AWS bedrock documentation change
Summary
Added detailed IAM policy configuration for Bedrock marketplace model operations including SageMaker endpoint management, KMS access, and AWS Marketplace integration with strict resource/tag conditions
Security assessment
The change adds granular IAM permissions documentation with security-focused conditions (e.g., CalledViaLast restrictions, specific tag requirements) but does not indicate a specific security vulnerability being patched. It enhances security posture through least-privilege controls rather than addressing a known exploit.
Diff
diff --git a/bedrock/latest/userguide/security-iam-awsmanpol.md b/bedrock/latest/userguide/security-iam-awsmanpol.md index 321a3649b..902238cc0 100644 --- a//bedrock/latest/userguide/security-iam-awsmanpol.md +++ b//bedrock/latest/userguide/security-iam-awsmanpol.md @@ -52,0 +53,214 @@ This policy includes the following permissions: + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "BedrockAll", + "Effect": "Allow", + "Action": [ + "bedrock:*" + ], + "Resource": "*" + }, + { + "Sid": "DescribeKey", + "Effect": "Allow", + "Action": [ + "kms:DescribeKey" + ], + "Resource": "arn:*:kms:*:::*" + }, + { + "Sid": "APIsWithAllResourceAccess", + "Effect": "Allow", + "Action": [ + "iam:ListRoles", + "ec2:DescribeVpcs", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups" + ], + "Resource": "*" + }, + { + "Sid": "MarketplaceModelEndpointMutatingAPIs", + "Effect": "Allow", + "Action": [ + "sagemaker:CreateEndpoint", + "sagemaker:CreateEndpointConfig", + "sagemaker:CreateModel", + "sagemaker:DeleteEndpoint", + "sagemaker:UpdateEndpoint" + ], + "Resource": [ + "arn:aws:sagemaker:*:*:endpoint/*", + "arn:aws:sagemaker:*:*:endpoint-config/*", + "arn:aws:sagemaker:*:*:model/*" + ], + "Condition": { + "StringEquals": { + "aws:CalledViaLast": "bedrock.amazonaws.com", + "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible" + } + } + }, + { + "Sid": "MarketplaceModelEndpointAddTagsOperations", + "Effect": "Allow", + "Action": [ + "sagemaker:AddTags" + ], + "Resource": [ + "arn:aws:sagemaker:*:*:endpoint/*", + "arn:aws:sagemaker:*:*:endpoint-config/*", + "arn:aws:sagemaker:*:*:model/*" + ], + "Condition": { + "ForAllValues:StringEquals": { + "aws:TagKeys": [ + "sagemaker-sdk:bedrock", + "bedrock:marketplace-registration-status", + "sagemaker-studio:hub-content-arn" + ] + }, + "StringLike": { + "aws:RequestTag/sagemaker-sdk:bedrock": "compatible", + "aws:RequestTag/bedrock:marketplace-registration-status": "registered", + "aws:RequestTag/sagemaker-studio:hub-content-arn": "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*" + } + } + }, + { + "Sid": "MarketplaceModelEndpointDeleteTagsOperations", + "Effect": "Allow", + "Action": [ + "sagemaker:DeleteTags" + ], + "Resource": [ + "arn:aws:sagemaker:*:*:endpoint/*", + "arn:aws:sagemaker:*:*:endpoint-config/*", + "arn:aws:sagemaker:*:*:model/*" + ], + "Condition": { + "ForAllValues:StringEquals": { + "aws:TagKeys": [ + "sagemaker-sdk:bedrock", + "bedrock:marketplace-registration-status", + "sagemaker-studio:hub-content-arn" + ] + }, + "StringLike": { + "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible", + "aws:ResourceTag/bedrock:marketplace-registration-status": "registered", + "aws:ResourceTag/sagemaker-studio:hub-content-arn": "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*" + } + } + }, + { + "Sid": "MarketplaceModelEndpointNonMutatingAPIs", + "Effect": "Allow", + "Action": [ + "sagemaker:DescribeEndpoint", + "sagemaker:DescribeEndpointConfig", + "sagemaker:DescribeModel", + "sagemaker:DescribeInferenceComponent", + "sagemaker:ListEndpoints", + "sagemaker:ListTags" + ], + "Resource": [ + "arn:aws:sagemaker:*:*:endpoint/*", + "arn:aws:sagemaker:*:*:endpoint-config/*", + "arn:aws:sagemaker:*:*:model/*" + ], + "Condition": { + "StringEquals": { + "aws:CalledViaLast": "bedrock.amazonaws.com" + } + } + }, + { + "Sid": "MarketplaceModelEndpointInvokingOperations", + "Effect": "Allow", + "Action": [ + "sagemaker:InvokeEndpoint", + "sagemaker:InvokeEndpointWithResponseStream" + ], + "Resource": [ + "arn:aws:sagemaker:*:*:endpoint/*" + ], + "Condition": { + "StringEquals": { + "aws:CalledViaLast": "bedrock.amazonaws.com", + "aws:ResourceTag/sagemaker-sdk:bedrock": "compatible" + } + } + }, + { + "Sid": "DiscoveringMarketplaceModel", + "Effect": "Allow", + "Action": [ + "sagemaker:DescribeHubContent" + ], + "Resource": [ + "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*", + "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" + ] + }, + { + "Sid": "AllowMarketplaceModelsListing", + "Effect": "Allow", + "Action": [ + "sagemaker:ListHubContents" + ], + "Resource": "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" + }, + { + "Sid": "PassRoleToSageMaker", + "Effect": "Allow", + "Action": [ + "iam:PassRole" + ], + "Resource": [ + "arn:aws:iam::*:role/*SageMaker*ForBedrock*" + ], + "Condition": { + "StringEquals": { + "iam:PassedToService": [ + "sagemaker.amazonaws.com", + "bedrock.amazonaws.com" + ] + } + } + }, + { + "Sid": "PassRoleToBedrock", + "Effect": "Allow", + "Action": [ + "iam:PassRole" + ], + "Resource": "arn:aws:iam::*:role/*AmazonBedrock*", + "Condition": { + "StringEquals": { + "iam:PassedToService": [ + "bedrock.amazonaws.com" + ] + } + }