AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2025-04-11 · Documentation medium

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md

Summary

Added Bedrock InvokeAgent permissions and KMS encryption requirements for agent operations

Security assessment

Introduces granular access controls and encryption requirements for Bedrock agents, enhancing security documentation but not fixing a known vulnerability

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md
index 7791237b5..6579263fd 100644
--- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md
+++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md
@@ -110,0 +111,12 @@ This policy allows the Amazon Bedrock service to access specific resources tagge
+    		{
+    			"Sid": "BedrockInvokeAgentPermissions",
+    			"Effect": "Allow",
+    			"Action": "bedrock:InvokeAgent",
+    			"Resource": "arn:aws:bedrock:*:*:agent-alias/*",
+    			"Condition": {
+    				"StringEquals": {
+    					"aws:ResourceAccount": "${aws:PrincipalAccount}",
+    					"aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}"
+    				}
+    			}
+    		},
@@ -144,0 +157,18 @@ This policy allows the Amazon Bedrock service to access specific resources tagge
+    		},
+    		{
+    			"Sid": "BedrockAgentKmsPermissions",
+    			"Effect": "Allow",
+    			"Action": [
+    				"kms:Decrypt",
+    				"kms:GenerateDataKey"
+    			],
+    			"Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}",
+    			"Condition": {
+    				"StringLike": {
+    					"kms:ViaService": "bedrock.*.amazonaws.com",
+    					"kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:agent/*"
+    				},
+    				"StringEquals": {
+    					"aws:ResourceAccount": "${aws:PrincipalAccount}"
+    				}
+    			}
@@ -156,2 +185,0 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-SageMakerStudioBedrockChatAgentUserRolePolicy
-
@@ -159,0 +188,2 @@ SageMakerStudioBedrockPromptUserRolePolicy
+SageMakerStudioBedrockEvaluationJobServiceRolePolicy
+