AmazonSageMakerHyperPodInferenceAccess
Last Modified
Jul 20, 2026
July 20, 2026 at 09:03 PM UTC
Version
v4
Total Versions
2
Created
Jul 20, 2026
Actions
50
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DeleteObjectsPermission",
"Effect": "Allow",
"Action": [
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::hyperpod-tls*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3GetObjectAccess",
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::hyperpod-tls*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"s3:ExistingObjectTag/CreatedBy": "HyperPodInference"
}
}
},
{
"Sid": "S3PutObjectAccess",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:PutObjectTagging"
],
"Resource": [
"arn:aws:s3:::hyperpod-tls*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"s3:RequestObjectTag/CreatedBy": "HyperPodInference"
}
}
},
{
"Sid": "DataCaptureS3",
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": [
"arn:aws:s3:::hyperpod-tls*/data-capture/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "S3ListBucketAccess",
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::hyperpod-tls*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "DataCaptureKMS",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringLike": {
"kms:ViaService": "s3.*.amazonaws.com",
"kms:EncryptionContext:aws:s3:arn": "arn:aws:s3:::hyperpod-tls*"
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ECRAuthorization",
"Effect": "Allow",
"Action": [
"ecr:GetAuthorizationToken"
],
"Resource": "*"
},
{
"Sid": "ECRRepositoryAccess",
"Effect": "Allow",
"Action": [
"ecr:GetDownloadUrlForLayer",
"ecr:BatchGetImage"
],
"Resource": "arn:aws:ecr:*:*:repository/*"
},
{
"Sid": "EC2DescribeAccess",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeInstanceTypes",
"ec2:DescribeNetworkInterfaces",
"ec2:DescribeSubnets",
"ec2:DescribeDhcpOptions",
"ec2:DescribeSecurityGroups"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EC2NetworkInterfaceActions",
"Effect": "Allow",
"Action": [
"ec2:CreateNetworkInterface",
"ec2:CreateNetworkInterfacePermission",
"ec2:DeleteNetworkInterface"
],
"Resource": [
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EKSClusterAccess",
"Effect": "Allow",
"Action": [
"eks:DescribeCluster",
"eks-auth:AssumeRoleForPodIdentity"
],
"Resource": "arn:aws:eks:*:*:cluster/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "EKSAccessEntryPolicyAssociation",
"Effect": "Allow",
"Action": [
"eks:AssociateAccessPolicy",
"eks:DisassociateAccessPolicy"
],
"Resource": "arn:aws:eks:*:*:access-entry/*",
"Condition": {
"StringEquals": {
"eks:policyarn": "arn:aws:eks::aws:cluster-access-policy/AmazonSagemakerHyperpodInferenceMonitoringPolicy"
}
}
},
{
"Sid": "EKSAccessEntryListPolicies",
"Effect": "Allow",
"Action": [
"eks:ListAssociatedAccessPolicies"
],
"Resource": "arn:aws:eks:*:*:access-entry/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ELBListAndDescribeAccess",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:DescribeLoadBalancers"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "FSxAccess",
"Effect": "Allow",
"Action": [
"fsx:DescribeFileSystems"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CertificateImportPermission",
"Effect": "Allow",
"Action": [
"acm:AddTagsToCertificate",
"acm:ImportCertificate"
],
"Resource": "arn:aws:acm:*:*:certificate/*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": "CreatedBy"
},
"StringEquals": {
"aws:RequestTag/CreatedBy": "HyperPodInference",
"aws:ResourceTag/CreatedBy": "HyperPodInference",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CertificateDeletePermission",
"Effect": "Allow",
"Action": "acm:DeleteCertificate",
"Resource": "arn:aws:acm:*:*:certificate/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/CreatedBy": "HyperPodInference"
}
}
},
{
"Sid": "AllowPassRoleToSageMaker",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/SageMakerHyperPodInference*",
"Condition": {
"StringEquals": {
"iam:PassedToService": "sagemaker.amazonaws.com"
}
}
},
{
"Sid": "CloudWatchMetricsAccess",
"Effect": "Allow",
"Action": [
"cloudwatch:PutMetricData"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": "HyperPodInference"
}
}
},
{
"Sid": "CloudWatchLogsAccess",
"Effect": "Allow",
"Action": [
"logs:PutLogEvents",
"logs:CreateLogStream",
"logs:CreateLogGroup"
],
"Resource": [
"arn:aws:logs:*:*:log-group:*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SageMakerAccess",
"Effect": "Allow",
"Action": [
"sagemaker:DescribeModel",
"sagemaker:DescribeEndpointConfig",
"sagemaker:DescribeEndpoint",
"sagemaker:DescribeCluster",
"sagemaker:DescribeClusterInference",
"sagemaker:UpdateClusterInference",
"sagemaker:DescribeHubContent"
],
"Resource": [
"arn:aws:sagemaker:*:*:model/*",
"arn:aws:sagemaker:*:*:endpoint/*",
"arn:aws:sagemaker:*:*:endpointconfig/*",
"arn:aws:sagemaker:*:*:cluster/*",
"arn:aws:sagemaker:*:*:hub-content/*",
"arn:aws:sagemaker:*:*:hub/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SageMakerCreateAccess",
"Effect": "Allow",
"Action": [
"sagemaker:CreateModel",
"sagemaker:CreateEndpointConfig",
"sagemaker:CreateEndpoint"
],
"Resource": [
"arn:aws:sagemaker:*:*:model/*",
"arn:aws:sagemaker:*:*:endpoint/*",
"arn:aws:sagemaker:*:*:endpoint-config/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedBy": "HyperPodInference"
}
}
},
{
"Sid": "SageMakerTagging",
"Effect": "Allow",
"Action": [
"sagemaker:AddTags"
],
"Resource": [
"arn:aws:sagemaker:*:*:model/*",
"arn:aws:sagemaker:*:*:endpoint/*",
"arn:aws:sagemaker:*:*:endpoint-config/*"
],
"Condition": {
"StringEquals": {
"sagemaker:TaggingAction": [
"CreateModel",
"CreateEndpointConfig",
"CreateEndpoint"
]
}
}
},
{
"Sid": "SageMakerDeleteAccess",
"Effect": "Allow",
"Action": [
"sagemaker:DeleteModel",
"sagemaker:DeleteEndpointConfig",
"sagemaker:DeleteEndpoint",
"sagemaker:UpdateEndpoint"
],
"Resource": [
"arn:aws:sagemaker:*:*:model/*",
"arn:aws:sagemaker:*:*:endpoint/*",
"arn:aws:sagemaker:*:*:endpoint-config/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedBy": "HyperPodInference"
}
}
}
]
},
"VersionId": "v4",
"IsDefaultVersion": true,
"CreateDate": "2026-07-20T20:57:13+00:00"
}
}Version History (5 recorded)
Raw historyv4updated
5 actions added
AmazonSageMakerHyperPodInferenceAccess - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
46e8594AmazonSageMakerHyperPodInferenceAccess - Policy Version v3
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
7d6ba5cAmazonSageMakerHyperPodInferenceAccess - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
96e332cAmazonSageMakerHyperPodInferenceAccess - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Jan 28, 2026
8af07e6