AWS sagemaker-unified-studio medium security documentation change

Service: sagemaker-unified-studio · 2025-03-26 · Security-related medium

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md

Summary

Added conditional policy to restrict access to default Glue database and expanded Bedrock role permissions

Security assessment

The policy change explicitly prevents access to the default Glue database (security hardening) and documents new security-related role permissions

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md
index f32cf55b5..2c9e3a1e2 100644
--- a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md
+++ b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md
@@ -969,0 +970,11 @@ An administrator can disable certain permissions in this policy by tagging the r
+    		{
+    			"Sid": "AllowGlueGetDatabasesExceptDefault",
+    			"Effect": "Allow",
+    			"Action": "glue:GetDatabases",
+    			"NotResource": "arn:aws:glue:*:*:database/default",
+    			"Condition": {
+    				"StringEquals": {
+    					"glue:LakeFormationPermissions": "Enabled"
+    				}
+    			}
+    		},
@@ -1033 +1043,0 @@ An administrator can disable certain permissions in this policy by tagging the r
-    				"glue:GetDatabases",
@@ -1929 +1939,4 @@ An administrator can disable certain permissions in this policy by tagging the r
-    			"Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*",
+    			"Resource": [
+    				"arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*",
+    				"arn:aws:iam::*:role/AmazonBedrockServiceRole-${aws:PrincipalTag/AmazonDataZoneProject}-*"
+    			],
@@ -1943 +1956,4 @@ An administrator can disable certain permissions in this policy by tagging the r
-    			"Resource": "arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*",
+    			"Resource": [
+    				"arn:aws:iam::*:role/AmazonBedrockEvaluationRole-${aws:PrincipalTag/AmazonDataZoneProject}-*",
+    				"arn:aws:iam::*:role/AmazonBedrockServiceRole-${aws:PrincipalTag/AmazonDataZoneProject}-*"
+    			],
@@ -2477,2 +2492,0 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-SageMakerStudioDomainExecutionRolePolicy
-
@@ -2480,0 +2495,2 @@ SageMakerStudioProjectRoleMachineLearningPolicy
+SageMakerStudioDomainServiceRolePolicy
+