AWS datazone documentation change
Summary
Replaced inline IAM policy JSON with a reference link to AWS Managed Policy documentation
Security assessment
Change removes detailed policy JSON but does not indicate a security vulnerability fix. This appears to be a documentation restructuring rather than addressing a specific security issue.
Diff
diff --git a/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerProvisioningRolePolicy.md b/datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerProvisioningRolePolicy.md index 3174bd809..53a15c18c 100644 --- a//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerProvisioningRolePolicy.md +++ b//datazone/latest/userguide/security-iam-awsmanpol-AmazonDataZoneSageMakerProvisioningRolePolicy.md @@ -9,200 +9 @@ The AmazonDataZoneSageMakerProvisioningRolePolicy policy grants Amazon DataZone - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "CreateSageMakerStudio", - "Effect": "Allow", - "Action": [ - "sagemaker:CreateDomain" - ], - "Resource": [ - "*" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - }, - "ForAnyValue:StringEquals": { - "aws:TagKeys": [ - "AmazonDataZoneEnvironment" - ] - }, - "Null": { - "aws:TagKeys": "false", - "aws:ResourceTag/AmazonDataZoneEnvironment": "false", - "aws:RequestTag/AmazonDataZoneEnvironment": "false" - } - } - }, - { - "Sid": "DeleteSageMakerStudio", - "Effect": "Allow", - "Action": [ - "sagemaker:DeleteDomain" - ], - "Resource": [ - "*" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - }, - "ForAnyValue:StringLike": { - "aws:TagKeys": [ - "AmazonDataZoneEnvironment" - ] - }, - "Null": { - "aws:TagKeys": "false", - "aws:ResourceTag/AmazonDataZoneEnvironment": "false" - } - } - }, - { - "Sid": "AmazonDataZoneEnvironmentSageMakerDescribePermissions", - "Effect": "Allow", - "Action": [ - "sagemaker:DescribeDomain" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "IamPassRolePermissions", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": [ - "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" - ], - "Condition": { - "StringEquals": { - "iam:PassedToService": [ - "glue.amazonaws.com", - "lakeformation.amazonaws.com", - "sagemaker.amazonaws.com" - ], - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZonePermissionsToCreateEnvironmentRole", - "Effect": "Allow", - "Action": [ - "iam:CreateRole", - "iam:DetachRolePolicy", - "iam:DeleteRolePolicy", - "iam:AttachRolePolicy", - "iam:PutRolePolicy" - ], - "Resource": [ - "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ], - "iam:PermissionsBoundary": "arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary" - } - } - }, - { - "Sid": "AmazonDataZonePermissionsToManageEnvironmentRole", - "Effect": "Allow", - "Action": [ - "iam:GetRole", - "iam:GetRolePolicy", - "iam:DeleteRole" - ], - "Resource": [ - "arn:aws:iam::*:role/sm-provisioning/datazone_usr*" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZonePermissionsToCreateSageMakerServiceRole", - "Effect": "Allow", - "Action": [ - "iam:CreateServiceLinkedRole" - ], - "Resource": [ - "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - } - } - }, - { - "Sid": "AmazonDataZoneEnvironmentParameterValidation", - "Effect": "Allow", - "Action": [ - "ec2:DescribeVpcs", - "ec2:DescribeSubnets", - "sagemaker:ListDomains" - ], - "Resource": "*" - }, - { - "Sid": "AmazonDataZoneEnvironmentKMSKeyValidation", - "Effect": "Allow", - "Action": [ - "kms:DescribeKey" - ], - "Resource": "arn:aws:kms:*:*:key/*", - "Condition": { - "Null": { - "aws:ResourceTag/AmazonDataZoneEnvironment": "false" - } - } - }, - { - "Sid": "AmazonDataZoneEnvironmentGluePermissions", - "Effect": "Allow", - "Action": [ - "glue:CreateConnection", - "glue:DeleteConnection", - "glue:GetConnection" - ], - "Resource": [ - "arn:aws:glue:*:*:connection/dz-sm-athena-glue-connection-*", - "arn:aws:glue:*:*:connection/dz-sm-redshift-cluster-connection-*", - "arn:aws:glue:*:*:connection/dz-sm-redshift-serverless-connection-*", - "arn:aws:glue:*:*:catalog" - ], - "Condition": { - "StringEquals": { - "aws:CalledViaFirst": [ - "cloudformation.amazonaws.com" - ] - }