AWS sagemaker medium security documentation change

Service: sagemaker · 2026-06-07 · Security-related medium

File: sagemaker/latest/dg/sagemaker-roles.md

Summary

Added 'kms:GenerateDataKey' permission requirement for AutoML jobs using KMS encryption.

Security assessment

Documents required cryptographic permission for proper KMS key usage, preventing encryption failures that could lead to data exposure.

Diff

diff --git a/sagemaker/latest/dg/sagemaker-roles.md b/sagemaker/latest/dg/sagemaker-roles.md
index cf7e095ad..516f9229c 100644
--- a//sagemaker/latest/dg/sagemaker-roles.md
+++ b//sagemaker/latest/dg/sagemaker-roles.md
@@ -570 +570,2 @@ If you specify a KMS key in the output configuration of your AutoML job, add the
-        "kms:Encrypt"
+        "kms:Encrypt",
+        "kms:GenerateDataKey"