AWS neptune documentation change

Service: neptune · 2026-03-07 · Documentation low

File: neptune/latest/userguide/ml-manual-setup-notebooks.md

Summary

Added detailed IAM policy JSON example for Neptune ML notebook setup permissions

Security assessment

The change adds documentation about required IAM permissions but does not address a specific security vulnerability. It improves security documentation by showing least-privilege permissions.

Diff

diff --git a/neptune/latest/userguide/ml-manual-setup-notebooks.md b/neptune/latest/userguide/ml-manual-setup-notebooks.md
index 6cec89293..fa8f8a295 100644
--- a//neptune/latest/userguide/ml-manual-setup-notebooks.md
+++ b//neptune/latest/userguide/ml-manual-setup-notebooks.md
@@ -35,0 +36,74 @@ You can also configure a default Neptune notebook for use with Neptune ML by fol
+JSON
+    
+
+****
+    
+    
+        {
+      "Version":"2012-10-17",		 	 	 
+      "Statement": [
+        {
+          "Action": [
+            "cloudwatch:PutMetricData"
+          ],
+          "Resource": "arn:aws:cloudwatch:us-east-1:111122223333:*",
+          "Sid": "AllowPutMetrics",
+          "Effect": "Allow"
+        },
+        {
+          "Action": [
+            "logs:CreateLogGroup",
+            "logs:CreateLogStream",
+            "logs:DescribeLogStreams",
+            "logs:PutLogEvents",
+            "logs:GetLogEvents"
+          ],
+          "Resource": "arn:aws:logs:us-east-1:111122223333:*",
+          "Sid": "AllowCreateLogs",
+          "Effect": "Allow"
+        },
+        {
+          "Action": [
+            "s3:Put*",
+            "s3:Get*",
+            "s3:List*"
+          ],
+          "Resource": "arn:aws:s3:::*",
+          "Sid": "AllowS3Actions",
+          "Effect": "Allow"
+        },
+        {
+          "Action": "execute-api:Invoke",
+          "Resource": "arn:aws:execute-api:us-east-1:111122223333:*/*",
+          "Sid": "AllowExecute",
+          "Effect": "Allow"
+        },
+        {
+          "Action": [
+            "sagemaker:CreateModel",
+            "sagemaker:CreateEndpointConfig",
+            "sagemaker:CreateEndpoint",
+            "sagemaker:DescribeModel",
+            "sagemaker:DescribeEndpointConfig",
+            "sagemaker:DescribeEndpoint",
+            "sagemaker:DeleteModel",
+            "sagemaker:DeleteEndpointConfig",
+            "sagemaker:DeleteEndpoint"
+          ],
+          "Resource": "arn:aws:sagemaker:us-east-1:111122223333:*/*",
+          "Sid": "AllowApiActions",
+          "Effect": "Allow"
+        },
+        {
+          "Action": [
+            "iam:PassRole"
+          ],
+          "Resource": "arn:aws:iam::111122223333:role/role-name",
+          "Sid": "AllowPassRole",
+          "Effect": "Allow"
+        }
+      ]
+    }
+    
+    
+