AWS sagemaker-unified-studio documentation change

Service: sagemaker-unified-studio · 2026-03-25 · Documentation medium

File: sagemaker-unified-studio/latest/adminguide/sagemaker-unified-studio-provisioned-resources-key-permissions.md

Summary

Updated KMS key policy to include additional log groups in encryption context and added new grant permissions for Airflow services.

Security assessment

This change expands KMS key policies to include Airflow-related log groups and adds CreateGrant permissions for Airflow services, which enhances encryption and access control documentation but doesn't indicate a security fix.

Diff

diff --git a/sagemaker-unified-studio/latest/adminguide/sagemaker-unified-studio-provisioned-resources-key-permissions.md b/sagemaker-unified-studio/latest/adminguide/sagemaker-unified-studio-provisioned-resources-key-permissions.md
index 4238bffed..3613635e5 100644
--- a//sagemaker-unified-studio/latest/adminguide/sagemaker-unified-studio-provisioned-resources-key-permissions.md
+++ b//sagemaker-unified-studio/latest/adminguide/sagemaker-unified-studio-provisioned-resources-key-permissions.md
@@ -36 +36,5 @@ JSON
-                        "kms:EncryptionContext:aws:logs:arn": "arn:aws:logs:us-east-1:111122223333:log-group:datazone-*"
+                        "kms:EncryptionContext:aws:logs:arn": [
+                            "arn:aws:logs:us-east-1:111122223333:log-group:datazone-*",
+                            "arn:aws:logs:us-east-1:111122223333:log-group:airflow-*",
+                            "arn:aws:logs:us-east-1:111122223333:log-group:aws/mwaa-serverless*"
+                        ]
@@ -102,0 +107,20 @@ JSON
+            {
+                "Sid": "AirflowCreateGrantKmsPermissions",
+                "Effect": "Allow",
+                "Principal": {
+                    "AWS": "arn:aws:iam::111122223333:role/service-role/AmazonSageMakerProvisioning-111122223333"
+                },
+                "Action": "kms:CreateGrant",
+                "Resource": "*",
+                "Condition": {
+                    "StringEquals": {
+                        "aws:ResourceAccount": "${aws:PrincipalAccount}"
+                    },
+                    "StringLike": {
+                        "kms:ViaService": [
+                            "airflow.*.amazonaws.com",
+                            "airflow-serverless.*.amazonaws.com"
+                        ]
+                    }
+                }
+            },