AWS sagemaker documentation change
Summary
Updated IAM policy documentation for SageMaker Service Catalog products, including new partner service role policies for API Gateway, CloudFormation, and Lambda. Modified permissions to include resource tagging constraints, account ownership conditions, and updated action/resource mappings.
Security assessment
Changes add documentation for new IAM policies and modify existing ones with stricter resource constraints (tag-based access controls, principal account matching). While these improve security posture, there's no evidence of addressing a specific disclosed vulnerability.
Diff
diff --git a/sagemaker/latest/dg/security-iam-awsmanpol-sc.md b/sagemaker/latest/dg/security-iam-awsmanpol-sc.md index aa11c1b40..9a049dfbc 100644 --- a//sagemaker/latest/dg/security-iam-awsmanpol-sc.md +++ b//sagemaker/latest/dg/security-iam-awsmanpol-sc.md @@ -66 +66 @@ This policy includes the following permissions. - * `codestarconnections`, `codestar-connections` – Also allows the role to pass AWS CodeConnections and AWS CodeStar connections. + * `codeconnections`, `codestar-connections` – Also allows the role to pass AWS CodeConnections and AWS CodeStar connections. @@ -92,0 +93,23 @@ This policy includes the following permissions. +To view the permissions for this policy, see [AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy.html) in the AWS Managed Policy Reference. + +## AWS managed policy: AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy + +This policy is used by Amazon API Gateway within the AWS Service Catalog provisioned products from the Amazon SageMaker AI portfolio. The policy is intended to be attached to an IAM role that the [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) passes to the AWS resources created by API Gateway that require a role. + +**Permissions details** + +This policy includes the following permissions. + + * `lambda` – Invoke a function created by a partner template. + + * `sagemaker` – Invoke an endpoint created by a partner template. + + + + +JSON + + +**** + + @@ -98 +120,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPermission", @@ -100,8 +122,2 @@ This policy includes the following permissions. - "Action": [ - "apigateway:GET", - "apigateway:POST", - "apigateway:PUT", - "apigateway:PATCH", - "apigateway:DELETE" - ], - "Resource": "*", + "Action": "lambda:InvokeFunction", + "Resource": "arn:aws:lambda:*:*:function:sagemaker-*", @@ -109,4 +125,3 @@ This policy includes the following permissions. - "StringLike": { - "aws:ResourceTag/sagemaker:launch-source": "*" - } - } + "Null": { + "aws:ResourceTag/sagemaker:project-name": "false", + "aws:ResourceTag/sagemaker:partner": "false" @@ -114,12 +129,2 @@ This policy includes the following permissions. - { - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPostPermission", - "Effect": "Allow", - "Action": [ - "apigateway:POST" - ], - "Resource": "*", - "Condition": { - "ForAnyValue:StringLike": { - "aws:TagKeys": [ - "sagemaker:launch-source" - ] + "StringEquals": { + "aws:ResourceAccount": "${aws:PrincipalAccount}" @@ -130,11 +134,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPatchPermission", - "Effect": "Allow", - "Action": [ - "apigateway:PATCH" - ], - "Resource": [ - "arn:aws:apigateway:*::/account" - ] - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnMutatePermission", @@ -142,6 +136,2 @@ This policy includes the following permissions. - "Action": [ - "cloudformation:CreateStack", - "cloudformation:UpdateStack", - "cloudformation:DeleteStack" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", + "Action": "sagemaker:InvokeEndpoint", + "Resource": "arn:aws:sagemaker:*:*:endpoint/*", @@ -149,4 +139,6 @@ This policy includes the following permissions. - "ArnLikeIfExists": { - "cloudformation:RoleArn": [ - "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" - ] + "Null": { + "aws:ResourceTag/sagemaker:project-name": "false", + "aws:ResourceTag/sagemaker:partner": "false" + }, + "StringEquals": { + "aws:ResourceAccount": "${aws:PrincipalAccount}" @@ -155,12 +146,0 @@ This policy includes the following permissions. - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnTagPermission", - "Effect": "Allow", - "Action": [ - "cloudformation:TagResource", - "cloudformation:UntagResource" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", - "Condition" : { - "Null": { - "aws:ResourceTag/sagemaker:project-name": "false" @@ -167,0 +148 @@ This policy includes the following permissions. + ] @@ -169 +150,27 @@ This policy includes the following permissions. - }, + + +## AWS managed policy: AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy + +This policy is used by AWS CloudFormation within the AWS Service Catalog provisioned products from the Amazon SageMaker AI portfolio. The policy is intended to be attached to an IAM role that the [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) passes to the AWS resources created by AWS CloudFormation that require a role. + +**Permissions details** + +This policy includes the following permissions. + + * `iam` – Pass the `AmazonSageMakerServiceCatalogProductsLambdaRole` and `AmazonSageMakerServiceCatalogProductsApiGatewayRole` roles. + + * `lambda` – Create, update, delete, and invoke AWS Lambda functions; retrieve, publish, and delete versions of a Lambda layer. + + * `apigateway` – Create, update, and delete Amazon API Gateway resources. + + * `s3` – Retrieve the `lambda-auth-code/layer.zip` file from an Amazon Simple Storage Service (Amazon S3) bucket. + + + + +JSON + + +**** + + @@ -172,29 +179,2 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogCFnReadPermission", - "Effect": "Allow", - "Action": [ - "cloudformation:DescribeStackEvents", - "cloudformation:DescribeStacks" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnTemplatePermission", - "Effect": "Allow", - "Action": [ - "cloudformation:GetTemplateSummary", - "cloudformation:ValidateTemplate" - ], - "Resource": "*" - }, - { - "Sid": "AmazonSageMakerServiceCatalogCodeBuildPermission", - "Effect": "Allow", - "Action": [ - "codebuild:CreateProject", - "codebuild:DeleteProject", - "codebuild:UpdateProject" - ], - "Resource": [ - "arn:aws:codebuild:*:*:project/sagemaker-*" - ] - }, + "Version":"2012-10-17", + "Statement": [ @@ -202 +181,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogCodeCommitPermission", @@ -205,5 +184 @@ This policy includes the following permissions. - "codecommit:CreateCommit", - "codecommit:CreateRepository", - "codecommit:DeleteRepository", - "codecommit:GetRepository", - "codecommit:TagResource" + "iam:PassRole" @@ -212,8 +187 @@ This policy includes the following permissions. - "arn:aws:codecommit:*:*:sagemaker-*" - ] - }, - { - "Sid": "AmazonSageMakerServiceCatalogCodeCommitListPermission", - "Effect": "Allow", - "Action": [ - "codecommit:ListRepositories" + "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsLambdaRole" @@ -221 +189,5 @@ This policy includes the following permissions. - "Resource": "*" + "Condition": { + "StringEquals": { + "iam:PassedToService": "lambda.amazonaws.com" + }