AWS sagemaker documentation change

Service: sagemaker · 2026-01-22 · Documentation medium

File: sagemaker/latest/dg/remote-access-remote-setup-vpc-subnets-without-internet-access.md

Summary

Added VPC endpoint policy recommendations with aws:PrincipalIsAWSService condition to restrict access to AWS services

Security assessment

Introduces security best practices for endpoint policies to prevent unauthorized access, but doesn't address any specific vulnerability or incident. The aws:PrincipalIsAWSService condition reduces attack surface by limiting access to AWS services

Diff

diff --git a/sagemaker/latest/dg/remote-access-remote-setup-vpc-subnets-without-internet-access.md b/sagemaker/latest/dg/remote-access-remote-setup-vpc-subnets-without-internet-access.md
index 8f758d16c..483617e82 100644
--- a//sagemaker/latest/dg/remote-access-remote-setup-vpc-subnets-without-internet-access.md
+++ b//sagemaker/latest/dg/remote-access-remote-setup-vpc-subnets-without-internet-access.md
@@ -26 +26,3 @@ You can configure Amazon SageMaker Studio to run in VPC only mode with subnets w
-**VPC PrivateLink requirements** When SageMaker AI runs in private subnets, configure these SSM VPC endpoints in addition to standard VPC endpoints required for SageMaker. For more information, see [Connect Studio Through a VPC Endpoint](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-interface-endpoint.html).
+### VPC PrivateLink requirements
+
+When SageMaker AI runs in private subnets, configure these SSM VPC endpoints in addition to standard VPC endpoints required for SageMaker. For more information, see [Connect Studio Through a VPC Endpoint](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-interface-endpoint.html).
@@ -34,0 +37,66 @@ You can configure Amazon SageMaker Studio to run in VPC only mode with subnets w
+**VPC endpoint policy recommendations**
+
+The following are the recommended VPC endpoint policies that allow the necessary actions for remote access while using the `aws:PrincipalIsAWSService` condition to ensure only AWS services like Amazon SageMaker AI can make the calls. For more information about the `aws:PrincipalIsAWSService` condition key, see [the documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalisawsservice).
+
+**SSM endpoint policy**
+
+Use the following policy for the `com.amazonaws.`REGION`.ssm` endpoint:
+    
+    
+    {
+        "Version": "2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Principal": "*",
+                "Action": [
+                    "ssm:CreateActivation",
+                    "ssm:RegisterManagedInstance",
+                    "ssm:DeleteActivation",
+                    "ssm:DeregisterManagedInstance",
+                    "ssm:AddTagsToResource",
+                    "ssm:UpdateInstanceInformation",
+                    "ssm:UpdateInstanceAssociationStatus",
+                    "ssm:DescribeInstanceInformation",
+                    "ssm:ListInstanceAssociations",
+                    "ssm:ListAssociations",
+                    "ssm:GetDocument",
+                    "ssm:PutInventory"
+                ],
+                "Resource": "*",
+                "Condition": {
+                    "BoolIfExists": {
+                        "aws:PrincipalIsAWSService": "true"
+                    }
+                }
+            }
+        ]
+    }
+
+**SSM Messages endpoint policy**
+
+Use the following policy for the `com.amazonaws.`REGION`.ssmmessages` endpoint:
+    
+    
+    {
+        "Version": "2012-10-17",		 	 	 
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Principal": "*",
+                "Action": [
+                    "ssmmessages:CreateControlChannel",
+                    "ssmmessages:CreateDataChannel",
+                    "ssmmessages:OpenControlChannel",
+                    "ssmmessages:OpenDataChannel"
+                ],
+                "Resource": "*",
+                "Condition": {
+                    "BoolIfExists": {
+                        "aws:PrincipalIsAWSService": "true"
+                    }
+                }
+            }
+        ]
+    }
+