AWS sagemaker-unified-studio documentation change
Summary
Fixed typos, added storage configuration details, and clarified security isolation limitations with IAM recommendations
Security assessment
Explicitly documents security limitations ('Projects do not provide strong security isolation') and recommends IAM policies for access control. This adds security guidance but does not address a specific vulnerability.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/all-capabilities.md b/sagemaker-unified-studio/latest/adminguide/all-capabilities.md index 8c20d03ad..efc90b41e 100644 --- a//sagemaker-unified-studio/latest/adminguide/all-capabilities.md +++ b//sagemaker-unified-studio/latest/adminguide/all-capabilities.md @@ -66 +66 @@ Note that by configuring all capabilities for your domain (this procedure), you - 8. On the **Create project profil: All capabilities** page, in the **Provisioning role** section, specify a service role that gives Amazon SageMaker Unified Studio authorization to ingest and manage access to datashares, tables and views in Amazon Redshift. + 8. On the **Create project profile: All capabilities** page, in the **Provisioning role** section, specify a service role that gives Amazon SageMaker Unified Studio authorization to ingest and manage access to datashares, tables and views in Amazon Redshift. @@ -123,0 +124,2 @@ Note that when you enable a blueprint, by default, you are enabling it in the sa + 1. On the **Create project profile** page, in the **Project files storage** section, choose a storage configuration type from Amazon S3 - new and Git repository. For more information on storage types, see [._unified-storage.xml](._unified-storage.xml) + @@ -143 +145 @@ Projects do not provide strong security isolation. To limit cross-domain and cro -After you complete this procedure, your All capabilities project profile will only include the capabilities defined in the [Tooling blueprint](./blueprints.html). You can further customize this project profile and configure it to include all capabilities by using the **Blueprints** tab to enable the rest of its required bluerpints. They are the following: +After you complete this procedure, your All capabilities project profile will only include the capabilities defined in the [Tooling blueprint](./blueprints.html). You can further customize this project profile and configure it to include all capabilities by using the **Blueprints** tab to enable the rest of its required blueprints. They are the following: