AWS sagemaker-unified-studio documentation change
Summary
Added 6 new IAM execution policies for SageMaker Unified Studio (Admin/User roles with permissive/default data access) and updated policy references. Added support for AssociateGovernedTerms/DisassociateGovernedTerms API actions for asset classification.
Security assessment
The changes document new IAM policies that control data access levels (broad vs restricted) and administrative privileges. While these are security-related features, there is no evidence of addressing a specific vulnerability. The changes improve security posture by clarifying access controls.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md index 3cc0ce229..e21f37965 100644 --- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md +++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md @@ -10,0 +11,7 @@ Change | Description | Date +Policy update - [SageMakerStudioDomainExecutionRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioDomainExecutionRolePolicy) | Policy updates to SageMakerStudioDomainExecutionRolePolicy - adding support for the new API actions - AssociateGovernedTerms and DisassociateGovernedTerms for the asset classification using restricted glossary terms feature in the catalog where users can associate or disassociate restricted glossary terms to an asset. | 8/20/2025 +New policy - [SageMakerStudioUserIAMPermissiveExecutionPolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioAdminIAMDefaultExecutionPolicy) | This is an execution policy for using IAM roles with Amazon SageMaker Unified Studio. It grants access to users to access resources, including broad access to data resources. | 8/20/2025 +New policy - [SageMakerStudioAdminIAMPermissiveExecutionPolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioAdminIAMDefaultExecutionPolicy) | This is an administrative execution policy for using IAM roles with Amazon SageMaker Unified Studio. It grants administrative access to provision, manage and access resources, including broad access to data resources. | 8/20/2025 +New policy - [SageMakerStudioUserIAMDefaultExecutionPolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioAdminIAMDefaultExecutionPolicy) | This is an execution policy for using IAM roles with Amazon SageMaker Unified Studio. It grants access to users to access resources, excluding access to data resources. | 8/20/2025 +New policy - [SageMakerStudioAdminIAMDefaultExecutionPolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioAdminIAMDefaultExecutionPolicy) | This is an administrative execution policy for using IAM roles with Amazon SageMaker Unified Studio. It grants administrative access to provision, manage and access resources in your account, excluding access to data resources. | 8/20/2025 +New policy - [SageMakerStudioAdminIAMConsolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioAdminIAMConsolePolicy) | This policy provides administrative and individual setup privileges for Amazon SageMaker Unified Studio using the AWS Management Console and SDK. It grants permissions for launching Amazon SageMaker Unified Studio. | 8/20/2025 +New policy - [SageMakerStudioUserIAMConsolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioUserIAMConsolePolicy) | This policy provides individual setup privileges for Amazon SageMaker Unified Studio using the AWS Management Console and SDK. It grants permissions for launching Amazon SageMaker Unified Studio. | 8/20/2025 @@ -82 +89 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -SageMakerStudioBedrockFunctionExecutionRolePolicy +SageMakerStudioAdminIAMPermissiveExecutionPolicy