AWS sagemaker-unified-studio medium security documentation change

Service: sagemaker-unified-studio · 2025-05-01 · Security-related medium

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md

Summary

Added IAM role ARNs and new EventBridge scheduler deletion permissions with resource conditions

Security assessment

Expands IAM policy to include new query execution roles and adds scheduler:DeleteSchedule permission with strict resource constraints. These changes modify security permissions and access patterns for project provisioning roles.

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md
index 585bca928..608e3da52 100644
--- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md
+++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md
@@ -723 +723,2 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId>
-    				"arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole"
+    				"arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole",
+    				"arn:aws:iam::*:role/service-role/AmazonSageMakerQueryExecution"
@@ -1290 +1291,4 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId>
-    			"Resource": "arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole",
+    			"Resource": [
+    				"arn:aws:iam::*:role/SageMakerStudioQueryExecutionRole",
+    				"arn:aws:iam::*:role/service-role/AmazonSageMakerQueryExecution"
+    			],
@@ -2797,0 +2802,19 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId>
+    		},
+    		{
+    			"Sid": "EventBridgeScheduleDeleteAction",
+    			"Effect": "Allow",
+    			"Action": [
+    				"scheduler:DeleteSchedule"
+    			],
+    			"Resource": [
+    				"arn:aws:scheduler:*:*:schedule/SageMakerUnifiedStudio-*-*/*"
+    			],
+    			"Condition": {
+    				"StringEquals": {
+    					"aws:ResourceAccount": "${aws:PrincipalAccount}",
+    					"aws:CalledViaFirst": "cloudformation.amazonaws.com"
+    				},
+    				"Null": {
+    					"aws:ResourceTag/AmazonDataZoneProject": "false"
+    				}
+    			}
@@ -2809,2 +2831,0 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-SageMakerStudioDomainExecutionRolePolicy
-
@@ -2812,0 +2834,2 @@ SageMakerStudioProjectRoleMachineLearningPolicy
+SageMakerStudioDomainServiceRolePolicy
+