AWS sagemaker medium security documentation change

Service: sagemaker · 2026-05-10 · Security-related medium

File: sagemaker/latest/dg/sagemaker-roles.md

Summary

Added 'kms:DescribeKey' permission requirement for processing jobs and training jobs using volume KMS keys

Security assessment

The change explicitly adds a missing KMS permission required for cryptographic operations. Without DescribeKey permission, jobs using volume encryption would fail due to insufficient permissions, potentially causing operational issues. This addresses an access control gap in KMS key usage documentation.

Diff

diff --git a/sagemaker/latest/dg/sagemaker-roles.md b/sagemaker/latest/dg/sagemaker-roles.md
index be03b409d..820334189 100644
--- a//sagemaker/latest/dg/sagemaker-roles.md
+++ b//sagemaker/latest/dg/sagemaker-roles.md
@@ -1183 +1183,2 @@ If you specify a volume KMS key in the resource configuration of your processing
-        "kms:CreateGrant"
+        "kms:CreateGrant",
+        "kms:DescribeKey"
@@ -1354 +1355,2 @@ If you specify a volume KMS key in the resource configuration of your training j
-        "kms:CreateGrant"
+        "kms:CreateGrant",
+        "kms:DescribeKey"