AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2025-08-22 · Documentation low

File: sagemaker-unified-studio/latest/userguide/nodes.md

Summary

Added documentation for new S3 storage and retrieval nodes, including configuration steps and IAM policy examples for S3 bucket access

Security assessment

The change adds IAM policy examples for S3 PutObject/GetObject permissions, which are security-relevant configurations. However, there's no evidence this addresses a specific vulnerability; it's standard feature documentation.

Diff

diff --git a/sagemaker-unified-studio/latest/userguide/nodes.md b/sagemaker-unified-studio/latest/userguide/nodes.md
index 14a207922..e7588e558 100644
--- a//sagemaker-unified-studio/latest/userguide/nodes.md
+++ b//sagemaker-unified-studio/latest/userguide/nodes.md
@@ -5 +5 @@
-Input nodeOutput nodeCollector nodeCondition nodeIterator nodeIterator node outputsPrompt nodeKnowledge Base nodeAgent node
+Input nodeOutput nodeCollector nodeCondition nodeIterator nodeIterator node outputsPrompt nodeKnowledge Base nodeAgent nodeS3 storage nodeS3 retrieval nodeAdding an Amazon S3 bucket
@@ -49,0 +50,6 @@ Amazon Bedrock in SageMaker Unified Studio supports a subset of the nodes that a
+  * S3 storage node
+
+  * S3 retrieval node
+
+  * Adding an Amazon S3 bucket
+
@@ -202 +208 @@ modelCompletion |  String
-A knowledge base node lets you send a query to a knowledge base and get response that the flow sends to the next node. For more information, see [Document data source](./data-source-document.html).
+A knowledge base node lets you send a query to a knowledge base and get response that the flow sends to the next node. For more information, see [Use a Local file as a data source](./data-source-document.html).
@@ -244,0 +251,85 @@ agentResponse |  String
+## S3 storage node
+
+An Amazon S3 Storage Node takes an object key and flow data as input. The flow data is stored in an Amazon S3 object specified by the object key, and the node returns the Amazon S3 URI where the data is stored. The Amazon S3 bucket can be specified in the configuration settings of the node.
+
+### S3 storage node inputs
+
+Name | Type | Expression  
+---|---|---  
+content |  String, Number, Boolean, Object, Array |  Yes  
+objectKey |  String |  Yes  
+  
+### S3 storage node outputs
+
+Name | Type  
+---|---  
+s3Uri |  String  
+  
+## S3 retrieval node
+
+An Amazon S3 Retrieval Node takes an object key as input and returns the data from the Amazon S3 object specified by the object key. The Amazon S3 bucket can be specified in the configuration settings of the node.
+
+### S3 retrieval node inputs
+
+Name | Type | Expression  
+---|---|---  
+objectKey |  String |  Yes  
+  
+### S3 retrieval node outputs
+
+Name | Type  
+---|---  
+s3Content |  String  
+  
+## Adding an Amazon S3 bucket
+
+To use S3 storage and retrieval flow nodes, you must first set up a connection with an Amazon S3 bucket. Amazon S3 buckets that are already within your project can be connected to automatically through a default S3 connection. If you want to use an S3 bucket from outside of your project, you will need to set up an S3 connection using the steps below.
+
+###### To connect to an S3 bucket outside of your project:
+
+  1. Navigate to the data section under your project overview.
+
+  2. Select **Add**.
+
+  3. Select **Add S3 location** , then select **Next**.
+
+  4. Follow the steps for Prerequisite option 2 in [Adding Amazon S3 data](./adding-existing-s3-data.html) to create the S3 connection and configure the correct permissions. Alternatively, you can use the following JSON policy to add permissions for an S3 storage node:
+    
+        {
+        "Sid": "WriteToS3Bucket",
+        "Effect": "Allow",
+        "Action": [
+            "s3:PutObject"
+        ],
+        "Resource": [
+            "arn:aws:s3:::${bucket-name}",
+            "arn:aws:s3:::${bucket-name}/*"
+        ],
+        "Condition": {
+            "StringEquals": {
+                "aws:ResourceAccount": "${account-id}"
+            }
+        }
+    }
+
+And the following JSON policy to add permissions for an S3 retrieval node:
+    
+        {
+        "Sid": "AccessS3Bucket",
+        "Effect": "Allow",
+        "Action": [
+            "s3:GetObject"
+        ],
+        "Resource": [
+            "arn:aws:s3:::${bucket-name}/*"
+        ],
+        "Condition": {
+            "StringEquals": {
+                "aws:ResourceAccount": "${account-id}"
+            }
+        }
+    }
+
+
+
+