AWS sagemaker-unified-studio medium security documentation change
Summary
Documented updates to managed policies SageMakerStudioProjectProvisioningRolePolicy (added security features) and SageMakerStudioEMRContainersSystemNamespaceRolePolicy (STS actions scope refinement).
Security assessment
Explicitly documents security-focused IAM policy changes, including encryption support and STS privilege reduction. The STS scope modification suggests remediation of potential overprivilege risks.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md index 2597ca77a..c2e4424ed 100644 --- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md +++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-updates.md @@ -10,0 +11,2 @@ Change | Description | Date +Policy update - [SageMakerStudioProjectProvisioningRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectProvisioningRolePolicy) | Policy updates to SageMakerStudioProjectProvisioningRolePolicy - permissions updates for the following features: EMR on EKS compute capabilities, trusted identity propagation with user background sessions, AWS resource custom tags support, support default AWS Glue catalog encryption, Amazon SageMaker Unified Studio per project S3 bucket. | 10/31/2025 +Policy update - [SageMakerStudioEMRContainersSystemNamespaceRolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioEMRContainersSystemNamespaceRolePolicy) | Policy updates to SageMakerStudioEMRContainersSystemNamespaceRolePolicy this revision refactors the scope of STS actions required for the EMR Containers service. | 10/31/2025