AWS bedrock documentation change
Summary
Replaced inline IAM policy JSON examples with links to managed policy documentation and removed detailed policy configurations
Security assessment
The changes simplify documentation by referencing managed policies rather than embedding full JSON. No security vulnerabilities or new security features are introduced - this is primarily documentation cleanup.
Diff
diff --git a/bedrock/latest/userguide/security-iam-awsmanpol.md b/bedrock/latest/userguide/security-iam-awsmanpol.md index 7fc6a5570..0a36cc82c 100644 --- a//bedrock/latest/userguide/security-iam-awsmanpol.md +++ b//bedrock/latest/userguide/security-iam-awsmanpol.md @@ -32,3 +32 @@ Additionally, AWS supports managed policies for job functions that span multiple -You can attach the `AmazonBedrockFullAccess` policy to your IAM identities. - -This policy grants administrative permissions that allow the user permission to create, read, update, and delete Amazon Bedrock resources. +You can attach the [AmazonBedrockFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBedrockFullAccess.html) policy to your IAM identities to grant administrative permissions that allow the user permission to create, read, update, and delete Amazon Bedrock resources. @@ -57,197 +54,0 @@ This policy includes the following permissions: - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "BedrockAll", - "Effect": "Allow", - "Action": [ - "bedrock:*" - ], - "Resource": "*" - }, - { - "Sid": "DescribeKey", - "Effect": "Allow", - "Action": [ - "kms:DescribeKey" - ], - "Resource": "arn:*:kms:*:::*" - }, - { - "Sid": "APIsWithAllResourceAccess", - "Effect": "Allow", - "Action": [ - "iam:ListRoles", - "ec2:DescribeVpcs", - "ec2:DescribeSubnets", - "ec2:DescribeSecurityGroups" - ], - "Resource": "*" - }, - { - "Sid": "MarketplaceModelEndpointMutatingAPIs", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateEndpoint", - "sagemaker:CreateEndpointConfig", - "sagemaker:CreateModel", - "sagemaker:DeleteEndpoint", - "sagemaker:UpdateEndpoint" - ], - "Resource": [ - "arn:aws:sagemaker:*:*:endpoint/*", - "arn:aws:sagemaker:*:*:endpoint-config/*", - "arn:aws:sagemaker:*:*:model/*" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaLast": "bedrock.amazonaws.com", - "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible" - } - } - }, - { - "Sid": "MarketplaceModelEndpointAddTagsOperations", - "Effect": "Allow", - "Action": [ - "sagemaker:AddTags" - ], - "Resource": [ - "arn:aws:sagemaker:*:*:endpoint/*", - "arn:aws:sagemaker:*:*:endpoint-config/*", - "arn:aws:sagemaker:*:*:model/*" - ], - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "sagemaker-sdk:bedrock", - "bedrock:marketplace-registration-status", - "sagemaker-studio:hub-content-arn" - ] - }, - "StringLike": { - "aws:RequestTag/sagemaker-sdk:bedrock": "compatible", - "aws:RequestTag/bedrock:marketplace-registration-status": "registered", - "aws:RequestTag/sagemaker-studio:hub-content-arn": "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*" - } - } - }, - { - "Sid": "MarketplaceModelEndpointDeleteTagsOperations", - "Effect": "Allow", - "Action": [ - "sagemaker:DeleteTags" - ], - "Resource": [ - "arn:aws:sagemaker:*:*:endpoint/*", - "arn:aws:sagemaker:*:*:endpoint-config/*", - "arn:aws:sagemaker:*:*:model/*" - ], - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "sagemaker-sdk:bedrock", - "bedrock:marketplace-registration-status", - "sagemaker-studio:hub-content-arn" - ] - }, - "StringLike": { - "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible", - "aws:ResourceTag/bedrock:marketplace-registration-status": "registered", - "aws:ResourceTag/sagemaker-studio:hub-content-arn": "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*" - } - } - }, - { - "Sid": "MarketplaceModelEndpointNonMutatingAPIs", - "Effect": "Allow", - "Action": [ - "sagemaker:DescribeEndpoint", - "sagemaker:DescribeEndpointConfig", - "sagemaker:DescribeModel", - "sagemaker:ListTags" - ], - "Resource": [ - "arn:aws:sagemaker:*:*:endpoint/*", - "arn:aws:sagemaker:*:*:endpoint-config/*", - "arn:aws:sagemaker:*:*:model/*" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaLast": "bedrock.amazonaws.com" - } - } - }, - { - "Sid": "MarketplaceModelEndpointInvokingOperations", - "Effect": "Allow", - "Action": [ - "sagemaker:InvokeEndpoint", - "sagemaker:InvokeEndpointWithResponseStream" - ], - "Resource": [ - "arn:aws:sagemaker:*:*:endpoint/*" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaLast": "bedrock.amazonaws.com", - "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible" - } - } - }, - { - "Sid": "DiscoveringMarketplaceModel", - "Effect": "Allow", - "Action": [ - "sagemaker:DescribeHubContent" - ], - "Resource": [ - "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*", - "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" - ] - }, - { - "Sid": "AllowMarketplaceModelsListing", - "Effect": "Allow", - "Action": [ - "sagemaker:ListHubContents" - ], - "Resource": "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" - }, - { - "Sid": "PassRoleToSageMaker", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": [ - "arn:aws:iam::*:role/*SageMaker*ForBedrock*" - ], - "Condition": { - "StringEquals": { - "iam:PassedToService": [ - "sagemaker.amazonaws.com", - "bedrock.amazonaws.com" - ] - } - } - }, - { - "Sid": "PassRoleToBedrock", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": "arn:aws:iam::*:role/*AmazonBedrock*", - "Condition": { - "StringEquals": { - "iam:PassedToService": [ - "bedrock.amazonaws.com"