AWS sagemaker documentation change
Summary
Added AWS managed policy 'AmazonSageMakerPartnerServiceCatalogProductsLambdaServiceRolePolicy' for Secrets Manager access with partner tag validation
Security assessment
Documents new security controls for secret retrieval with tag-based access (aws:ResourceTag/sagemaker:partner). Enhances security documentation but doesn't fix a known vulnerability.
Diff
diff --git a/sagemaker/latest/dg/security-iam-awsmanpol-sc.md b/sagemaker/latest/dg/security-iam-awsmanpol-sc.md index aa11c1b40..9a049dfbc 100644 --- a//sagemaker/latest/dg/security-iam-awsmanpol-sc.md +++ b//sagemaker/latest/dg/security-iam-awsmanpol-sc.md @@ -66 +66 @@ This policy includes the following permissions. - * `codestarconnections`, `codestar-connections` – Also allows the role to pass AWS CodeConnections and AWS CodeStar connections. + * `codeconnections`, `codestar-connections` – Also allows the role to pass AWS CodeConnections and AWS CodeStar connections. @@ -92,0 +93,23 @@ This policy includes the following permissions. +To view the permissions for this policy, see [AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy.html) in the AWS Managed Policy Reference. + +## AWS managed policy: AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy + +This policy is used by Amazon API Gateway within the AWS Service Catalog provisioned products from the Amazon SageMaker AI portfolio. The policy is intended to be attached to an IAM role that the [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) passes to the AWS resources created by API Gateway that require a role. + +**Permissions details** + +This policy includes the following permissions. + + * `lambda` – Invoke a function created by a partner template. + + * `sagemaker` – Invoke an endpoint created by a partner template. + + + + +JSON + + +**** + + @@ -98 +120,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPermission", @@ -100,8 +122,2 @@ This policy includes the following permissions. - "Action": [ - "apigateway:GET", - "apigateway:POST", - "apigateway:PUT", - "apigateway:PATCH", - "apigateway:DELETE" - ], - "Resource": "*", + "Action": "lambda:InvokeFunction", + "Resource": "arn:aws:lambda:*:*:function:sagemaker-*", @@ -109,4 +125,3 @@ This policy includes the following permissions. - "StringLike": { - "aws:ResourceTag/sagemaker:launch-source": "*" - } - } + "Null": { + "aws:ResourceTag/sagemaker:project-name": "false", + "aws:ResourceTag/sagemaker:partner": "false" @@ -114,12 +129,2 @@ This policy includes the following permissions. - { - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPostPermission", - "Effect": "Allow", - "Action": [ - "apigateway:POST" - ], - "Resource": "*", - "Condition": { - "ForAnyValue:StringLike": { - "aws:TagKeys": [ - "sagemaker:launch-source" - ] + "StringEquals": { + "aws:ResourceAccount": "${aws:PrincipalAccount}" @@ -130,11 +134,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPatchPermission", - "Effect": "Allow", - "Action": [ - "apigateway:PATCH" - ], - "Resource": [ - "arn:aws:apigateway:*::/account" - ] - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnMutatePermission", @@ -142,6 +136,2 @@ This policy includes the following permissions. - "Action": [ - "cloudformation:CreateStack", - "cloudformation:UpdateStack", - "cloudformation:DeleteStack" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", + "Action": "sagemaker:InvokeEndpoint", + "Resource": "arn:aws:sagemaker:*:*:endpoint/*", @@ -149,4 +139,6 @@ This policy includes the following permissions. - "ArnLikeIfExists": { - "cloudformation:RoleArn": [ - "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" - ] + "Null": { + "aws:ResourceTag/sagemaker:project-name": "false", + "aws:ResourceTag/sagemaker:partner": "false" + }, + "StringEquals": { + "aws:ResourceAccount": "${aws:PrincipalAccount}" @@ -155,12 +146,0 @@ This policy includes the following permissions. - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnTagPermission", - "Effect": "Allow", - "Action": [ - "cloudformation:TagResource", - "cloudformation:UntagResource" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", - "Condition" : { - "Null": { - "aws:ResourceTag/sagemaker:project-name": "false" @@ -167,0 +148 @@ This policy includes the following permissions. + ] @@ -169 +150,27 @@ This policy includes the following permissions. - }, + + +## AWS managed policy: AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy + +This policy is used by AWS CloudFormation within the AWS Service Catalog provisioned products from the Amazon SageMaker AI portfolio. The policy is intended to be attached to an IAM role that the [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) passes to the AWS resources created by AWS CloudFormation that require a role. + +**Permissions details** + +This policy includes the following permissions. + + * `iam` – Pass the `AmazonSageMakerServiceCatalogProductsLambdaRole` and `AmazonSageMakerServiceCatalogProductsApiGatewayRole` roles. + + * `lambda` – Create, update, delete, and invoke AWS Lambda functions; retrieve, publish, and delete versions of a Lambda layer. + + * `apigateway` – Create, update, and delete Amazon API Gateway resources. + + * `s3` – Retrieve the `lambda-auth-code/layer.zip` file from an Amazon Simple Storage Service (Amazon S3) bucket. + + + + +JSON + + +**** + + @@ -172,29 +179,2 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogCFnReadPermission", - "Effect": "Allow", - "Action": [ - "cloudformation:DescribeStackEvents", - "cloudformation:DescribeStacks" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnTemplatePermission", - "Effect": "Allow", - "Action": [ - "cloudformation:GetTemplateSummary", - "cloudformation:ValidateTemplate" - ], - "Resource": "*" - }, - { - "Sid": "AmazonSageMakerServiceCatalogCodeBuildPermission", - "Effect": "Allow", - "Action": [ - "codebuild:CreateProject", - "codebuild:DeleteProject", - "codebuild:UpdateProject" - ], - "Resource": [ - "arn:aws:codebuild:*:*:project/sagemaker-*" - ] - }, + "Version":"2012-10-17", + "Statement": [ @@ -202 +181,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogCodeCommitPermission", @@ -205,5 +184 @@ This policy includes the following permissions. - "codecommit:CreateCommit", - "codecommit:CreateRepository", - "codecommit:DeleteRepository", - "codecommit:GetRepository", - "codecommit:TagResource" + "iam:PassRole" @@ -212,8 +187 @@ This policy includes the following permissions. - "arn:aws:codecommit:*:*:sagemaker-*" - ] - }, - { - "Sid": "AmazonSageMakerServiceCatalogCodeCommitListPermission", - "Effect": "Allow", - "Action": [ - "codecommit:ListRepositories" + "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsLambdaRole" @@ -221 +189,5 @@ This policy includes the following permissions. - "Resource": "*" + "Condition": { + "StringEquals": { + "iam:PassedToService": "lambda.amazonaws.com" + }