SageMaker Studio执行角色拒绝策略失效问题求助

问题场景 #

我们的SageMaker Studio为所有用户分配了默认执行角色，用户通过Jupyter Server应用开展操作。为该角色附加了一条拒绝策略，预期禁止创建ml.t3.medium等指定实例类型的Notebook实例，但实际仍能成功创建。尝试过ForAnyValue和ForAllValues条件，原策略如下：

{
    "Sid": "VisualEditor0",
    "Effect": "Deny",
    "Action": [
        "sagemaker:CreateSpace",
        "sagemaker:CreateDomain",
        "sagemaker:UpdateDomain",
        "sagemaker:CreateTrainingJob",
        "sagemaker:CreateProcessingJob",
        "sagemaker:CreateNotebookInstance",
        "sagemaker:UpdateNotebookInstance",
        "sagemaker:CreateApp",
        "sagemaker:StartNotebookInstance"
    ],
    "Resource": [
        "arn:aws:sagemaker:*:*:notebook-instance/*",
        "arn:aws:sagemaker:*:*:processing-job/*",
        "arn:aws:sagemaker:*:*:domain/*",
        "arn:aws:sagemaker:*:*:training-job/*",
        "arn:aws:sagemaker:*:*:space/*/*"
    ],
    "Condition": {
        "ForAnyValue:StringLike": {
            "sagemaker:InstanceTypes": [
                "ml.p3.*",
                "*.16x*",
                "*.24x*",
                "*.48x*",
                "ml.g5.12xlarge",
                "ml.t3.medium"
            ]
        }
    }
}

问题原因 #

1. 资源未覆盖App场景：用户通过SageMaker Studio创建Notebook实例时，实际调用的是sagemaker:CreateApp接口，对应的资源是app类型，但原策略的Resource列表中缺少app的ARN格式，导致策略无法匹配该操作。
2. 条件键不匹配：CreateApp等单实例操作对应的条件键是sagemaker:InstanceType（单数），而原策略仅使用了复数的sagemaker:InstanceTypes，无法触发拒绝规则。

修正后的策略 #

{
    "Sid": "DenyRestrictedInstanceTypes",
    "Effect": "Deny",
    "Action": [
        "sagemaker:CreateSpace",
        "sagemaker:CreateDomain",
        "sagemaker:UpdateDomain",
        "sagemaker:CreateTrainingJob",
        "sagemaker:CreateProcessingJob",
        "sagemaker:CreateNotebookInstance",
        "sagemaker:UpdateNotebookInstance",
        "sagemaker:CreateApp",
        "sagemaker:StartNotebookInstance"
    ],
    "Resource": [
        "arn:aws:sagemaker:*:*:notebook-instance/*",
        "arn:aws:sagemaker:*:*:processing-job/*",
        "arn:aws:sagemaker:*:*:domain/*",
        "arn:aws:sagemaker:*:*:training-job/*",
        "arn:aws:sagemaker:*:*:space/*/*",
        "arn:aws:sagemaker:*:*:app/*/*/*/*"
    ],
    "Condition": {
        "Or": [
            {
                "ForAnyValue:StringLike": {
                    "sagemaker:InstanceTypes": [
                        "ml.p3.*",
                        "*.16x*",
                        "*.24x*",
                        "*.48x*",
                        "ml.g5.12xlarge",
                        "ml.t3.medium"
                    ]
                }
            },
            {
                "StringLike": {
                    "sagemaker:InstanceType": [
                        "ml.p3.*",
                        "*.16x*",
                        "*.24x*",
                        "*.48x*",
                        "ml.g5.12xlarge",
                        "ml.t3.medium"
                    ]
                }
            }
        ]
    }
}

修正说明 #

• 补充arn:aws:sagemaker:*:*:app/*/*/*/*资源，覆盖SageMaker Studio中创建Jupyter Server等App的操作场景
• 通过Or条件同时匹配单数和复数的实例类型条件键，确保单实例（如CreateApp）和多实例（如CreateTrainingJob）操作都能触发拒绝规则
• 保留原有的实例类型匹配规则，确保所有需要限制的实例类型都被覆盖

内容的提问来源于stack exchange，提问作者gary69