AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2025-04-11 · Documentation low

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md

Summary

Added scheduler.amazonaws.com service principal, tag-based conditions for resource isolation, and EventBridge schedule management permissions.

Security assessment

Enhances permissions for scheduling features and adds tag-based access controls. No explicit security vulnerability addressed, but improves least-privilege practices.

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md
index 2c9e3a1e2..615431388 100644
--- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md
+++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.md
@@ -1261 +1261,2 @@ An administrator can disable certain permissions in this policy by tagging the r
-    						"emr-serverless.amazonaws.com"
+    						"emr-serverless.amazonaws.com",
+    						"scheduler.amazonaws.com"
@@ -1345,0 +1347,3 @@ An administrator can disable certain permissions in this policy by tagging the r
+    				},
+    				"Null": {
+    					"aws:ResourceTag/AmazonDataZoneEnvironment": "true"
@@ -1578 +1582,2 @@ An administrator can disable certain permissions in this policy by tagging the r
-    						"s3.*.amazonaws.com"
+    						"s3.*.amazonaws.com",
+    						"scheduler.*.amazonaws.com"
@@ -1633 +1638,2 @@ An administrator can disable certain permissions in this policy by tagging the r
-    						"codecommit.*.amazonaws.com"
+    						"codecommit.*.amazonaws.com",
+    						"scheduler.*.amazonaws.com"
@@ -2481,0 +2488,33 @@ An administrator can disable certain permissions in this policy by tagging the r
+    		},
+    		{
+    			"Sid": "EventBridgeScheduleActions",
+    			"Effect": "Allow",
+    			"Action": [
+    				"scheduler:CreateSchedule",
+    				"scheduler:GetSchedule",
+    				"scheduler:UpdateSchedule",
+    				"scheduler:DeleteSchedule"
+    			],
+    			"Resource": [
+    				"arn:aws:scheduler:*:*:schedule/*"
+    			],
+    			"Condition": {
+    				"StringEquals": {
+    					"aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}"
+    				}
+    			}
+    		},
+    		{
+    			"Sid": "EventBridgeScheduleGroupActions",
+    			"Effect": "Allow",
+    			"Action": [
+    				"scheduler:GetScheduleGroup"
+    			],
+    			"Resource": [
+    				"arn:aws:scheduler:*:*:schedule-group/*"
+    			],
+    			"Condition": {
+    				"StringEquals": {
+    					"aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}"
+    				}
+    			}
@@ -2493,2 +2531,0 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-SageMakerStudioProjectRoleMachineLearningPolicy
-
@@ -2496,0 +2534,2 @@ SageMakerStudioDomainServiceRolePolicy
+AmazonDataZoneBedrockModelManagementPolicy
+