AWS sagemaker-unified-studio documentation change
Summary
Replaced inline IAM policy JSON with reference to AWS Managed Policy documentation
Security assessment
Similar to the first file, this change removes granular policy details in favor of external references. The modification appears focused on documentation maintenance rather than addressing specific security weaknesses. The policy content remains security-related, but the change itself doesn't introduce new security features or resolve identified vulnerabilities.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockChatAgentUserRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockChatAgentUserRolePolicy.md index 162afbde2..90f5b523d 100644 --- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockChatAgentUserRolePolicy.md +++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockChatAgentUserRolePolicy.md @@ -24,166 +24 @@ This policy allows users to access individually shared Amazon Bedrock IDE chat a - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "BedrockGetAgentAliasPermissions", - "Effect": "Allow", - "Action": "bedrock:GetAgentAlias", - "Resource": "arn:aws:bedrock:*:*:agent-alias/${aws:PrincipalTag/AgentId}/${aws:PrincipalTag/AgentAliasId}", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "BedrockInvokeAgentPermissions", - "Effect": "Allow", - "Action": "bedrock:InvokeAgent", - "Resource": "arn:aws:bedrock:*:*:agent-alias/${aws:PrincipalTag/AgentId}/${aws:PrincipalTag/AgentAliasId}", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "BedrockGetAndListAgentMetadataPermissions", - "Effect": "Allow", - "Action": [ - "bedrock:GetAgent", - "bedrock:GetAgentActionGroup", - "bedrock:GetAgentKnowledgeBase", - "bedrock:GetAgentVersion", - "bedrock:ListAgentActionGroups", - "bedrock:ListAgentAliases", - "bedrock:ListAgentKnowledgeBases", - "bedrock:ListAgentVersions" - ], - "Resource": "arn:aws:bedrock:*:*:agent/${aws:PrincipalTag/AgentId}", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "S3ListAppDefinitionPermissions", - "Effect": "Allow", - "Action": "s3:ListBucket", - "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", - "Condition": { - "StringEquals": { - "s3:prefix": "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AppDefinitionPath}", - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, - "StringNotEquals": { - "aws:PrincipalTag/DomainBucketName": "", - "aws:PrincipalTag/AmazonDataZoneDomain": "", - "aws:PrincipalTag/AmazonDataZoneProject": "", - "aws:PrincipalTag/AppDefinitionPath": "" - } - } - }, - { - "Sid": "S3GetAppDefinitionPermissions", - "Effect": "Allow", - "Action": [ - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AppDefinitionPath}", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, - "StringNotEquals": { - "aws:PrincipalTag/DomainBucketName": "", - "aws:PrincipalTag/AmazonDataZoneDomain": "", - "aws:PrincipalTag/AmazonDataZoneProject": "", - "aws:PrincipalTag/AppDefinitionPath": "" - } - } - }, - { - "Sid": "S3ListDataSourcePermissions", - "Effect": "Allow", - "Action": "s3:ListBucket", - "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", - "Condition": { - "StringEquals": { - "s3:prefix": "${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/DataSourcePath}", - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, - "StringNotEquals": { - "aws:PrincipalTag/DomainBucketName": "", - "aws:PrincipalTag/AmazonDataZoneDomain": "", - "aws:PrincipalTag/AmazonDataZoneProject": "", - "aws:PrincipalTag/DataSourcePath": "" - } - } - }, - { - "Sid": "S3GetDataSourcePermissions", - "Effect": "Allow", - "Action": [ - "s3:GetObject", - "s3:GetObjectVersion" - ], - "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/DataSourcePath}", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, - "StringNotEquals": { - "aws:PrincipalTag/DomainBucketName": "", - "aws:PrincipalTag/AmazonDataZoneDomain": "", - "aws:PrincipalTag/AmazonDataZoneProject": "", - "aws:PrincipalTag/DataSourcePath": "" - } - } - }, - { - "Sid": "BedrockAgentKmsPermissions", - "Effect": "Allow", - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", - "Condition": { - "StringLike": { - "kms:ViaService": "bedrock.*.amazonaws.com", - "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:agent/${aws:PrincipalTag/AgentId}" - }, - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "S3KmsPermissions", - "Effect": "Allow", - "Action": "kms:Decrypt", - "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", - "Condition": { - "StringLike": { - "kms:ViaService": "s3.*.amazonaws.com" - }, - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, - "ArnLike": { - "kms:EncryptionContext:aws:s3:arn": [ - "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}", - "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/*" - ] - } - } - } - ] - } - +To view the permissions for this policy, see [SageMakerStudioBedrockChatAgentUserRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SageMakerStudioBedrockChatAgentUserRolePolicy.html) in the _AWS Managed Policy Reference_.