AWS sagemaker-unified-studio high security documentation change
Summary
Updated IAM policy document with shortened Sid values, removed redundant conditions, expanded resource ARNs, added new permissions for QuickSight and EventBridge, and modified existing permissions for CloudFormation, IAM, EMR Serverless, and other services.
Security assessment
The changes remove 'aws:ResourceAccount' conditions in multiple policy statements, potentially broadening cross-account permissions. For example, the CloudFormation DeleteStack permission (CfnDelete) lost its account restriction. The EMR Serverless resource ARN was widened from specific patterns to wildcard '*'. Added UntagRole permissions could enable privilege escalation via tag manipulation. These changes impact the principle of least privilege.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md index 608e3da52..5474c96ec 100644 --- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md +++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy.md @@ -43 +43 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "CloudFormationStackCreationAndTagging", + "Sid": "CfnCreate", @@ -68 +68 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "CloudFormationStackManagement", + "Sid": "CfnManage", @@ -88,16 +88 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "CloudFormationStackDeletion", - "Effect": "Allow", - "Action": [ - "cloudformation:DeleteStack" - ], - "Resource": [ - "arn:aws:cloudformation:*:*:stack/DataZone*" - ], - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "CloudFormationListStacks", + "Sid": "CfnDelete", @@ -105,0 +91 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> + "cloudformation:DeleteStack", @@ -118 +104 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "LakeFormationPermissionsForDataLakeValidation", + "Sid": "LFManage", @@ -125,8 +111 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "lakeformation:ListPermissions" - ], - "Resource": "*" - }, - { - "Sid": "LakeFormationPermissionsForDataLakeResourceGrant", - "Effect": "Allow", - "Action": [ + "lakeformation:ListPermissions", @@ -143 +122 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "PermissionsToGetBlueprintTemplates", + "Sid": "GetDataZoneTemplate", @@ -157 +136 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "CodeCommitCreationAndTagging", + "Sid": "CodeCommitCreate", @@ -216 +195 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "CodeCommitListRepositories", + "Sid": "CodeCommitList", @@ -224 +203 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "CodeCommitKmsPermissions", + "Sid": "CodeCommitKms", @@ -260,2 +239 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -266 +244 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "IAMRoleAndPolicyManagement", + "Sid": "IAMManage", @@ -285 +262,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -294 +271 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "IAMRoleAndPolicyManagementFromDataZone", + "Sid": "IAMManageFromDataZone", @@ -305 +281,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -325,2 +301 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -345,2 +320 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -374,2 +348 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -398 +371,4 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Action": "iam:TagRole", + "Action": [ + "iam:TagRole", + "iam:UntagRole" + ], @@ -409,2 +385 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -440 +415,4 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Action": "iam:TagRole", + "Action": [ + "iam:TagRole", + "iam:UntagRole" + ], @@ -444,2 +422 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -476,3 +452,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, @@ -493 +467,4 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Action": "iam:TagRole", + "Action": [ + "iam:TagRole", + "iam:UntagRole" + ], @@ -500,2 +477 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -526,2 +502 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -553,2 +528 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -575,3 +548,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, @@ -594 +564,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -606,7 +576,3 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "arn:aws:iam::*:role/datazone*" - ], - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } + "arn:aws:iam::*:role/datazone*", + "arn:aws:iam::*:role/AmazonBedrock*" + ] @@ -631,6 +597 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - ], - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } + ] @@ -639 +600 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "IAMPolicyManagementWithoutRequiredResources", + "Sid": "IAMListPolicy", @@ -647 +608 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "GlueConnectionTypeUnrestrictedAccess", + "Sid": "GlueConnection", @@ -656 +617 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "IAMInstanceProfileManagement", + "Sid": "IAMInstanceProfile", @@ -668,2 +629 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:CalledViaFirst": "cloudformation.amazonaws.com", - "aws:ResourceAccount": "${aws:PrincipalAccount}" + "aws:CalledViaFirst": "cloudformation.amazonaws.com" @@ -687 +646,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -708 +666,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -728 +685,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -746 +702,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -763 +718,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -781 +735,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -797 +750,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -803 +756 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "IamCreateServiceLinkedRoleForAoss", + "Sid": "IamCreateSLRForAoss", @@ -810 +762,0 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "aws:ResourceAccount": "${aws:PrincipalAccount}", @@ -833 +785 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "GlueDatabaseCreationFromCloudFormation", + "Sid": "GlueDbCreateFromCfn", @@ -839,2 +791 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "arn:aws:glue:*:*:database/*", - "arn:aws:glue:*:*:catalog" + "arn:aws:glue:*:*:database/*" @@ -934 +885 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "FederatedDataGlueConnectionPermissions", + "Sid": "FederatedGlueConnection", @@ -952 +903 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "FederatedDataAthenaConnectionPermissions", + "Sid": "FederatedAthenaConnection", @@ -956 +907 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Resource": "arn:aws:athena:*:*:datacatalog/*", + "Resource": "*", @@ -965 +916 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId> - "Sid": "FederatedDataGetConnectionPermissions", + "Sid": "FederatedGetConnection", @@ -976 +927 @@ This is the default policy for the AmazonSageMakerProvisioning-<domainAccountId>