AWS sagemaker documentation change
Summary
Updated policy documentation to replace full JSON policy with summarized permission categories and link to external policy. Changed 'Amazon Managed Prometheus' to 'Amazon Managed Service for Prometheus' naming.
Security assessment
The changes are organizational/documentation improvements rather than addressing security vulnerabilities. The policy summary maintains the same broad access described previously. No evidence of security vulnerability fixes or incident response.
Diff
diff --git a/sagemaker/latest/dg/security-iam-awsmanpol-AmazonSageMakerHyperPodObservabilityAdminAccess.md b/sagemaker/latest/dg/security-iam-awsmanpol-AmazonSageMakerHyperPodObservabilityAdminAccess.md index fc1adfc61..132fa9c7b 100644 --- a//sagemaker/latest/dg/security-iam-awsmanpol-AmazonSageMakerHyperPodObservabilityAdminAccess.md +++ b//sagemaker/latest/dg/security-iam-awsmanpol-AmazonSageMakerHyperPodObservabilityAdminAccess.md @@ -7 +7 @@ -This policy provides administrative privileges required for setting up Amazon SageMaker HyperPod observability. It enables access to Amazon Managed Prometheus, Amazon Managed Grafana and Amazon Elastic Kubernetes Service add-ons. The policy also includes broad access to Grafana HTTP APIs through ServiceAccountTokens across all Amazon Managed Grafana workspaces in your account. +This policy provides administrative privileges required for setting up Amazon SageMaker HyperPod observability. It enables access to Amazon Managed Service for Prometheus, Amazon Managed Grafana and Amazon Elastic Kubernetes Service add-ons. The policy also includes broad access to Grafana HTTP APIs through ServiceAccountTokens across all Amazon Managed Grafana workspaces in your account. @@ -9 +9 @@ This policy provides administrative privileges required for setting up Amazon Sa -The following is the policy JSON. +###### Permission details @@ -10,0 +11 @@ The following is the policy JSON. +The following list provides an overview of the permissions that are included in this policy. @@ -12,257 +13,18 @@ The following is the policy JSON. - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "PrometheusCreateAccess", - "Effect": "Allow", - "Action": [ - "aps:CreateWorkspace" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:RequestTag/SageMaker": "true" - } - } - }, - { - "Sid": "PrometheusTagsAccess", - "Effect": "Allow", - "Action": "aps:TagResource", - "Resource": [ - "arn:aws:aps:*:*:/workspaces", - "arn:aws:aps:*:*:rulegroupsnamespace/*/HyperPodObservabilityNamespace" - ], - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "SageMaker" - ] - }, - "StringEquals": { - "aws:RequestTag/SageMaker": "true", - "aws:ResourceTag/SageMaker": "true" - } - } - }, - { - "Sid": "PrometheusDescribeAccess", - "Effect": "Allow", - "Action": [ - "aps:DescribeWorkspace" - ], - "Resource": "arn:aws:aps:*:*:workspace/*" - }, - { - "Sid": "PrometheusListAccess", - "Effect": "Allow", - "Action": [ - "aps:ListWorkspaces" - ], - "Resource": "*" - }, - { - "Sid": "PrometheusAlertsRuleGroupAccess", - "Effect": "Allow", - "Action": [ - "aps:CreateAlertManagerDefinition", - "aps:DescribeAlertManagerDefinition", - "aps:DescribeRuleGroupsNamespace", - "aps:ListRuleGroupsNamespaces" - ], - "Resource": [ - "arn:aws:aps:*:*:workspace/*", - "arn:aws:aps:*:*:rulegroupsnamespace/*/HyperPodObservabilityNamespace" - ] - }, - { - "Sid": "PrometheusCreateRuleGroupAccess", - "Effect": "Allow", - "Action": "aps:CreateRuleGroupsNamespace", - "Resource": "arn:aws:aps:*:*:rulegroupsnamespace/*/HyperPodObservabilityNamespace", - "Condition": { - "StringEquals": { - "aws:RequestTag/SageMaker": "true", - "aws:ResourceTag/SageMaker": "true" - } - } - }, - { - "Sid": "GrafanaCreateWorkspaceAccess", - "Effect": "Allow", - "Action": [ - "grafana:CreateWorkspace" - ], - "Resource": "*", - "Condition": { - "StringEquals": { - "aws:RequestTag/SageMaker": "true" - } - } - }, - { - "Sid": "GrafanaTagsAccess", - "Effect": "Allow", - "Action": "grafana:TagResource", - "Resource": "arn:aws:grafana:*:*:/workspaces", - "Condition": { - "ForAllValues:StringEquals": { - "aws:TagKeys": [ - "SageMaker" - ] - }, - "StringEquals": { - "aws:RequestTag/SageMaker": "true", - "aws:ResourceTag/SageMaker": "true" - } - } - }, - { - "Sid": "GrafanaListAccess", - "Effect": "Allow", - "Action": [ - "grafana:ListWorkspaces" - ], - "Resource": "*" - }, - { - "Sid": "GrafanaServiceAccountAccess", - "Effect": "Allow", - "Action": [ - "grafana:DescribeWorkspace", - "grafana:CreateWorkspaceApiKey", - "grafana:CreateWorkspaceServiceAccount", - "grafana:CreateWorkspaceServiceAccountToken", - "grafana:ListWorkspaceServiceAccounts", - "grafana:ListWorkspaceServiceAccountTokens", - "grafana:DeleteWorkspaceServiceAccountToken" - ], - "Resource": "arn:aws:grafana:*:*:/workspaces/*" - }, - { - "Sid": "IAMGrafanaPassRoleAccess", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": "arn:aws:iam::*:role/AmazonSageMakerHyperPodObservabilityGrafanaAccess-*", - "Condition": { - "StringLike": { - "iam:PassedToService": [ - "grafana.amazonaws.com" - ] - } - } - }, - { - "Sid": "IAMEKSPassRoleAccess", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": "arn:aws:iam::*:role/AmazonSageMakerHyperPodObservabilityAddonAccess-*", - "Condition": { - "StringLike": { - "iam:PassedToService": [ - "pods.eks.amazonaws.com" - ] - } - } - }, - { - "Sid": "IAMGetRoleAccess", - "Effect": "Allow", - "Action": "iam:GetRole", - "Resource": [ - "arn:aws:iam::*:role/AmazonSageMakerHyperPodObservabilityAddonAccess-*" - ] - }, - { - "Sid": "HyperPodClusterAccess", - "Effect": "Allow", - "Action": [ - "sagemaker:ListClusters", - "sagemaker:DescribeCluster" - ], - "Resource": "*" - }, - { - "Sid": "EKSAddonAccess", - "Effect": "Allow", - "Action": [ - "eks:DeleteAddon", - "eks:UpdateAddon", - "eks:DescribeAddon" - ], - "Resource": "arn:aws:eks:*:*:addon/*/amazon-sagemaker-hyperpod-observability/*" - },