AWS sagemaker medium security documentation change

Service: sagemaker · 2026-05-31 · Security-related medium

File: sagemaker/latest/dg/sagemaker-roles.md

Summary

Removed 'kms:Encrypt' permission from IAM policy examples for processing and training jobs with KMS keys.

Security assessment

Explicit removal of encryption permissions follows least-privilege principles. This directly addresses potential over-permissioning security risks by reducing unnecessary KMS access.

Diff

diff --git a/sagemaker/latest/dg/sagemaker-roles.md b/sagemaker/latest/dg/sagemaker-roles.md
index 50bbf7449..cf7e095ad 100644
--- a//sagemaker/latest/dg/sagemaker-roles.md
+++ b//sagemaker/latest/dg/sagemaker-roles.md
@@ -1188 +1187,0 @@ If you specify a KMS key in the output configuration of your processing job, add
-        "kms:Encrypt",
@@ -1361 +1359,0 @@ If you specify a KMS key in the output configuration of your training job, add t
-        "kms:Encrypt",