AWS bedrock documentation change
Summary
Updated IAM policy documentation: Removed two SageMaker permissions, changed resource ARNs to use wildcard partition, and clarified policy recommendations.
Security assessment
This change updates IAM policy examples which are security configurations, but there's no evidence of addressing a specific vulnerability. The removal of sagemaker:CreateInferenceComponent and sagemaker:DeleteInferenceComponent permissions reduces attack surface, but isn't tied to a disclosed security issue. The ARN format change (arn:aws → arn:*) enhances cross-partition compatibility without security implications.
Diff
diff --git a/bedrock/latest/userguide/setup-amazon-bedrock-marketplace.md b/bedrock/latest/userguide/setup-amazon-bedrock-marketplace.md index 552fec511..76e3732bd 100644 --- a//bedrock/latest/userguide/setup-amazon-bedrock-marketplace.md +++ b//bedrock/latest/userguide/setup-amazon-bedrock-marketplace.md @@ -11,7 +11 @@ You can use the [Amazon Bedrock Full Access policy](https://docs.aws.amazon.com/ -The following are the permissions provided by the Amazon Bedrock Full Access policy. - -JSON - - -**** - +The following is a recommended custom policy for Amazon Bedrock Marketplace. For the latest version of the Amazon Bedrock Full Access managed policy, see [AmazonBedrockFullAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonBedrockFullAccess.html). @@ -57,2 +50,0 @@ JSON - "sagemaker:CreateInferenceComponent", - "sagemaker:DeleteInferenceComponent", @@ -63,3 +55,3 @@ JSON - "arn:aws:sagemaker:*:*:endpoint/*", - "arn:aws:sagemaker:*:*:endpoint-config/*", - "arn:aws:sagemaker:*:*:model/*" + "arn:*:sagemaker:*:*:endpoint/*", + "arn:*:sagemaker:*:*:endpoint-config/*", + "arn:*:sagemaker:*:*:model/*" @@ -81,3 +73,3 @@ JSON - "arn:aws:sagemaker:*:*:endpoint/*", - "arn:aws:sagemaker:*:*:endpoint-config/*", - "arn:aws:sagemaker:*:*:model/*" + "arn:*:sagemaker:*:*:endpoint/*", + "arn:*:sagemaker:*:*:endpoint-config/*", + "arn:*:sagemaker:*:*:model/*" @@ -98,3 +90,3 @@ JSON - "arn:aws:sagemaker:*:*:endpoint/*", - "arn:aws:sagemaker:*:*:endpoint-config/*", - "arn:aws:sagemaker:*:*:model/*" + "arn:*:sagemaker:*:*:endpoint/*", + "arn:*:sagemaker:*:*:endpoint-config/*", + "arn:*:sagemaker:*:*:model/*" @@ -116 +108 @@ JSON - "arn:aws:sagemaker:*:*:endpoint/*" + "arn:*:sagemaker:*:*:endpoint/*" @@ -131,2 +123,2 @@ JSON - "arn:aws:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*", - "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" + "arn:*:sagemaker:*:aws:hub-content/SageMakerPublicHub/Model/*", + "arn:*:sagemaker:*:aws:hub/SageMakerPublicHub" @@ -141 +133 @@ JSON - "Resource": "arn:aws:sagemaker:*:aws:hub/SageMakerPublicHub" + "Resource": "arn:*:sagemaker:*:aws:hub/SageMakerPublicHub" @@ -160 +152 @@ JSON - "arn:aws:iam::*:role/*Sagemaker*ForBedrock*" + "arn:*:iam::*:role/*Sagemaker*ForBedrock*" @@ -177 +169 @@ JSON - "Resource": "arn:aws:iam::*:role/*AmazonBedrock*", + "Resource": "arn:*:iam::*:role/*AmazonBedrock*",