AWS sagemaker medium security documentation change

Service: sagemaker · 2025-08-16 · Security-related medium

File: sagemaker/latest/dg/security_iam_id-based-policy-examples.md

Summary

Removed 'aws-marketplace:DescribeListings' and 'groundtruthlabeling:RunFilterOrSampleManifestJob' permissions from IAM policy examples. Removed 's3:SelectObjectContent' permission from S3 actions. Fixed typo in 'sagemaker:CreateFlowDefiniton' action. Updated KMS key ARN region from us-west-2 to us-east-1 in example policy.

Security assessment

Removing unnecessary IAM permissions (aws-marketplace:DescribeListings, groundtruthlabeling:RunFilterOrSampleManifestJob, s3:SelectObjectContent) reduces attack surface and follows least privilege principle. This directly addresses potential security risks from over-permissive policies. The KMS key region change appears to be an example update rather than a security fix.

Diff

diff --git a/sagemaker/latest/dg/security_iam_id-based-policy-examples.md b/sagemaker/latest/dg/security_iam_id-based-policy-examples.md
index f3c1a16e6..38ae713c4 100644
--- a//sagemaker/latest/dg/security_iam_id-based-policy-examples.md
+++ b//sagemaker/latest/dg/security_iam_id-based-policy-examples.md
@@ -208 +207,0 @@ JSON
-                    "aws-marketplace:DescribeListings",
@@ -234 +232,0 @@ JSON
-                    "groundtruthlabeling:RunFilterOrSampleManifestJob",
@@ -241,2 +239 @@ JSON
-                    "s3:PutObject",
-                    "s3:SelectObjectContent"
+                    "s3:PutObject"
@@ -989 +986 @@ JSON
-                    "sagemaker:CreateFlowDefiniton"
+                    "sagemaker:CreateFlowDefinition"
@@ -994 +991 @@ JSON
-                        "sagemaker:VolumeKmsKey": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
+                        "sagemaker:VolumeKmsKey": "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"