AWS sagemaker documentation change
Summary
Updated policy version dates and change descriptions in revision history table
Security assessment
Routine maintenance update showing policy version changes. No security context or vulnerability fixes mentioned.
Diff
diff --git a/sagemaker/latest/dg/security-iam-awsmanpol-sc.md b/sagemaker/latest/dg/security-iam-awsmanpol-sc.md index aa11c1b40..9a049dfbc 100644 --- a//sagemaker/latest/dg/security-iam-awsmanpol-sc.md +++ b//sagemaker/latest/dg/security-iam-awsmanpol-sc.md @@ -66 +66 @@ This policy includes the following permissions. - * `codestarconnections`, `codestar-connections` – Also allows the role to pass AWS CodeConnections and AWS CodeStar connections. + * `codeconnections`, `codestar-connections` – Also allows the role to pass AWS CodeConnections and AWS CodeStar connections. @@ -92,0 +93,23 @@ This policy includes the following permissions. +To view the permissions for this policy, see [AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy.html) in the AWS Managed Policy Reference. + +## AWS managed policy: AmazonSageMakerPartnerServiceCatalogProductsApiGatewayServiceRolePolicy + +This policy is used by Amazon API Gateway within the AWS Service Catalog provisioned products from the Amazon SageMaker AI portfolio. The policy is intended to be attached to an IAM role that the [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) passes to the AWS resources created by API Gateway that require a role. + +**Permissions details** + +This policy includes the following permissions. + + * `lambda` – Invoke a function created by a partner template. + + * `sagemaker` – Invoke an endpoint created by a partner template. + + + + +JSON + + +**** + + @@ -98 +120,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPermission", @@ -100,8 +122,2 @@ This policy includes the following permissions. - "Action": [ - "apigateway:GET", - "apigateway:POST", - "apigateway:PUT", - "apigateway:PATCH", - "apigateway:DELETE" - ], - "Resource": "*", + "Action": "lambda:InvokeFunction", + "Resource": "arn:aws:lambda:*:*:function:sagemaker-*", @@ -109,4 +125,3 @@ This policy includes the following permissions. - "StringLike": { - "aws:ResourceTag/sagemaker:launch-source": "*" - } - } + "Null": { + "aws:ResourceTag/sagemaker:project-name": "false", + "aws:ResourceTag/sagemaker:partner": "false" @@ -114,12 +129,2 @@ This policy includes the following permissions. - { - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPostPermission", - "Effect": "Allow", - "Action": [ - "apigateway:POST" - ], - "Resource": "*", - "Condition": { - "ForAnyValue:StringLike": { - "aws:TagKeys": [ - "sagemaker:launch-source" - ] + "StringEquals": { + "aws:ResourceAccount": "${aws:PrincipalAccount}" @@ -130,11 +134,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogAPIGatewayPatchPermission", - "Effect": "Allow", - "Action": [ - "apigateway:PATCH" - ], - "Resource": [ - "arn:aws:apigateway:*::/account" - ] - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnMutatePermission", @@ -142,6 +136,2 @@ This policy includes the following permissions. - "Action": [ - "cloudformation:CreateStack", - "cloudformation:UpdateStack", - "cloudformation:DeleteStack" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", + "Action": "sagemaker:InvokeEndpoint", + "Resource": "arn:aws:sagemaker:*:*:endpoint/*", @@ -149,4 +139,6 @@ This policy includes the following permissions. - "ArnLikeIfExists": { - "cloudformation:RoleArn": [ - "arn:aws:sts::*:assumed-role/AmazonSageMakerServiceCatalog*" - ] + "Null": { + "aws:ResourceTag/sagemaker:project-name": "false", + "aws:ResourceTag/sagemaker:partner": "false" + }, + "StringEquals": { + "aws:ResourceAccount": "${aws:PrincipalAccount}" @@ -155,12 +146,0 @@ This policy includes the following permissions. - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnTagPermission", - "Effect": "Allow", - "Action": [ - "cloudformation:TagResource", - "cloudformation:UntagResource" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*", - "Condition" : { - "Null": { - "aws:ResourceTag/sagemaker:project-name": "false" @@ -167,0 +148 @@ This policy includes the following permissions. + ] @@ -169 +150,27 @@ This policy includes the following permissions. - }, + + +## AWS managed policy: AmazonSageMakerPartnerServiceCatalogProductsCloudFormationServiceRolePolicy + +This policy is used by AWS CloudFormation within the AWS Service Catalog provisioned products from the Amazon SageMaker AI portfolio. The policy is intended to be attached to an IAM role that the [AmazonSageMakerServiceCatalogProductsLaunchRole](https://console.aws.amazon.com/iam/home?#/roles/AmazonSageMakerServiceCatalogProductsLaunchRole) passes to the AWS resources created by AWS CloudFormation that require a role. + +**Permissions details** + +This policy includes the following permissions. + + * `iam` – Pass the `AmazonSageMakerServiceCatalogProductsLambdaRole` and `AmazonSageMakerServiceCatalogProductsApiGatewayRole` roles. + + * `lambda` – Create, update, delete, and invoke AWS Lambda functions; retrieve, publish, and delete versions of a Lambda layer. + + * `apigateway` – Create, update, and delete Amazon API Gateway resources. + + * `s3` – Retrieve the `lambda-auth-code/layer.zip` file from an Amazon Simple Storage Service (Amazon S3) bucket. + + + + +JSON + + +**** + + @@ -172,29 +179,2 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogCFnReadPermission", - "Effect": "Allow", - "Action": [ - "cloudformation:DescribeStackEvents", - "cloudformation:DescribeStacks" - ], - "Resource": "arn:aws:cloudformation:*:*:stack/SC-*" - }, - { - "Sid": "AmazonSageMakerServiceCatalogCFnTemplatePermission", - "Effect": "Allow", - "Action": [ - "cloudformation:GetTemplateSummary", - "cloudformation:ValidateTemplate" - ], - "Resource": "*" - }, - { - "Sid": "AmazonSageMakerServiceCatalogCodeBuildPermission", - "Effect": "Allow", - "Action": [ - "codebuild:CreateProject", - "codebuild:DeleteProject", - "codebuild:UpdateProject" - ], - "Resource": [ - "arn:aws:codebuild:*:*:project/sagemaker-*" - ] - }, + "Version":"2012-10-17", + "Statement": [ @@ -202 +181,0 @@ This policy includes the following permissions. - "Sid": "AmazonSageMakerServiceCatalogCodeCommitPermission", @@ -205,5 +184 @@ This policy includes the following permissions. - "codecommit:CreateCommit", - "codecommit:CreateRepository", - "codecommit:DeleteRepository", - "codecommit:GetRepository", - "codecommit:TagResource" + "iam:PassRole" @@ -212,8 +187 @@ This policy includes the following permissions. - "arn:aws:codecommit:*:*:sagemaker-*" - ] - }, - { - "Sid": "AmazonSageMakerServiceCatalogCodeCommitListPermission", - "Effect": "Allow", - "Action": [ - "codecommit:ListRepositories" + "arn:aws:iam::*:role/service-role/AmazonSageMakerServiceCatalogProductsLambdaRole" @@ -221 +189,5 @@ This policy includes the following permissions. - "Resource": "*" + "Condition": { + "StringEquals": { + "iam:PassedToService": "lambda.amazonaws.com" + }