AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2025-04-20 · Documentation medium

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy.md

Summary

Added SQL Workbench permissions and Bedrock GenerateQuery action to the IAM policy documentation

Security assessment

The change expands the IAM policy to include permissions for SQL Workbench and Bedrock query generation. This updates security documentation to reflect new access controls but does not indicate a security issue fix.

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy.md
index 2ceee4c7a..13880561d 100644
--- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy.md
+++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy.md
@@ -13 +13,3 @@ This policy grants the Amazon Bedrock service access to resources attached to Am
-  * Amazon Bedrock permissions are required for Amazon Bedrock knowledge bases to invoke Amazon Bedrock models enabled at the project level.
+  * Amazon Bedrock permissions are required for Amazon Bedrock knowledge bases to invoke Amazon Bedrock models enabled at the project level and generate queries.
+
+  * AWS SQL Workbench permissions are required to generate SQL recommendations for querying structured data sources.
@@ -153,0 +156,19 @@ This policy allows the Amazon Bedrock service to access specific resources tagge
+    		},
+    		{
+    			"Sid": "SqlWorkbenchAccessPermissions",
+    			"Effect": "Allow",
+    			"Action": [
+    				"sqlworkbench:GetSqlRecommendations",
+    				"sqlworkbench:PutSqlGenerationContext",
+    				"sqlworkbench:GetSqlGenerationContext",
+    				"sqlworkbench:DeleteSqlGenerationContext"
+    			],
+    			"Resource": "*"
+    		},
+    		{
+    			"Sid": "BedrockGenerateQueryPermissions",
+    			"Effect": "Allow",
+    			"Action": [
+    				"bedrock:GenerateQuery"
+    			],
+    			"Resource": "*"
@@ -165,2 +185,0 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-SageMakerStudioBedrockEvaluationJobServiceRolePolicy
-
@@ -168,0 +188,2 @@ SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy
+SageMakerStudioBedrockFunctionExecutionRolePolicy
+