AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2025-07-18 · Documentation low

File: sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md

Summary

Removed detailed IAM policy JSON content and replaced with reference to AWS Managed Policy documentation

Security assessment

The change removes implementation details of an IAM policy but does not indicate any specific security vulnerability being addressed. This appears to be a documentation simplification/centralization effort rather than a security-related update. The policy itself contains security-related permissions, but the documentation change does not add new security features or directly reference security issues.

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md
index d6e81da58..2798f4689 100644
--- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md
+++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md
@@ -13,947 +13 @@ An administrator can disable certain permissions in this policy by tagging the r
-    
-    {
-    	"Version": "2012-10-17",
-    	"Statement": [
-    		{
-    			"Sid": "AllowManageSageMakerEniOnVpc",
-    			"Effect": "Allow",
-    			"Action": [
-    				"ec2:CreateVpcEndpoint"
-    			],
-    			"Resource": [
-    				"arn:aws:ec2:*:*:network-interface/*",
-    				"arn:aws:ec2:*:*:subnet/*",
-    				"arn:aws:ec2:*:*:route-table/*",
-    				"arn:aws:ec2:*:*:security-group/*"
-    			],
-    			"Condition": {
-    				"StringEquals": {
-    					"aws:CalledViaLast": [
-    						"sagemaker.amazonaws.com",
-    						"airflow.amazonaws.com"
-    					]
-    				},
-    				"ArnLike": {
-    					"ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "AllowManageSageMakerTrainingEniOnVpc",
-    			"Effect": "Allow",
-    			"Action": [
-    				"ec2:CreateNetworkInterface",
-    				"ec2:DeleteNetworkInterface",
-    				"ec2:AttachNetworkInterface",
-    				"ec2:CreateNetworkInterfacePermission",
-    				"ec2:DeleteNetworkInterfacePermission"
-    			],
-    			"Resource": [
-    				"arn:aws:ec2:*:*:network-interface/*",
-    				"arn:aws:ec2:*:*:subnet/*",
-    				"arn:aws:ec2:*:*:route-table/*",
-    				"arn:aws:ec2:*:*:security-group/*"
-    			],
-    			"Condition": {
-    				"ArnLike": {
-    					"ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "AllowManageSageMakerEni",
-    			"Effect": "Allow",
-    			"Action": [
-    				"ec2:CreateNetworkInterface",
-    				"ec2:AttachNetworkInterface"
-    			],
-    			"Resource": [
-    				"arn:aws:ec2:*:*:network-interface/*",
-    				"arn:aws:ec2:*:*:instance/*"
-    			],
-    			"Condition": {
-    				"StringEqualsIfExists": {
-    					"aws:CalledViaLast": "sagemaker.amazonaws.com",
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "AllowSageMakerCreateVpcEndpointOnVpcId",
-    			"Effect": "Allow",
-    			"Action": [
-    				"ec2:CreateVpcEndpoint"
-    			],
-    			"Resource": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}",
-    			"Condition": {
-    				"StringEquals": {
-    					"ec2:VpcID": "${aws:PrincipalTag/VpcId}"
-    				},
-    				"StringEqualsIfExists": {
-    					"aws:CalledViaLast": "sagemaker.amazonaws.com",
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "AllowSageMakerCreateVpcEndpoint",
-    			"Effect": "Allow",
-    			"Action": [
-    				"ec2:CreateVpcEndpoint"
-    			],
-    			"Resource": [
-    				"arn:aws:ec2:*:*:vpc-endpoint/*"
-    			],
-    			"Condition": {
-    				"StringEqualsIfExists": {
-    					"aws:CalledViaLast": "sagemaker.amazonaws.com",
-    					"aws:ResourceAccount": "${aws:PrincipalAccount}"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "AllowSageMakerDescribeVPCResources",
-    			"Effect": "Allow",
-    			"Action": [
-    				"ec2:DescribeVpcEndpoints",
-    				"ec2:DescribeSubnets",
-    				"ec2:DescribeRouteTables",
-    				"ec2:DescribeSecurityGroups",
-    				"glue:ListSessions",
-    				"ec2:DescribeVpcs",
-    				"ec2:DescribeNetworkInterfaces",
-    				"ec2:DescribeDhcpOptions"
-    			],
-    			"Resource": "*"
-    		},
-    		{
-    			"Sid": "AllowSageMakerLogAccess",
-    			"Effect": "Allow",
-    			"Action": [
-    				"logs:DescribeLogStreams",
-    				"logs:GetLogEvents"
-    			],
-    			"Resource": "arn:aws:logs:*:*:log-group:/aws/sagemaker/*"
-    		},
-    		{
-    			"Sid": "SageMakerMlflowPermission",
-    			"Effect": "Allow",
-    			"Action": [
-    				"sagemaker:UpdateMlflowTrackingServer",
-    				"sagemaker:StartMlflowTrackingServer",
-    				"sagemaker:StopMlflowTrackingServer",
-    				"sagemaker:DescribeMlflowTrackingServer",
-    				"sagemaker:CreatePresignedMlflowTrackingServerUrl",
-    				"sagemaker-mlflow:AccessUI",
-    				"sagemaker-mlflow:CreateExperiment",
-    				"sagemaker-mlflow:SearchExperiments",
-    				"sagemaker-mlflow:GetExperiment",
-    				"sagemaker-mlflow:GetExperimentByName",
-    				"sagemaker-mlflow:DeleteExperiment",
-    				"sagemaker-mlflow:RestoreExperiment",
-    				"sagemaker-mlflow:UpdateExperiment",
-    				"sagemaker-mlflow:CreateRun",
-    				"sagemaker-mlflow:DeleteRun",
-    				"sagemaker-mlflow:RestoreRun",
-    				"sagemaker-mlflow:GetRun",
-    				"sagemaker-mlflow:LogMetric",
-    				"sagemaker-mlflow:LogBatch",
-    				"sagemaker-mlflow:LogModel",
-    				"sagemaker-mlflow:LogInputs",
-    				"sagemaker-mlflow:SetExperimentTag",
-    				"sagemaker-mlflow:SetTag",
-    				"sagemaker-mlflow:DeleteTag",
-    				"sagemaker-mlflow:LogParam",
-    				"sagemaker-mlflow:GetMetricHistory",
-    				"sagemaker-mlflow:SearchRuns",
-    				"sagemaker-mlflow:ListArtifacts",
-    				"sagemaker-mlflow:UpdateRun",
-    				"sagemaker-mlflow:CreateRegisteredModel",
-    				"sagemaker-mlflow:GetRegisteredModel",
-    				"sagemaker-mlflow:RenameRegisteredModel",
-    				"sagemaker-mlflow:UpdateRegisteredModel",
-    				"sagemaker-mlflow:DeleteRegisteredModel",
-    				"sagemaker-mlflow:GetLatestModelVersions",
-    				"sagemaker-mlflow:CreateModelVersion",
-    				"sagemaker-mlflow:GetModelVersion",
-    				"sagemaker-mlflow:UpdateModelVersion",
-    				"sagemaker-mlflow:DeleteModelVersion",
-    				"sagemaker-mlflow:SearchModelVersions",
-    				"sagemaker-mlflow:GetDownloadURIForModelVersionArtifacts",
-    				"sagemaker-mlflow:TransitionModelVersionStage",
-    				"sagemaker-mlflow:SearchRegisteredModels",
-    				"sagemaker-mlflow:SetRegisteredModelTag",
-    				"sagemaker-mlflow:DeleteRegisteredModelTag",
-    				"sagemaker-mlflow:DeleteModelVersionTag",
-    				"sagemaker-mlflow:DeleteRegisteredModelAlias",
-    				"sagemaker-mlflow:SetRegisteredModelAlias",
-    				"sagemaker-mlflow:GetModelVersionByAlias"
-    			],
-    			"Resource": "arn:aws:sagemaker:*:*:mlflow-tracking-server/*",
-    			"Condition": {
-    				"StringEquals": {
-    					"aws:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}"
-    				}
-    			}
-    		},
-    		{
-    			"Sid": "SageMakerBYOFSPermissions",
-    			"Effect": "Allow",
-    			"Action": [
-    				"elasticfilesystem:DescribeMountTargets"
-    			],
-    			"Resource": "*"
-    		},
-    		{