AWS braket documentation change
Summary
Modified S3 permissions in three managed policies to support ABAC-enabled buckets with 'AmazonBraket: true' tag
Security assessment
Changes explicitly document added ABAC (Attribute-Based Access Control) support through S3 resource tagging. This improves security documentation by enabling fine-grained access but doesn't indicate vulnerability remediation.
Diff
diff --git a/braket/latest/developerguide/security-iam-aws-managed-policies.md b/braket/latest/developerguide/security-iam-aws-managed-policies.md index 90130d1c3..b2395edf8 100644 --- a//braket/latest/developerguide/security-iam-aws-managed-policies.md +++ b//braket/latest/developerguide/security-iam-aws-managed-policies.md @@ -44 +44 @@ The **AmazonBraketFullAccess** policy grants permissions for Amazon Braket opera - * **Create and store data in Amazon S3 buckets, and list all buckets** – To create S3 buckets, list the S3 buckets in your account, and put objects into and get objects from any bucket in your account whose name begins with _amazon-braket-_. These permissions are required for Braket to put files containing results from processed quantum tasks into the bucket and to retrieve them from the bucket. + * **Create and store data in Amazon S3 buckets, and list all buckets** – To create S3 buckets, list the S3 buckets in your account, and put objects into and get objects from any bucket in your account whose name begins with _amazon-braket-_ or that is [ABAC-enabled](https://docs.aws.amazon.com/AmazonS3/latest/userguide/buckets-tagging-enable-abac.html) and tagged with `"AmazonBraket": "true"`. These permissions are required for Braket to put files containing results from processed quantum tasks into the bucket and to retrieve them from the bucket. @@ -67 +67 @@ The **AmazonBraketJobsExecutionPolicy** policy grants permissions for execution - * **Store data in Amazon S3 buckets** – List the S3 buckets in your account, put objects into and get objects from any bucket in your account that starts with _amazon-braket-_ in its name. These permissions are required for Braket to put files containing results from processed quantum tasks into the bucket, and to retrieve them from the bucket. + * **Store data in Amazon S3 buckets** – List the S3 buckets in your account, put objects into and get objects from any bucket in your account that starts with _amazon-braket-_ in its name or that is [ABAC-enabled](https://docs.aws.amazon.com/AmazonS3/latest/userguide/buckets-tagging-enable-abac.html) and tagged with `"AmazonBraket": "true"`. These permissions are required for Braket to put files containing results from processed quantum tasks into the bucket, and to retrieve them from the bucket. @@ -80 +80 @@ The **AmazonBraketServiceRolePolicy** policy grants permissions for Amazon Brake - * **Amazon S3** – permissions to list the buckets in your account, and put objects into and get objects from any bucket in your account with a name that starts with `amazon-braket-`. + * **Amazon S3** – permissions to list the buckets in your account, and put objects into and get objects from any bucket in your account with a name that starts with `amazon-braket-` or that is [ABAC-enabled](https://docs.aws.amazon.com/AmazonS3/latest/userguide/buckets-tagging-enable-abac.html) and tagged with `"AmazonBraket": "true"`. @@ -96,0 +97,3 @@ The following table provides details about updates to AWS managed policies for A +AmazonBraketFullAccess \- Full access policy for Braket | Added Amazon S3 permissions for arbitrarily-named buckets with the **"aws:ResourceAccount": "${aws:PrincipalAccount}"** and **"aws:ResourceTag/AmazonBraket": "true"** condition scope. | July 6, 2026 +AmazonBraketJobsExecutionPolicy \- Jobs execution policy | Added Amazon S3 permissions for arbitrarily-named buckets with the **"aws:ResourceTag/AmazonBraket": "true"** condition scope. | July 6, 2026 +AmazonBraketServiceRolePolicy \- Resource management policy | Added Amazon S3 permissions for arbitrarily-named buckets with the **"aws:ResourceAccount": "${aws:PrincipalAccount}"** and **"aws:ResourceTag/AmazonBraket": "true"** condition scope. | July 6, 2026