AWS sagemaker-unified-studio high security documentation change
Summary
Removed entire KMS key policy JSON example and updated navigation path
Security assessment
The removal of the KMS key policy example could indicate addressing insecure permissions (e.g., overly broad root ARN usage, permissive conditions). KMS policies are security-critical, and removing flawed examples prevents misconfiguration.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md b/sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md index 391975197..9400599db 100644 --- a//sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md +++ b//sagemaker-unified-studio/latest/adminguide/amazon-bedrock-key-permissions.md @@ -3 +3 @@ -[Documentation](/index.html)[Amazon SageMaker Unified Studio](/sagemaker/index.html)[Administrator Guide](what-is-sagemaker-unified-studio.html) +[Documentation](/index.html)[Amazon SageMaker Unified Studio](/next-generation-sagemaker/index.html)[Administrator Guide](what-is-sagemaker-unified-studio.html) @@ -9,214 +8,0 @@ -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "Allow administrators to manage key", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:role/ExampleAdminRole" - }, - "Action": [ - "kms:Create*", - "kms:Describe*", - "kms:Enable*", - "kms:List*", - "kms:Put*", - "kms:Update*", - "kms:Revoke*", - "kms:Disable*", - "kms:Get*", - "kms:Delete*", - "kms:TagResource", - "kms:UntagResource", - "kms:ScheduleKeyDeletion", - "kms:CancelKeyDeletion", - "kms:RotateKeyOnDemand" - ], - "Resource": "*" - }, - { - "Sid": "Allow administrators and SageMaker domain execution role to encrypt and decrypt DataZone data", - "Effect": "Allow", - "Principal": { - "AWS": [ - "arn:aws:iam::111122223333:role/ExampleAdminRole", - "arn:aws:iam::111122223333:role/ExampleDomainUser", - "arn:aws:iam::111122223333:role/service-role/AmazonSageMakerDomainExecution" - ] - }, - "Action": [ - "kms:CreateGrant", - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "*", - "Condition": { - "StringLike": { - "kms:EncryptionContext:aws:datazone:domainId": "dzd*" - } - } - }, - { - "Sid": "Allow SageMaker provisioning role to encrypt and decrypt Amazon Bedrock resources", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:role/service-role/AmazonSageMakerProvisioning-111122223333" - }, - "Action": [ - "kms:CreateGrant", - "kms:Decrypt", - "kms:DescribeKey", - "kms:Encrypt", - "kms:GenerateDataKey" - ], - "Resource": "*" - }, - { - "Sid": "Allow SageMaker project roles to describe key", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:root" - }, - "Action": "kms:DescribeKey", - "Resource": "*", - "Condition": { - "Null": { - "aws:PrincipalTag/AmazonDataZoneProject": "false" - } - } - }, - { - "Sid": "Allow SageMaker project roles to encrypt and decrypt data in Tooling blueprint S3 bucket", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:root" - }, - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "*", - "Condition": { - "Null": { - "aws:PrincipalTag/AmazonDataZoneProject": "false" - }, - "StringLike": { - "kms:ViaService": "s3.*.amazonaws.com" - } - } - }, - { - "Sid": "Allow SageMaker project roles to encrypt and decrypt Amazon Bedrock secrets", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:root" - }, - "Action": [ - "kms:Decrypt", - "kms:Encrypt", - "kms:GenerateDataKey" - ], - "Resource": "*", - "Condition": { - "Null": { - "aws:PrincipalTag/AmazonDataZoneProject": "false" - }, - "StringLike": { - "kms:ViaService": "secretsmanager.*.amazonaws.com" - }, - "ArnLike": { - "kms:EncryptionContext:SecretARN": "arn:aws:secretsmanager:*:*:secret:amazon-bedrock*" - } - } - }, - { - "Sid": "Allow SageMaker project roles to encrypt and decrypt Amazon Bedrock data", - "Effect": "Allow", - "Principal": { - "AWS": "arn:aws:iam::111122223333:root" - }, - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "*", - "Condition": { - "Null": { - "aws:PrincipalTag/AmazonDataZoneProject": "false" - }, - "ForAnyValue:StringLike": { - "kms:EncryptionContextKeys": [ - "aws:bedrock*", - "evaluationJobArn" - ] - } - } - }, - { - "Sid": "Allow Amazon Bedrock to encrypt and decrypt Amazon Bedrock data", - "Effect": "Allow", - "Principal": { - "Service": "bedrock.amazonaws.com" - }, - "Action": [ - "kms:Decrypt", - "kms:GenerateDataKey" - ], - "Resource": "*", - "Condition": { - "ForAnyValue:StringLike": { - "kms:EncryptionContextKeys": [ - "aws:bedrock*", - "evaluationJobArn" - ] - } - } - }, - { - "Sid": "Allow Amazon Bedrock to create and revoke grants for Amazon Bedrock resources", - "Effect": "Allow", - "Principal": { - "Service": "bedrock.amazonaws.com" - }, - "Action": [ - "kms:CreateGrant", - "kms:ListGrants", - "kms:RevokeGrant" - ], - "Resource": "*", - "Condition": { - "Bool": { - "kms:GrantIsForAWSResource": "true" - } - } - }, - { - "Sid": "Allow CloudWatch Logs to encrypt and decrypt Amazon Bedrock log groups",