packages/constructs/L3/governance/roles-l3-construct/policy-statements/service-based/sagemaker-basic-policy.yaml

statements:
  - Sid: SagemakerNoResourceAccessPolicy
    Action: 
      - 'sagemaker:GetSearchSuggestions'
      - 'sagemaker:ListActions'
      - 'sagemaker:ListAlgorithms'
      - 'sagemaker:ListAppImageConfigs'
      - 'sagemaker:ListApps'
      - 'sagemaker:ListArtifacts'
      - 'sagemaker:ListAssociations'
      - 'sagemaker:ListAutoMLJobs'
      - 'sagemaker:ListCandidatesForAutoMLJob'
      - 'sagemaker:ListCodeRepositories'
      - 'sagemaker:ListCompilationJobs'
      - 'sagemaker:ListContexts'
      - 'sagemaker:ListDataQualityJobDefinitions'
      - 'sagemaker:ListDeviceFleets'
      - 'sagemaker:ListDevices'
      - 'sagemaker:ListDomains'
      - 'sagemaker:ListEdgeDeploymentPlans'
      - 'sagemaker:ListEdgePackagingJobs'
      - 'sagemaker:ListEndpointConfigs'
      - 'sagemaker:ListEndpoints'
      - 'sagemaker:ListExperiments'
      - 'sagemaker:ListFeatureGroups'
      - 'sagemaker:ListFlowDefinitions'
      - 'sagemaker:ListHubs'
      - 'sagemaker:ListHuman*'
      - 'sagemaker:ListHyperParameterTuningJobs'
      - 'sagemaker:ListImages'
      - 'sagemaker:ListInference*'
      - 'sagemaker:ListLabelingJobs'
      - 'sagemaker:ListLineageGroups'
      - 'sagemaker:ListModelBiasJobDefinitions'
      - 'sagemaker:ListModelCards'
      - 'sagemaker:ListModelExplainabilityJobDefinitions'
      - 'sagemaker:ListModelMetadata'
      - 'sagemaker:ListModelPackageGroups'
      - 'sagemaker:ListModelQualityJobDefinitions'
      - 'sagemaker:ListModels'
      - 'sagemaker:ListMonitoring*'
      - 'sagemaker:ListNotebookInstanceLifecycleConfigs'
      - 'sagemaker:ListNotebookInstances'
      - 'sagemaker:ListPipelines'
      - 'sagemaker:ListProcessingJobs'
      - 'sagemaker:ListProjects'
      - 'sagemaker:ListResourceCatalogs'
      - 'sagemaker:ListStageDevices'
      - 'sagemaker:ListStudioLifecycleConfigs'
      - 'sagemaker:ListSubscribedWorkteams'
      - 'sagemaker:ListTrainingJobs'
      - 'sagemaker:ListTransformJobs'
      - 'sagemaker:ListTrialComponents'
      - 'sagemaker:ListTrials'
      - 'sagemaker:ListUserProfiles'
      - 'sagemaker:ListWorkforces'
      - 'sagemaker:ListWorkteams'
      - 'sagemaker:Search'
    Resource: '*'
    Effect: Allow
suppressions:
    -   id: "AwsSolutions-IAM5"
        reason: "Policy actions do not require Resource!"