AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2025-07-18 · Documentation low

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-AmazonDataZoneBedrockModelConsumptionPolicy.md

Summary

Replaced inline IAM policy details with a reference to AWS Managed Policy documentation.

Security assessment

This change documents security-related IAM permissions for Amazon Bedrock model consumption but does not indicate remediation of a specific security issue. The policy relates to access control for AI model usage.

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-AmazonDataZoneBedrockModelConsumptionPolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-AmazonDataZoneBedrockModelConsumptionPolicy.md
index 0a2ad7760..b7e2ca64d 100644
--- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-AmazonDataZoneBedrockModelConsumptionPolicy.md
+++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-AmazonDataZoneBedrockModelConsumptionPolicy.md
@@ -9,101 +9 @@ Provides permissions to consume Amazon Bedrock models, including invoking Amazon
-    
-    {
-    	"Version": "2012-10-17",
-    	"Statement": [
-    		{
-    			"Sid": "InvokeDomainInferenceProfiles",
-    			"Effect": "Allow",
-    			"Action": [
-    				"bedrock:InvokeModel",
-    				"bedrock:InvokeModelWithResponseStream"
-    			],
-    			"Resource": "arn:aws:bedrock:*:*:application-inference-profile/*",
-    			"Condition": {
-    				"StringEquals": {
-    					"aws:ResourceTag/AmazonDataZoneDomain": "${datazone:domainId}",
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}"
-    				},
-    				"Null": {
-    					"aws:ResourceTag/AmazonDataZoneProject": "true"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "ListFoundationModels",
-    			"Effect": "Allow",
-    			"Action": [
-    				"bedrock:ListFoundationModels"
-    			],
-    			"Resource": "*"
-    		},
-    		{
-    			"Sid": "BedrockCreateSessionWithTagsPermissions",
-    			"Effect": "Allow",
-    			"Action": [
-    				"bedrock:CreateSession",
-    				"bedrock:TagResource"
-    			],
-    			"Resource": "arn:aws:bedrock:*:*:session/*",
-    			"Condition": {
-    				"StringEquals": {
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}",
-    					"aws:RequestTag/AmazonDataZoneUser": "${datazone:userId}",
-    					"aws:ResourceTag/AmazonDataZoneUser": "${datazone:userId}",
-    					"aws:RequestTag/AmazonDataZoneDomain": "${datazone:domainId}",
-    					"aws:ResourceTag/AmazonDataZoneDomain": "${datazone:domainId}"
-    				},
-    				"StringNotEquals": {
-    					"aws:RequestTag/AmazonDataZoneUser": "",
-    					"aws:ResourceTag/AmazonDataZoneUser": "",
-    					"aws:RequestTag/AmazonDataZoneDomain": "",
-    					"aws:ResourceTag/AmazonDataZoneDomain": ""
-    				},
-    				"ForAllValues:StringLike": {
-    					"aws:TagKeys": "AmazonDataZone*"
-    				},
-    				"Null": {
-    					"aws:RequestTag/AmazonDataZoneProject": "true",
-    					"aws:ResourceTag/AmazonDataZoneProject": "true"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "BedrockSessionPermissions",
-    			"Effect": "Allow",
-    			"Action": [
-    				"bedrock:GetSession",
-    				"bedrock:UpdateSession",
-    				"bedrock:DeleteSession",
-    				"bedrock:EndSession",
-    				"bedrock:CreateInvocation",
-    				"bedrock:ListInvocations",
-    				"bedrock:PutInvocationStep",
-    				"bedrock:GetInvocationStep",
-    				"bedrock:ListInvocationSteps",
-    				"bedrock:ListTagsForResource"
-    			],
-    			"Resource": "arn:aws:bedrock:*:*:session/*",
-    			"Condition": {
-    				"StringEquals": {
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}",
-    					"aws:ResourceTag/AmazonDataZoneUser": "${datazone:userId}",
-    					"aws:ResourceTag/AmazonDataZoneDomain": "${datazone:domainId}"
-    				},
-    				"StringNotEquals": {
-    					"aws:ResourceTag/AmazonDataZoneUser": "",
-    					"aws:ResourceTag/AmazonDataZoneDomain": ""
-    				},
-    				"Null": {
-    					"aws:ResourceTag/AmazonDataZoneProject": "true"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "BedrockListSessionsPermissions",
-    			"Effect": "Allow",
-    			"Action": "bedrock:ListSessions",
-    			"Resource": "*"
-    		}
-    	]
-    }
-    		
+To view the permissions for this policy, see [AmazonDataZoneBedrockModelConsumptionPolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonDataZoneBedrockModelConsumptionPolicy.html) in the _AWS Managed Policy Reference_.