braket-iam-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "IamPassRole",
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::*:role/AmazonBraketServiceSageMakerNotebookRole-*"
        },
        {
            "Sid": "SageMakerActions",
            "Effect": "Allow",
            "Action": [
                "sagemaker:DeleteNotebookInstance",
                "sagemaker:StopNotebookInstance",
                "sagemaker:CreatePresignedNotebookInstanceUrl",
                "sagemaker:CreateNotebookInstanceLifecycleConfig",
                "sagemaker:ListNotebookInstances",
                "sagemaker:CreateNotebookInstance"
            ],
            "Resource": "*"
        }
    ]
}

braket-notebook-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::amazon-braket-*",
                "arn:aws:s3:::braketnotebookcdk-*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:DescribeLogStreams",
                "logs:PutLogEvents",
                "logs:CreateLogGroup"
            ],
            "Resource": [
                "arn:aws:logs:*::log-group:/aws/sagemaker/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": "braket:*",
            "Resource": "*"
        }
    ]
}

braket-notebook-role-trust-relationship.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "sagemaker.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

restrict-qpu-create-task-policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ExplicitAllowReadOnlyActionsOnAllTasks",
            "Effect": "Allow",
            "Action": [
                "braket:GetQuantumTask",
                "braket:ListTagsForResource"
            ],
            "Resource": "arn:aws:braket:*:*:quantum-task/*"
        },
        {
            "Sid": "ExplicitAllowReadOnlyActionsOnAllResources",
            "Effect": "Allow",
            "Action": [
                "braket:GetDevice",
                "braket:SearchDevices",
                "braket:SearchQuantumTasks"
            ],
            "Resource": "*"
        },
        {
            "Sid": "ExplicitDenyCreateQuantumTask",
            "Effect": "Deny",
            "Action": "braket:CreateQuantumTask",
            "Resource": "arn:aws:braket:*:*:device/qpu/*"
        }
    ]
}