AWS datazone documentation change
Summary
Replaced detailed inline IAM policy JSON with a reference to AWS Managed Policy documentation
Security assessment
The change removes explicit policy details and directs users to official AWS managed policy documentation. While this improves maintainability and aligns with security best practices of using managed policies, there's no evidence of addressing a specific security vulnerability. The change primarily updates documentation format rather than modifying security controls.
Diff
diff --git a/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary.md b/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary.md index 3d5d4bd23..5fa8f1d18 100644 --- a//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary.md +++ b//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary.md @@ -19,1191 +19 @@ Amazon DataZone applies the `AmazonDataZoneSageMakerEnvironmentRolePermissionsBo - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowAllNonAdminSageMakerActions", - "Effect": "Allow", - "Action": [ - "sagemaker:*", - "sagemaker-geospatial:*" - ], - "NotResource": [ - "arn:aws:sagemaker:*:*:domain/*", - "arn:aws:sagemaker:*:*:user-profile/*", - "arn:aws:sagemaker:*:*:app/*", - "arn:aws:sagemaker:*:*:space/*", - "arn:aws:sagemaker:*:*:flow-definition/*" - ] - }, - { - "Sid": "AllowSageMakerProfileManagement", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateUserProfile", - "sagemaker:DescribeUserProfile", - "sagemaker:UpdateUserProfile", - "sagemaker:CreatePresignedDomainUrl" - ], - "Resource": "arn:aws:sagemaker:*:*:*/*" - }, - { - "Sid": "AllowLakeFormation", - "Effect": "Allow", - "Action": [ - "lakeformation:GetDataAccess" - ], - "Resource": "*" - }, - { - "Sid": "AllowAddTagsForDomainResources", - "Effect": "Allow", - "Action": [ - "sagemaker:AddTags" - ], - "Resource": [ - "arn:aws:sagemaker:*:*:app/*", - "arn:aws:sagemaker:*:*:space/*", - "arn:aws:sagemaker:*:*:user-profile/*" - ], - "Condition": { - "StringEquals": { - "sagemaker:TaggingAction": [ - "CreateApp", - "CreateSpace", - "CreateUserProfile" - ] - } - } - }, - { - "Sid": "AllowStudioActions", - "Effect": "Allow", - "Action": [ - "sagemaker:CreatePresignedDomainUrl", - "sagemaker:DescribeApp", - "sagemaker:DescribeDomain", - "sagemaker:DescribeSpace", - "sagemaker:DescribeUserProfile", - "sagemaker:ListApps", - "sagemaker:ListDomains", - "sagemaker:ListSpaces", - "sagemaker:ListUserProfiles" - ], - "Resource": "*" - }, - { - "Sid": "AllowAppActionsForUserProfile", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateApp", - "sagemaker:DeleteApp" - ], - "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*", - "Condition": { - "Null": { - "sagemaker:OwnerUserProfileArn": "true" - } - } - }, - { - "Sid": "AllowAppActionsForSharedSpaces", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateApp", - "sagemaker:DeleteApp" - ], - "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", - "Condition": { - "StringEquals": { - "sagemaker:SpaceSharingType": [ - "Shared" - ] - } - } - }, - { - "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateSpace", - "sagemaker:DeleteSpace", - "sagemaker:UpdateSpace" - ], - "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", - "Condition": { - "Null": { - "sagemaker:OwnerUserProfileArn": "true" - } - } - }, - { - "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateSpace", - "sagemaker:DeleteSpace", - "sagemaker:UpdateSpace" - ], - "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*", - "Condition": { - "ArnLike": { - "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" - }, - "StringEquals": { - "sagemaker:SpaceSharingType": [ - "Private", - "Shared" - ] - } - } - }, - { - "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateApp", - "sagemaker:DeleteApp" - ], - "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*", - "Condition": { - "ArnLike": { - "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}" - }, - "StringEquals": { - "sagemaker:SpaceSharingType": [ - "Private" - ] - } - } - }, - { - "Sid": "AllowFlowDefinitionActions", - "Effect": "Allow", - "Action": "sagemaker:*", - "Resource": [ - "arn:aws:sagemaker:*:*:flow-definition/*" - ], - "Condition": { - "StringEqualsIfExists": { - "sagemaker:WorkteamType": [ - "private-crowd", - "vendor-crowd" - ] - } - } - }, - { - "Sid": "AllowAWSServiceActions", - "Effect": "Allow", - "Action": [ - "sqlworkbench:*", - "datazone:*", - "application-autoscaling:DeleteScalingPolicy", - "application-autoscaling:DeleteScheduledAction", - "application-autoscaling:DeregisterScalableTarget", - "application-autoscaling:DescribeScalableTargets", - "application-autoscaling:DescribeScalingActivities", - "application-autoscaling:DescribeScalingPolicies", - "application-autoscaling:DescribeScheduledActions", - "application-autoscaling:PutScalingPolicy", - "application-autoscaling:PutScheduledAction", - "application-autoscaling:RegisterScalableTarget", - "aws-marketplace:ViewSubscriptions", - "cloudformation:GetTemplateSummary", - "cloudwatch:DeleteAlarms",