AWS sagemaker-unified-studio documentation change
Summary
Clarified the tag for controlling SageMaker ML workload permissions, changing from 'EnableSageMakerMLWorkloads=false' to 'EnableSageMakerMLWorkloadsPermissions' with details on how it grants or denies permissions.
Security assessment
Provides clearer instructions on using tags to manage IAM policy permissions, improving security configuration documentation, but no evidence of a security issue is addressed.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md b/sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md index 6eed82f83..847da02aa 100644 --- a//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md +++ b//sagemaker-unified-studio/latest/adminguide/security-iam-awsmanpol-SageMakerStudioProjectRoleMachineLearningPolicy.md @@ -13 +13 @@ This is the SageMaker policy for the SageMakerUnifiedStudioProjectRole role. Thi -An administrator can disable certain permissions in this policy by tagging the role to which the policy is attached to. The tag EnableSageMakerMLWorkloads=false disables all SageMaker ML workloads related permissions. +An administrator can control certain permissions in this policy by tagging the role to which the policy is attached. The tag EnableSageMakerMLWorkloadsPermissions — when set to "true" (default), grants permissions for SageMaker ML workloads including training jobs, processing jobs, and model deployment. When not set to "true", these SageMaker ML workload permissions are not granted.