如何为SageMaker用户配置文件执行角色添加sagemaker:CreateApp权限

API 探路者

2026-9-1

问题对应报错

SageMaker is unable to use your associated ExecutionRole [arn:aws:iam::xxxxxxxxxxxx:role/sagemaker-workshop-data-ml] to create app. Verify that your associated ExecutionRole has permission for 'sagemaker:CreateApp'

可选解决方案

两种方式都可以解决问题，按需选择即可：

直接附加AWS现成托管策略
AWS官方托管的AmazonSageMakerFullAccess最新版本已经包含sagemaker:CreateApp以及SageMaker Studio运行所需的全部关联权限，不需要自定义策略。如果当前角色绑定的是自定义的“SageMaker全访问”策略，大概率是自定义策略内容不全，漏掉了Studio相关的API权限。
Terraform绑定托管策略的参考配置：
```
resource "aws_iam_role_policy_attachment" "sagemaker_managed_full_access" {
  role       = "sagemaker-workshop-data-ml"
  policy_arn = "arn:aws:iam::aws:policy/AmazonSageMakerFullAccess"
}
```

自定义最小权限策略附加
如果不想授予全量SageMaker访问权限，可以通过Terraform编写仅包含所需权限的自定义策略，绑定到现有角色即可。参考配置：

resource "aws_iam_policy" "sagemaker_studio_basic_perms" {
  name   = "sagemaker-studio-basic-permissions"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = [
          "sagemaker:CreateApp",
          "sagemaker:DescribeApp",
          "sagemaker:DeleteApp",
          "sagemaker:ListApps",
          "sagemaker:CreatePresignedDomainUrl"
        ]
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "sagemaker_studio_basic_perms_attach" {
  role       = "sagemaker-workshop-data-ml"
  policy_arn = aws_iam_policy.sagemaker_studio_basic_perms.arn
}