AWS sagemaker-unified-studio medium security documentation change
Summary
Standardized account IDs to 111122223333 and fixed KMS ARN regions to us-east-1
Security assessment
Correcting KMS ARN regions ensures policies reference valid resources, preventing potential misconfigurations that could lead to unintended access.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md b/sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md index 21d0bbb61..1a8979f98 100644 --- a//sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md +++ b//sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md @@ -50 +50 @@ JSON - "arn:aws:iam::${ACCOUNT_ID}:role/service-role/AmazonSageMakerDomainExecution" + "arn:aws:iam::111122223333:role/service-role/AmazonSageMakerDomainExecution" @@ -69 +69 @@ JSON - "AWS": "arn:aws:iam::${ACCOUNT_ID}:role/service-role/AmazonSageMakerProvisioning-${ACCOUNT_ID}" + "AWS": "arn:aws:iam::111122223333:role/service-role/AmazonSageMakerProvisioning-111122223333" @@ -84 +84 @@ JSON - "AWS": "arn:aws:iam::${ACCOUNT_ID}:root" + "AWS": "arn:aws:iam::111122223333:root" @@ -98 +98 @@ JSON - "AWS": "arn:aws:iam::${ACCOUNT_ID}:root" + "AWS": "arn:aws:iam::111122223333:root" @@ -118 +118 @@ JSON - "AWS": "arn:aws:iam::${ACCOUNT_ID}:root" + "AWS": "arn:aws:iam::111122223333:root" @@ -142 +142 @@ JSON - "AWS": "arn:aws:iam::${ACCOUNT_ID}:root" + "AWS": "arn:aws:iam::111122223333:root" @@ -239 +238 @@ JSON - "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${DOMAIN_KEY_ID}" + "Resource": "arn:aws:kms:us-east-1:${KEY_ACCOUNT_ID}:key/${DOMAIN_KEY_ID}" @@ -249 +248 @@ JSON - "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${DOMAIN_KEY_ID}", + "Resource": "arn:aws:kms:us-east-1:${KEY_ACCOUNT_ID}:key/${DOMAIN_KEY_ID}", @@ -276 +274 @@ JSON - "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}" + "Resource": "arn:aws:kms:us-east-1:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}" @@ -285 +283 @@ JSON - "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}", + "Resource": "arn:aws:kms:us-east-1:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}", @@ -300 +298 @@ JSON - "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}", + "Resource": "arn:aws:kms:us-east-1:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}", @@ -318 +316 @@ JSON - "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}", + "Resource": "arn:aws:kms:us-east-1:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}", @@ -336 +334 @@ JSON - "Resource": "arn:aws:kms:${KEY_REGION}:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}", + "Resource": "arn:aws:kms:us-east-1:${KEY_ACCOUNT_ID}:key/${TOOLING_BLUEPRINT_KEY_ID}",