AWS sagemaker-unified-studio medium security documentation change
Summary
Added hyperlinks to IAM policies, updated service references (AWS Glue/S3 to Athena/S3 Tables), reordered configuration steps, and clarified policy requirements for execution roles
Security assessment
The changes explicitly document required IAM policies (SageMakerStudioUserIAMConsolePolicy) and trust relationships for secure role configuration. Clarifying how roles must pass themselves to services and enforce policy attachments directly impacts access control security. Incorrect IAM configurations could lead to privilege escalation or unauthorized access.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md b/sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md index 55604a2d1..3a29fd041 100644 --- a//sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md +++ b//sagemaker-unified-studio/latest/adminguide/setup-projects-iam-based-domains.md @@ -15 +15 @@ To create a project within an IAM-based domain you assign Member IAM role or use - * SageMakerStudioUserIAMConsolePolicy must be attached or have the same permissions added via another policy. + * [SageMakerStudioUserIAMConsolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioUserIAMConsolePolicy.html) must be attached or have the same permissions added via another policy. @@ -22 +22 @@ To create a project within an IAM-based domain you assign Member IAM role or use - * When Amazon SageMaker Unified Studio creates this role for you, this policy will be attached, SageMakerStudioUserIAMDefaultExecutionPolicy. + * When Amazon SageMaker Unified Studio creates this role for you, this policy will be attached, [SageMakerStudioUserIAMDefaultExecutionPolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioUserIAMDefaultExecutionPolicy.html). @@ -24 +24 @@ To create a project within an IAM-based domain you assign Member IAM role or use - * When you provide your own role, SageMakerStudioUserIAMConsolePolicy must be attached. An inline policy is needed to allow this role to pass itself to other services. A trust policy is needed to allow Amazon SageMaker Unified Studio and related services to assume this execution IAM role. + * When you provide your own role, [SageMakerStudioUserIAMConsolePolicy](https://docs.aws.amazon.com/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioUserIAMConsolePolicy.html) must be attached. An inline policy is needed to allow this role to pass itself to other services. A trust policy is needed to allow Amazon SageMaker Unified Studio and related services to assume this execution IAM role. @@ -52 +52 @@ To create a project within an IAM-based domain you assign Member IAM role or use -You can configure other IAM roles in your account to self-setup their Amazon SageMaker Unified Studio project within your IAM-based domain. You must add additional permissions and policies to the existing IAM roles to allow them to setup their own project using the Member IAM role for login and Execution IAM role for accessing data and resources within the project. This enables users from AWS console to create projects using these roles from AWS Services - AWS Glue, Amazon Simple Storage Service (S3), and Amazon Redshift. +You can configure other IAM roles in your account to self-setup their Amazon SageMaker Unified Studio project within your IAM-based domain. You must add additional permissions and policies to the existing IAM roles to allow them to setup their own project using the Member IAM role for login and Execution IAM role for accessing data and resources within the project. This enables users from AWS console to create projects using these roles from AWS Services - Amazon Athena, Amazon S3 Tables, and Amazon Redshift. @@ -72,0 +73 @@ You can configure other IAM roles in your account to self-setup their Amazon Sag + 4. Add the inline policy to allow this role to pass itself to other services. @@ -74,5 +75 @@ You can configure other IAM roles in your account to self-setup their Amazon Sag - - - 1. Add the inline policy to allow this role to pass itself to other services. - - 2. Add a trust policy: Allow Amazon SageMaker Unified Studio and related services to assume this Execution IAM role. + 5. Add a trust policy: Allow Amazon SageMaker Unified Studio and related services to assume this Execution IAM role.