AWS sagemaker-unified-studio documentation change
Summary
Replaced inline IAM policy JSON with reference link to AWS Managed Policy documentation
Security assessment
The change removes explicit policy details and replaces them with a reference link. While this impacts documentation clarity, there's no evidence it addresses a security vulnerability or weakness. The policy content itself appears unchanged in external reference.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioDomainExecutionRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioDomainExecutionRolePolicy.md index 887aac4bf..3ca603be1 100644 --- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioDomainExecutionRolePolicy.md +++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioDomainExecutionRolePolicy.md @@ -11,252 +11 @@ This role provides access to all Amazon SageMaker Unified Studio APIs that are r - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DataZonePermissions", - "Effect": "Allow", - "Action": [ - "datazone:AcceptPredictions", - "datazone:AcceptSubscriptionRequest", - "datazone:AddEntityOwner", - "datazone:AddPolicyGrant", - "datazone:CancelMetadataGenerationRun", - "datazone:CancelSubscription", - "datazone:CreateAsset", - "datazone:CreateAssetFilter", - "datazone:CreateAssetRevision", - "datazone:CreateAssetType", - "datazone:CreateConnection", - "datazone:CreateDataProduct", - "datazone:CreateDataProductRevision", - "datazone:CreateDataSource", - "datazone:CreateDomainUnit", - "datazone:CreateEnvironment", - "datazone:CreateEnvironmentProfile", - "datazone:CreateFormType", - "datazone:CreateGlossary", - "datazone:CreateGlossaryTerm", - "datazone:CreateListingChangeSet", - "datazone:CreateProject", - "datazone:CreateProjectMembership", - "datazone:CreateRule", - "datazone:CreateSubscriptionGrant", - "datazone:CreateSubscriptionRequest", - "datazone:DeleteAsset", - "datazone:DeleteAssetFilter", - "datazone:DeleteAssetType", - "datazone:DeleteConnection", - "datazone:DeleteDataProduct", - "datazone:DeleteDataSource", - "datazone:DeleteDomainUnit", - "datazone:DeleteEnvironment", - "datazone:DeleteEnvironmentProfile", - "datazone:DeleteFormType", - "datazone:DeleteGlossary", - "datazone:DeleteGlossaryTerm", - "datazone:DeleteListing", - "datazone:DeleteProject", - "datazone:DeleteProjectMembership", - "datazone:DeleteRule", - "datazone:DeleteSubscriptionGrant", - "datazone:DeleteSubscriptionRequest", - "datazone:DeleteSubscriptionTarget", - "datazone:DeleteTimeSeriesDataPoints", - "datazone:GetAsset", - "datazone:GetAssetFilter", - "datazone:GetAssetType", - "datazone:GetConnection", - "datazone:GetDataProduct", - "datazone:GetDataSource", - "datazone:GetDataSourceRun", - "datazone:GetDomain", - "datazone:GetDomainUnit", - "datazone:GetEnvironment", - "datazone:GetEnvironmentAction", - "datazone:GetEnvironmentActionLink", - "datazone:GetEnvironmentBlueprint", - "datazone:GetEnvironmentBlueprintConfiguration", - "datazone:GetEnvironmentCredentials", - "datazone:GetEnvironmentProfile", - "datazone:GetFormType", - "datazone:GetGlossary", - "datazone:GetGlossaryTerm", - "datazone:GetGroupProfile", - "datazone:GetLineageNode", - "datazone:GetListing", - "datazone:GetMetadataGenerationRun", - "datazone:GetProject", - "datazone:GetRule", - "datazone:GetSubscription", - "datazone:GetSubscriptionEligibility", - "datazone:GetSubscriptionGrant", - "datazone:GetSubscriptionRequestDetails", - "datazone:GetSubscriptionTarget", - "datazone:GetTimeSeriesDataPoint", - "datazone:GetUpdateEligibility", - "datazone:GetUserProfile", - "datazone:ListAccountEnvironments", - "datazone:ListAssetFilters", - "datazone:ListAssetRevisions", - "datazone:ListConnections", - "datazone:ListDataProductRevisions", - "datazone:ListDataSourceRunActivities", - "datazone:ListDataSourceRuns", - "datazone:ListDataSources", - "datazone:ListDomainUnitsForParent", - "datazone:ListEntityOwners", - "datazone:ListEnvironmentActions", - "datazone:ListEnvironmentBlueprintConfigurationSummaries", - "datazone:ListEnvironmentBlueprintConfigurations", - "datazone:ListEnvironmentBlueprints", - "datazone:ListEnvironmentProfiles", - "datazone:ListEnvironments", - "datazone:ListGroupsForUser", - "datazone:ListLineageNodeHistory", - "datazone:ListMetadataGenerationRuns", - "datazone:ListNotifications", - "datazone:ListPolicyGrants", - "datazone:ListProjectMemberships", - "datazone:ListProjects", - "datazone:ListRules", - "datazone:ListSubscriptionGrants", - "datazone:ListSubscriptionRequests", - "datazone:ListSubscriptionTargets", - "datazone:ListSubscriptions", - "datazone:ListTimeSeriesDataPoints", - "datazone:ListWarehouseMetadata", - "datazone:RejectPredictions", - "datazone:RejectSubscriptionRequest", - "datazone:RemoveEntityOwner", - "datazone:RemovePolicyGrant", - "datazone:RevokeSubscription", - "datazone:Search", - "datazone:SearchGroupProfiles", - "datazone:SearchListings", - "datazone:SearchRules", - "datazone:SearchTypes", - "datazone:SearchUserProfiles", - "datazone:StartDataSourceRun", - "datazone:StartMetadataGenerationRun", - "datazone:UpdateAssetFilter", - "datazone:UpdateConnection", - "datazone:UpdateDataSource", - "datazone:UpdateDomainUnit", - "datazone:UpdateEnvironment", - "datazone:UpdateEnvironmentDeploymentStatus", - "datazone:UpdateEnvironmentProfile", - "datazone:UpdateGlossary", - "datazone:UpdateGlossaryTerm", - "datazone:UpdateProject", - "datazone:UpdateRule", - "datazone:UpdateSubscriptionGrantStatus", - "datazone:UpdateSubscriptionRequest" - ], - "Resource": "*" - }, - { - "Sid": "RAMResourceShareStatement", - "Effect": "Allow", - "Action": [ - "ram:GetResourceShareAssociations", - "ram:GetResourceShares" - ], - "Resource": "*" - }, - { - "Sid": "AmazonQPermissionsStatement", - "Effect": "Allow", - "Action": [ - "q:StartConversation", - "q:SendMessage", - "q:ListConversations", - "q:GetConversation", - "q:PassRequest", - "glue:StartCompletion", - "glue:GetCompletion" - ], - "Resource": "*" - }, - { - "Sid": "AllowSetTrustedIdentity", - "Effect": "Allow", - "Action": [ - "sts:SetContext" - ], - "Resource": "arn:aws:sts::*:self" - }, - { - "Sid": "SSMGetParameterStatement", - "Effect": "Allow", - "Action": [ - "ssm:GetParameter" - ], - "Resource": [ - "arn:aws:ssm:*:*:parameter/amazon/datazone/q/${aws:PrincipalTag/datazone-domainId}*", - "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/${aws:PrincipalTag/datazone-domainId}/*" - ], - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "GetCodeConnectionsPermissionsStatement",