Minimum Permissions

1{
2  "Version": "2012-10-17",
3  "Statement": [
4    {
5      "Sid": "S3ModelArtifactAccess",
6      "Effect": "Allow",
7      "Action": [
8        "s3:GetObject",
9        "s3:ListBucket"
10      ],
11      "Resource": [
12        "arn:aws:s3:::REPLACE_WITH_MODEL_BUCKET",
13        "arn:aws:s3:::REPLACE_WITH_MODEL_BUCKET/*"
14      ]
15    },
16    {
17      "Sid": "ECRPullServingImages",
18      "Effect": "Allow",
19      "Action": [
20        "ecr:GetAuthorizationToken",
21        "ecr:BatchCheckLayerAvailability",
22        "ecr:GetDownloadUrlForLayer",
23        "ecr:BatchGetImage"
24      ],
25      "Resource": "*"
26    },
27    {
28      "Sid": "CloudWatchLogs",
29      "Effect": "Allow",
30      "Action": [
31        "logs:CreateLogStream",
32        "logs:CreateLogGroup",
33        "logs:PutLogEvents",
34        "logs:DescribeLogStreams"
35      ],
36      "Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*"
37    },
38    {
39      "Sid": "CloudWatchMetrics",
40      "Effect": "Allow",
41      "Action": [
42        "cloudwatch:PutMetricData"
43      ],
44      "Resource": "*"
45    }
46  ]
47}