -92,7 +109,8 @@ These actions grants a role the ability to create the specified SageMaker and Be
         "Resource": "*",
         "Condition": {
             "StringNotEqualsIgnoreCase": {
-                "aws:RequestTag/project": "Project001"
+                "aws:RequestTag/project": "Project001",
+                "aws:ResourceTag/project": "Project001v20241002"
             }
         }
     },

diff --git a/frontend/docs/admin-guide/security/policies/user-policy-raw.json b/frontend/docs/admin-guide/security/policies/user-policy-raw.json
@@ -70,7 +70,25 @@
                 "sagemaker:CreateProcessingJob",
                 "sagemaker:CreateHyperParameterTuningJob",
                 "sagemaker:CreateTransformJob",
-
+                "sagemaker:DeleteModel",
+                "sagemaker:DescribeModel",
+                "sagemaker:DeleteEndpoint",
+                "sagemaker:DescribeEndpoint",
+                "sagemaker:InvokeEndpoint",
+                "sagemaker:DeleteEndpointConfig",
+                "sageamker:DescribeEndpointConfig",
+                "sagemaker:DescribeLabelingJob",
+                "sagemaker:StopLabelingJob",
+                "sagemaker:DescribeTrainingJob",
+                "sagemaker:StopTrainingJob",
+                "sagemaker:DescribeProcessingJob",
+                "sageamker:StopProcessingJob",
+                "sagemaker:DescribeHyperParameterTuningJob",
+                "sagemaker:StopHyperParameterTuningJob",
+                "sagemaker:DescribeTransformJob",
+                "sagemaker:StopTransformJob",
+                "sagemaker:UpdateEndpoint",
+                "sagemaker:UpdateEndpointWeightsAndCapacities",
                 "bedrock:Associate*",
                 "bedrock:Create*",
                 "bedrock:BatchDelete*",
@@ -79,7 +97,6 @@
                 "bedrock:Retrieve*",
                 "bedrock:Start*",
                 "bedrock:Update*",
-
                 "bedrock:Apply*",
                 "bedrock:Detect*",
                 "bedrock:List*",
@@ -90,7 +107,8 @@
             "Resource": "*",
             "Condition": {
                 "StringNotEqualsIgnoreCase": {
-                    "aws:RequestTag/user": "jdoe"
+                    "aws:RequestTag/user": "jdoe",
+                    "aws:ResourceTag/user": "jdoe"
                 }
             }
         }

diff --git a/frontend/docs/admin-guide/security/policies/user-policy.md b/frontend/docs/admin-guide/security/policies/user-policy.md
@@ -125,7 +125,25 @@ These actions grants a role the ability to create the specified SageMaker and Be
             "sagemaker:CreateProcessingJob",
             "sagemaker:CreateHyperParameterTuningJob",
             "sagemaker:CreateTransformJob",
-
+            "sagemaker:DeleteModel",
+            "sagemaker:DescribeModel",
+            "sagemaker:DeleteEndpoint",
+            "sagemaker:DescribeEndpoint",
+            "sagemaker:InvokeEndpoint",
+            "sagemaker:DeleteEndpointConfig",
+            "sageamker:DescribeEndpointConfig",
+            "sagemaker:DescribeLabelingJob",
+            "sagemaker:StopLabelingJob",
+            "sagemaker:DescribeTrainingJob",
+            "sagemaker:StopTrainingJob",
+            "sagemaker:DescribeProcessingJob",
+            "sageamker:StopProcessingJob",
+            "sagemaker:DescribeHyperParameterTuningJob",
+            "sagemaker:StopHyperParameterTuningJob",
+            "sagemaker:DescribeTransformJob",
+            "sagemaker:StopTransformJob",
+            "sagemaker:UpdateEndpoint",
+            "sagemaker:UpdateEndpointWeightsAndCapacities",
             "bedrock:Associate*",
             "bedrock:Create*",
             "bedrock:BatchDelete*",
@@ -134,7 +152,6 @@ These actions grants a role the ability to create the specified SageMaker and Be
             "bedrock:Retrieve*",
             "bedrock:Start*",
             "bedrock:Update*",
-            
             "bedrock:Apply*",
             "bedrock:Detect*",
             "bedrock:List*",
@@ -145,7 +162,8 @@ These actions grants a role the ability to create the specified SageMaker and Be
         "Resource": "*",
         "Condition": {
             "StringNotEqualsIgnoreCase": {
-                "aws:RequestTag/user": "jdoe"
+                "aws:RequestTag/user": "jdoe",
+                "aws:ResourceTag/user": "jdoe"
             }
         }
     }