AWS sagemaker-unified-studio documentation change
Summary
Replaced inline IAM policy JSON with reference link to AWS Managed Policy documentation
Security assessment
Change removes explicit policy details in favor of external reference. Maintains security documentation but doesn't indicate any security vulnerability being addressed. The modification appears to be organizational rather than security-related.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md index 6579263fd..ef79b07d5 100644 --- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md +++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioBedrockFlowServiceRolePolicy.md @@ -24,155 +24 @@ This policy allows the Amazon Bedrock service to access specific resources tagge - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "BedrockPromptPermissions", - "Effect": "Allow", - "Action": "bedrock:GetPrompt", - "Resource": "arn:aws:bedrock:*:*:prompt/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "BedrockKnowledgeBasePermissions", - "Effect": "Allow", - "Action": "bedrock:Retrieve", - "Resource": "arn:aws:bedrock:*:*:knowledge-base/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "BedrockGuardrailPermissions", - "Effect": "Allow", - "Action": "bedrock:ApplyGuardrail", - "Resource": "arn:aws:bedrock:*:*:guardrail/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "AllowBedrockRetrieveAndGeneratePermissions", - "Effect": "Allow", - "Action": "bedrock:RetrieveAndGenerate", - "Resource": "*" - }, - { - "Sid": "AllowLambdaInvokeFunctionInProjectPermissions", - "Effect": "Allow", - "Action": "lambda:InvokeFunction", - "Resource": "arn:aws:lambda:*:*:function:amazon-bedrock*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "AllowBedrockApplicationInferenceProfileAccessInProjectPermissions", - "Effect": "Allow", - "Action": [ - "bedrock:GetInferenceProfile", - "bedrock:InvokeModel" - ], - "Resource": "arn:aws:bedrock:*:*:application-inference-profile/*", - "Condition": { - "StringEquals": { - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "AllowBedrockInvokeModelAccessWithInferenceProfilePermissions", - "Effect": "Allow", - "Action": "bedrock:InvokeModel", - "Resource": [ - "arn:aws:bedrock:*::foundation-model/*", - "arn:aws:bedrock:*:*:custom-model/*", - "arn:aws:bedrock:*:*:provisioned-model/*" - ], - "Condition": { - "Null": { - "bedrock:InferenceProfileArn": "false" - } - } - }, - { - "Sid": "BedrockInvokeAgentPermissions", - "Effect": "Allow", - "Action": "bedrock:InvokeAgent", - "Resource": "arn:aws:bedrock:*:*:agent-alias/*", - "Condition": { - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}", - "aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}" - } - } - }, - { - "Sid": "BedrockPromptKmsPermissions", - "Effect": "Allow", - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", - "Condition": { - "StringLike": { - "kms:ViaService": "bedrock.*.amazonaws.com", - "kms:EncryptionContext:aws:bedrock-prompts:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:prompt/*" - }, - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - }, - { - "Sid": "BedrockGuardrailKmsPermissions", - "Effect": "Allow", - "Action": "kms:Decrypt", - "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", - "Condition": { - "StringLike": { - "kms:ViaService": "bedrock.*.amazonaws.com" - }, - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - }, - "Null": { - "kms:EncryptionContext:aws:bedrock:guardrail-id": "false" - } - } - }, - { - "Sid": "BedrockAgentKmsPermissions", - "Effect": "Allow", - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}", - "Condition": { - "StringLike": { - "kms:ViaService": "bedrock.*.amazonaws.com", - "kms:EncryptionContext:aws:bedrock:arn": "arn:aws:bedrock:*:${aws:PrincipalAccount}:agent/*" - }, - "StringEquals": { - "aws:ResourceAccount": "${aws:PrincipalAccount}" - } - } - } - ] - } - +To view the permissions for this policy, see [SageMakerStudioBedrockFlowServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SageMakerStudioBedrockFlowServiceRolePolicy.html) in the _AWS Managed Policy Reference_.