AWS sagemaker-unified-studio documentation change
Summary
Added three new IAM managed policies related to Amazon Bedrock integration and corrected policy link formatting. Updated existing policy entries with proper links.
Security assessment
The changes document new IAM policies which are security-related access controls, but there is no evidence of addressing a specific security vulnerability. The updates add documentation about security features (managed policies).
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md index 685fdb33d..c8269fc5c 100644 --- a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md +++ b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md @@ -12,0 +13,3 @@ Change | Description | Date +New policy - [SageMakerStudioBedrockFunctionExecutionRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFunctionExecutionRolePolicy) | This policy allows AWS Lambda to access an Amazon Bedrock function component's configuration in Amazon SageMaker Unified Studio. | 2/25/2025 +New policy - [SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy) | This policy provides access to configure vector stores and Amazon Bedrock knowledge bases in Amazon SageMaker Unified Studio. | 2/25/2025 +New policy - [SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy) | This policy allows Amazon Bedrock Knowledge Bases to access Amazon Bedrock models and data sources in Amazon SageMaker Unified Studio. | 2/25/2025 @@ -14,5 +17,5 @@ Policy update - [SageMakerStudioProjectProvisioningRolePolicy](https://docs.aws. -New policy - [SageMakerStudioBedrockEvaluationJobServiceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-security-iam-awsmanpol-SageMakerStudioBedrockEvaluationJobServiceRolePolicy) | This policy allows Amazon Bedrock to access Amazon Bedrock models and datasets for evaluation jobs in Amazon SageMaker Unified Studio. | 2/14/2025 -New policy - [SageMakerStudioBedrockPromptUserRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-security-iam-awsmanpol-SageMakerStudioBedrockPromptUserRolePolicy) | This policy provides access to an Amazon Bedrock prompt and its configuration in Amazon SageMaker Unified Studio. | 2/14/2025 -New policy - [SageMakerStudioBedrockFlowServiceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy) | This policy allows Amazon Bedrock Flows to access Amazon Bedrock models and other resources attached to a flow in Amazon SageMaker Unified Studio. | 2/14/2025 -New policy - [SageMakerStudioBedrockChatAgentUserRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-security-iam-awsmanpol-SageMakerStudioBedrockChatAgentUserRolePolicy) | This policy provides access to an Amazon Bedrock chat agent app's configuration and Amazon Bedrock agent in Amazon SageMaker Unified Studio. | 2/14/2025 -New policy - [SageMakerStudioBedrockAgentServiceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-security-iam-awsmanpol-SageMakerStudioBedrockAgentServiceRolePolicy) | This policy allows Amazon Bedrock Agents to access Amazon Bedrock models and other resources attached to an agent in Amazon SageMaker Unified Studio. | 2/14/2025 +New policy - [SageMakerStudioBedrockEvaluationJobServiceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockEvaluationJobServiceRolePolicy) | This policy allows Amazon Bedrock to access Amazon Bedrock models and datasets for evaluation jobs in Amazon SageMaker Unified Studio. | 2/14/2025 +New policy - [SageMakerStudioBedrockPromptUserRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockPromptUserRolePolicy) | This policy provides access to an Amazon Bedrock prompt and its configuration in Amazon SageMaker Unified Studio. | 2/14/2025 +New policy - [SageMakerStudioBedrockFlowServiceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy) | This policy allows Amazon Bedrock Flows to access Amazon Bedrock models and other resources attached to a flow in Amazon SageMaker Unified Studio. | 2/14/2025 +New policy - [SageMakerStudioBedrockChatAgentUserRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockChatAgentUserRolePolicy) | This policy provides access to an Amazon Bedrock chat agent app's configuration and Amazon Bedrock agent in Amazon SageMaker Unified Studio. | 2/14/2025 +New policy - [SageMakerStudioBedrockAgentServiceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockAgentServiceRolePolicy) | This policy allows Amazon Bedrock Agents to access Amazon Bedrock models and other resources attached to an agent in Amazon SageMaker Unified Studio. | 2/14/2025 @@ -22 +25 @@ New Policy - [SageMakerStudioQueryExecutionRolePolicy](https://docs.aws.amazon.c -Policy update - [SageMakerStudioProjectProvisioningRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy) | Policy updates to SageMakerStudioProjectProvisioningRolePolicy - adding permissions to manage IAM roles with only AWS managed policies attached to them and no permissions boundary. Also adding permissions to update the AWS Lambda function for Amazon Athena federated connections. | 1/31/2025 +Policy update - [SageMakerStudioProjectProvisioningRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy) | Policy updates to SageMakerStudioProjectProvisioningRolePolicy - adding permissions to manage IAM roles with only AWS managed policies attached to them and no permissions boundary. Also adding permissions to update the AWS Lambda function for Amazon Athena federated connections. | 1/31/2025 @@ -45 +48 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -SageMakerStudioBedrockEvaluationJobServiceRolePolicy +SageMakerStudioBedrockFunctionExecutionRolePolicy