AWS redshift documentation change

Service: redshift · 2025-08-28 · Documentation low

File: redshift/latest/dg/getting-started-machine-learning.md

Summary

Removed detailed IAM policy for SageMaker/Redshift ML integration

Security assessment

Policy example deletion removes guidance for secure ML permissions setup but doesn't indicate a security fix. Could impact users' ability to configure least-privilege access.

Diff

diff --git a/redshift/latest/dg/getting-started-machine-learning.md b/redshift/latest/dg/getting-started-machine-learning.md
index b5c91543e..1d4e1d5ca 100644
--- a//redshift/latest/dg/getting-started-machine-learning.md
+++ b//redshift/latest/dg/getting-started-machine-learning.md
@@ -69,76 +68,0 @@ The ``your-account-id``, ``your-role``, and `amzn-s3-demo-bucket` values are the
-JSON
-    
-
-****
-    
-        
-                {
-            "Version": "2012-10-17",
-            "Statement": [
-                {
-                    "Effect": "Allow",
-                    "Action": [
-                        "cloudwatch:PutMetricData",
-                        "ecr:BatchCheckLayerAvailability",
-                        "ecr:BatchGetImage",
-                        "ecr:GetAuthorizationToken",
-                        "ecr:GetDownloadUrlForLayer",
-                        "logs:CreateLogGroup",
-                        "logs:CreateLogStream",
-                        "logs:DescribeLogStreams",
-                        "logs:PutLogEvents",
-                        "sagemaker:*Job*",
-                        "sagemaker:AddTags",
-                        "sagemaker:CreateModel",
-                        "sagemaker:CreateEndpoint",
-                        "sagemaker:CreateEndpointConfig",
-                        "sagemaker:DeleteEndpoint",
-                        "sagemaker:DeleteEndpointConfig,
-                        "sagemaker:DeleteModel"
-                    ],
-                    "Resource": "*"
-                },
-                {
-                    "Effect": "Allow",
-                    "Action": [
-                        "iam:PassRole",
-                        "s3:AbortMultipartUpload",
-                        "s3:GetObject",
-                        "s3:DeleteObject",
-                        "s3:PutObject"
-                    ],
-                    "Resource": [
-                        "arn:aws:iam::<your-account-id>:role/<your-role>",
-                        "arn:aws:s3:::amzn-s3-demo-bucket/*",
-                        "arn:aws:s3:::redshift-downloads/*"
-                    ]
-                },
-                {
-                    "Effect": "Allow",
-                    "Action": [
-                        "s3:GetBucketLocation",
-                        "s3:ListBucket"
-                    ],
-                    "Resource": [
-                        "arn:aws:s3:::amzn-s3-demo-bucket,
-                        "arn:aws:s3:::redshift-downloads"
-                    ]
-                }
-                // Optional section needed if you use AWS KMS keys.
-                ,{
-                    "Effect": "Allow",
-                    "Action": [
-                        "kms:CreateGrant",
-                        "kms:Decrypt",
-                        "kms:DescribeKey",
-                        "kms:Encrypt",
-                        "kms:GenerateDataKey*"
-                     ],
-                     "Resource": [
-                        "arn:aws:kms:<your-region>:<your-account-id>:key/<your-kms-key>"
-                     ]
-                }
-            ]
-        }
-        
-