AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2025-03-02 · Documentation low

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md

Summary

Updated policy documentation with changes to network interface permissions and added new SageMaker search permissions with visibility conditions.

Security assessment

The changes modify and add IAM permissions which are security-related features, but there is no evidence these changes address specific security vulnerabilities or incidents.

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md
index 7b143a4f8..7c6450047 100644
--- a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md
+++ b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md
@@ -23,5 +22,0 @@ An administrator can disable certain permissions in this policy by tagging the r
-    				"ec2:CreateNetworkInterface",
-    				"ec2:DeleteNetworkInterface",
-    				"ec2:AttachNetworkInterface",
-    				"ec2:CreateNetworkInterfacePermission",
-    				"ec2:DeleteNetworkInterfacePermission",
@@ -41,2 +36 @@ An administrator can disable certain permissions in this policy by tagging the r
-    					],
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}"
+    					]
@@ -52,0 +47,3 @@ An administrator can disable certain permissions in this policy by tagging the r
+    				"ec2:CreateNetworkInterface",
+    				"ec2:DeleteNetworkInterface",
+    				"ec2:AttachNetworkInterface",
@@ -63,3 +59,0 @@ An administrator can disable certain permissions in this policy by tagging the r
-    				"StringEquals": {
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}"
-    				},
@@ -401 +394,0 @@ An administrator can disable certain permissions in this policy by tagging the r
-    				"sagemaker:Search",
@@ -427,0 +421,14 @@ An administrator can disable certain permissions in this policy by tagging the r
+    		{
+    			"Sid": "SageMakerSearchPermissions",
+    			"Effect": "Allow",
+    			"Action": [
+    				"sagemaker:Search"
+    			],
+    			"Resource": "*",
+    			"Condition": {
+    				"StringEquals": {
+    					"aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true",
+    					"sagemaker:SearchVisibilityCondition/Tags.AmazonDataZoneProject/EqualsIfExists": "${aws:PrincipalTag/AmazonDataZoneProject}"
+    				}
+    			}
+    		},
@@ -874 +881 @@ SageMakerStudioProjectUserRolePolicy
-AmazonDataZoneBedrockModelManagementPolicy
+SageMakerStudioDomainServiceRolePolicy