AWS sagemaker medium security documentation change
Summary
Clarified IAM permissions requirements for pipeline execution roles, specifying that the policy must explicitly include `iam:PassRole` permissions for custom roles used in pipeline steps
Security assessment
The change emphasizes least-privilege security by requiring explicit specification of roles in IAM policies rather than generic permissions. This helps prevent overprivileged roles and potential privilege escalation risks.
Diff
diff --git a/sagemaker/latest/dg/build-and-manage-access.md b/sagemaker/latest/dg/build-and-manage-access.md index dcc2c1c14..87e70e0dc 100644 --- a//sagemaker/latest/dg/build-and-manage-access.md +++ b//sagemaker/latest/dg/build-and-manage-access.md @@ -30 +30 @@ The following sections describe the AWS Identity and Access Management (IAM) req -Your pipeline requires an IAM pipeline execution role that is passed to Pipelines when you create a pipeline. The role for the SageMaker AI instance that is creating the pipeline must have the `iam:PassRole` permission for the pipeline execution role in order to pass it. For more information on IAM roles, see [IAM Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html). +Your pipeline requires an IAM pipeline execution role that is passed to Pipelines when you create a pipeline. The role for the SageMaker AI instance you're using to create the pipeline must have a policy with the `iam:PassRole` permission that specifies the pipeline execution role. This is because the instance needs permission to pass your pipeline execution role to the Pipelines service for use in creating and running pipelines. For more information on IAM roles, see [IAM Roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html). @@ -34 +34 @@ Your pipeline execution role requires the following permissions: - * To pass any role to a SageMaker AI job within a pipeline, the `iam:PassRole` permission for the role that is being passed. + * You can use a unique or customized role for any of the SageMaker AI job steps in your pipeline (rather than the pipeline execution role, which is used by default). Make sure that your pipeline execution role has added a policy with the `iam:PassRole` permission that specifies each of these roles.