AmazonSageMakerFullAccess

Last Modified

Mar 12, 2026

March 12, 2026 at 09:28 PM UTC

Version

v29

Total Versions

25

Created

Feb 12, 2026

Actions

204

Risk

High

An unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

  • High

    Can take over existing resources that run as another role

    Grants every action of 3 documented escalation paths on any resource with no condition, and 1 more in a scoped form.

    • codebuild-002codebuild:StartBuildunrestricted
    • sagemaker-004sagemaker:CreatePresignedNotebookInstanceUrlunrestricted
    • sagemaker-005sagemaker:CreateNotebookInstanceLifecycleConfig + sagemaker:StopNotebookInstance + sagemaker:UpdateNotebookInstance + sagemaker:StartNotebookInstanceunrestricted
    • stepfunctions-002states:UpdateStateMachine + states:StartExecutionscoped
      • states:UpdateStateMachine: on arn:aws:states:*:*:statemachine:*sagemaker*, arn:aws:states:*:*:execution:*sagemaker*:*
      • states:StartExecution: on arn:aws:states:*:*:statemachine:*sagemaker*, arn:aws:states:*:*:execution:*sagemaker*:*

    Use with caution: List the roles attached to the functions, instances, pipelines or notebooks it can modify: the holder effectively has them too.

  • Medium

    Can launch resources that run as a more privileged role

    Grants the actions of 5 documented escalation paths, but only on named resources or under a condition. Review that scope before trusting it.

    • glue-003iam:PassRole + glue:CreateJob + glue:StartJobRunscoped
      • iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/*AmazonSageMaker*
    • glue-005iam:PassRole + glue:UpdateJob + glue:StartJobRunscoped
      • iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/*AmazonSageMaker*
    • sagemaker-001iam:PassRole + sagemaker:CreateNotebookInstancescoped
      • iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/*AmazonSageMaker*
    • sagemaker-002iam:PassRole + sagemaker:CreateTrainingJobscoped
      • iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/*AmazonSageMaker*
    • sagemaker-003iam:PassRole + sagemaker:CreateProcessingJobscoped
      • iam:PassRole: condition iam:PassedToService, on arn:aws:iam::*:role/*AmazonSageMaker*

    Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.

  • Medium

    Can rewrite resource policies and sharing

    Grants 3 permissions management actions across 2 services (ec2, logs) on any resource, enough to share resources outside the account.

    ec2:createnetworkinterfacepermissionec2:deletenetworkinterfacepermissionlogs:putresourcepolicy

    Use with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.

  • Medium

    Full access to 3 services on every resource

    Uses groundtruthlabeling:*, sagemaker:*, sagemaker-geospatial:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.

    groundtruthlabeling:*sagemaker:*sagemaker-geospatial:*

    Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.

IAM Access Analyzer (2)

  • Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA

    The 13719 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs

  • Error / INVALID_SERVICE_IN_ACTION

    The service elastic-inference:Connect specified in the action does not exist. AWS docs

Policy Document

View on GitHub
{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "AllowAllNonAdminSageMakerActions",
          "Effect": "Allow",
          "Action": [
            "sagemaker:*",
            "sagemaker-geospatial:*"
          ],
          "NotResource": [
            "arn:aws:sagemaker:*:*:domain/*",
            "arn:aws:sagemaker:*:*:user-profile/*",
            "arn:aws:sagemaker:*:*:app/*",
            "arn:aws:sagemaker:*:*:space/*",
            "arn:aws:sagemaker:*:*:partner-app/*",
            "arn:aws:sagemaker:*:*:flow-definition/*",
            "arn:aws:sagemaker:*:*:training-plan/*",
            "arn:aws:sagemaker:*:*:reserved-capacity/*"
          ]
        },
        {
          "Sid": "AllowAddTagsForSpace",
          "Effect": "Allow",
          "Action": [
            "sagemaker:AddTags"
          ],
          "Resource": [
            "arn:aws:sagemaker:*:*:space/*"
          ],
          "Condition": {
            "StringEquals": {
              "sagemaker:TaggingAction": "CreateSpace"
            }
          }
        },
        {
          "Sid": "AllowAddTagsForApp",
          "Effect": "Allow",
          "Action": [
            "sagemaker:AddTags"
          ],
          "Resource": [
            "arn:aws:sagemaker:*:*:app/*"
          ]
        },
        {
          "Sid": "AllowUseOfTrainingPlanResources",
          "Effect": "Allow",
          "Action": [
            "sagemaker:CreateTrainingJob",
            "sagemaker:CreateCluster",
            "sagemaker:UpdateCluster",
            "sagemaker:DescribeTrainingPlan"
          ],
          "Resource": [
            "arn:aws:sagemaker:*:*:training-plan/*",
            "arn:aws:sagemaker:*:*:reserved-capacity/*"
          ]
        },
        {
          "Sid": "AllowStudioActions",
          "Effect": "Allow",
          "Action": [
            "sagemaker:CreatePresignedDomainUrl",
            "sagemaker:DescribeDomain",
            "sagemaker:ListDomains",
            "sagemaker:DescribeUserProfile",
            "sagemaker:ListUserProfiles",
            "sagemaker:DescribeSpace",
            "sagemaker:ListSpaces",
            "sagemaker:DescribeApp",
            "sagemaker:ListApps"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AllowAppActionsForUserProfile",
          "Effect": "Allow",
          "Action": [
            "sagemaker:CreateApp",
            "sagemaker:DeleteApp"
          ],
          "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*",
          "Condition": {
            "Null": {
              "sagemaker:OwnerUserProfileArn": "true"
            }
          }
        },
        {
          "Sid": "AllowAppActionsForSharedSpaces",
          "Effect": "Allow",
          "Action": [
            "sagemaker:CreateApp",
            "sagemaker:DeleteApp"
          ],
          "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*",
          "Condition": {
            "StringEquals": {
              "sagemaker:SpaceSharingType": [
                "Shared"
              ]
            }
          }
        },
        {
          "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner",
          "Effect": "Allow",
          "Action": [
            "sagemaker:CreateSpace",
            "sagemaker:UpdateSpace",
            "sagemaker:DeleteSpace"
          ],
          "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*",
          "Condition": {
            "Null": {
              "sagemaker:OwnerUserProfileArn": "true"
            }
          }
        },
        {
          "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile",
          "Effect": "Allow",
          "Action": [
            "sagemaker:CreateSpace",
            "sagemaker:UpdateSpace",
            "sagemaker:DeleteSpace"
          ],
          "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*",
          "Condition": {
            "ArnLike": {
              "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}"
            },
            "StringEquals": {
              "sagemaker:SpaceSharingType": [
                "Private",
                "Shared"
              ]
            }
          }
        },
        {
          "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile",
          "Effect": "Allow",
          "Action": [
            "sagemaker:CreateApp",
            "sagemaker:DeleteApp"
          ],
          "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*",
          "Condition": {
            "ArnLike": {
              "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}"
            },
            "StringEquals": {
              "sagemaker:SpaceSharingType": [
                "Private"
              ]
            }
          }
        },
        {
          "Sid": "AllowFlowDefinitionActions",
          "Effect": "Allow",
          "Action": "sagemaker:*",
          "Resource": [
            "arn:aws:sagemaker:*:*:flow-definition/*"
          ],
          "Condition": {
            "StringEqualsIfExists": {
              "sagemaker:WorkteamType": [
                "private-crowd",
                "vendor-crowd"
              ]
            }
          }
        },
        {
          "Sid": "AllowAWSServiceActions",
          "Effect": "Allow",
          "Action": [
            "application-autoscaling:DeleteScalingPolicy",
            "application-autoscaling:DeleteScheduledAction",
            "application-autoscaling:DeregisterScalableTarget",
            "application-autoscaling:DescribeScalableTargets",
            "application-autoscaling:DescribeScalingActivities",
            "application-autoscaling:DescribeScalingPolicies",
            "application-autoscaling:DescribeScheduledActions",
            "application-autoscaling:PutScalingPolicy",
            "application-autoscaling:PutScheduledAction",
            "application-autoscaling:RegisterScalableTarget",
            "aws-marketplace:ViewSubscriptions",
            "cloudformation:GetTemplateSummary",
            "cloudwatch:DeleteAlarms",
            "cloudwatch:DescribeAlarms",
            "cloudwatch:GetMetricData",
            "cloudwatch:GetMetricStatistics",
            "cloudwatch:ListMetrics",
            "cloudwatch:PutMetricAlarm",
            "cloudwatch:PutMetricData",
            "codecommit:BatchGetRepositories",
            "codecommit:CreateRepository",
            "codecommit:GetRepository",
            "codecommit:List*",
            "cognito-idp:AdminAddUserToGroup",
            "cognito-idp:AdminCreateUser",
            "cognito-idp:AdminDeleteUser",
            "cognito-idp:AdminDisableUser",
            "cognito-idp:AdminEnableUser",
            "cognito-idp:AdminRemoveUserFromGroup",
            "cognito-idp:CreateGroup",
            "cognito-idp:CreateUserPool",
            "cognito-idp:CreateUserPoolClient",
            "cognito-idp:CreateUserPoolDomain",
            "cognito-idp:DescribeUserPool",
            "cognito-idp:DescribeUserPoolClient",
            "cognito-idp:List*",
            "cognito-idp:UpdateUserPool",
            "cognito-idp:UpdateUserPoolClient",
            "ec2:CreateNetworkInterface",
            "ec2:CreateNetworkInterfacePermission",
            "ec2:CreateVpcEndpoint",
            "ec2:DeleteNetworkInterface",
            "ec2:DeleteNetworkInterfacePermission",
            "ec2:DescribeDhcpOptions",
            "ec2:DescribeNetworkInterfaces",
            "ec2:DescribeRouteTables",
            "ec2:DescribeSecurityGroups",
            "ec2:DescribeSubnets",
            "ec2:DescribeVpcEndpoints",
            "ec2:DescribeVpcs",
            "ecr:BatchCheckLayerAvailability",
            "ecr:BatchGetImage",
            "ecr:CreateRepository",
            "ecr:Describe*",
            "ecr:GetAuthorizationToken",
            "ecr:GetDownloadUrlForLayer",
            "ecr:StartImageScan",
            "elastic-inference:Connect",
            "elasticfilesystem:DescribeFileSystems",
            "elasticfilesystem:DescribeMountTargets",
            "fsx:DescribeFileSystems",
            "glue:CreateJob",
            "glue:DeleteJob",
            "glue:GetJob*",
            "glue:GetTable*",
            "glue:GetWorkflowRun",
            "glue:ResetJobBookmark",
            "glue:StartJobRun",
            "glue:StartWorkflowRun",
            "glue:UpdateJob",
            "groundtruthlabeling:*",
            "iam:ListRoles",
            "kms:DescribeKey",
            "kms:ListAliases",
            "lambda:ListFunctions",
            "logs:CreateLogDelivery",
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:DeleteLogDelivery",
            "logs:Describe*",
            "logs:GetLogDelivery",
            "logs:GetLogEvents",
            "logs:ListLogDeliveries",
            "logs:PutLogEvents",
            "logs:PutResourcePolicy",
            "logs:UpdateLogDelivery",
            "robomaker:CreateSimulationApplication",
            "robomaker:DescribeSimulationApplication",
            "robomaker:DeleteSimulationApplication",
            "robomaker:CreateSimulationJob",
            "robomaker:DescribeSimulationJob",
            "robomaker:CancelSimulationJob",
            "secretsmanager:ListSecrets",
            "servicecatalog:Describe*",
            "servicecatalog:List*",
            "servicecatalog:ScanProvisionedProducts",
            "servicecatalog:SearchProducts",
            "servicecatalog:SearchProvisionedProducts",
            "sns:ListTopics",
            "tag:GetResources"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AllowECRActions",
          "Effect": "Allow",
          "Action": [
            "ecr:SetRepositoryPolicy",
            "ecr:CompleteLayerUpload",
            "ecr:BatchDeleteImage",
            "ecr:UploadLayerPart",
            "ecr:DeleteRepositoryPolicy",
            "ecr:InitiateLayerUpload",
            "ecr:DeleteRepository",
            "ecr:PutImage"
          ],
          "Resource": [
            "arn:aws:ecr:*:*:repository/*sagemaker*"
          ]
        },
        {
          "Sid": "AllowCodeCommitActions",
          "Effect": "Allow",
          "Action": [
            "codecommit:GitPull",
            "codecommit:GitPush"
          ],
          "Resource": [
            "arn:aws:codecommit:*:*:*sagemaker*",
            "arn:aws:codecommit:*:*:*SageMaker*",
            "arn:aws:codecommit:*:*:*Sagemaker*"
          ]
        },
        {
          "Sid": "AllowCodeBuildActions",
          "Action": [
            "codebuild:BatchGetBuilds",
            "codebuild:StartBuild"
          ],
          "Resource": [
            "arn:aws:codebuild:*:*:project/sagemaker*",
            "arn:aws:codebuild:*:*:build/*"
          ],
          "Effect": "Allow"
        },
        {
          "Sid": "AllowStepFunctionsActions",
          "Action": [
            "states:DescribeExecution",
            "states:GetExecutionHistory",
            "states:StartExecution",
            "states:StopExecution",
            "states:UpdateStateMachine"
          ],
          "Resource": [
            "arn:aws:states:*:*:statemachine:*sagemaker*",
            "arn:aws:states:*:*:execution:*sagemaker*:*"
          ],
          "Effect": "Allow"
        },
        {
          "Sid": "AllowSecretManagerActions",
          "Effect": "Allow",
          "Action": [
            "secretsmanager:DescribeSecret",
            "secretsmanager:GetSecretValue",
            "secretsmanager:CreateSecret"
          ],
          "Resource": [
            "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*"
          ]
        },
        {
          "Sid": "AllowReadOnlySecretManagerActions",
          "Effect": "Allow",
          "Action": [
            "secretsmanager:DescribeSecret",
            "secretsmanager:GetSecretValue"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "secretsmanager:ResourceTag/SageMaker": "true"
            }
          }
        },
        {
          "Sid": "AllowServiceCatalogProvisionProduct",
          "Effect": "Allow",
          "Action": [
            "servicecatalog:ProvisionProduct"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct",
          "Effect": "Allow",
          "Action": [
            "servicecatalog:TerminateProvisionedProduct",
            "servicecatalog:UpdateProvisionedProduct"
          ],
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "servicecatalog:userLevel": "self"
            }
          }
        },
        {
          "Sid": "AllowS3ObjectActions",
          "Effect": "Allow",
          "Action": [
            "s3:GetObject",
            "s3:PutObject",
            "s3:DeleteObject",
            "s3:AbortMultipartUpload"
          ],
          "Resource": [
            "arn:aws:s3:::*SageMaker*",
            "arn:aws:s3:::*Sagemaker*",
            "arn:aws:s3:::*sagemaker*",
            "arn:aws:s3:::*aws-glue*"
          ]
        },
        {
          "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag",
          "Effect": "Allow",
          "Action": [
            "s3:GetObject"
          ],
          "Resource": [
            "arn:aws:s3:::*"
          ],
          "Condition": {
            "StringEqualsIgnoreCase": {
              "s3:ExistingObjectTag/SageMaker": "true"
            }
          }
        },
        {
          "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag",
          "Effect": "Allow",
          "Action": [
            "s3:GetObject"
          ],
          "Resource": [
            "arn:aws:s3:::*"
          ],
          "Condition": {
            "StringEquals": {
              "s3:ExistingObjectTag/servicecatalog:provisioning": "true"
            }
          }
        },
        {
          "Sid": "AllowS3BucketActions",
          "Effect": "Allow",
          "Action": [
            "s3:CreateBucket",
            "s3:GetBucketLocation",
            "s3:ListBucket",
            "s3:ListAllMyBuckets",
            "s3:GetBucketCors",
            "s3:PutBucketCors"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AllowS3BucketACL",
          "Effect": "Allow",
          "Action": [
            "s3:GetBucketAcl",
            "s3:PutObjectAcl"
          ],
          "Resource": [
            "arn:aws:s3:::*SageMaker*",
            "arn:aws:s3:::*Sagemaker*",
            "arn:aws:s3:::*sagemaker*"
          ]
        },
        {
          "Sid": "AllowLambdaInvokeFunction",
          "Effect": "Allow",
          "Action": [
            "lambda:InvokeFunction"
          ],
          "Resource": [
            "arn:aws:lambda:*:*:function:*SageMaker*",
            "arn:aws:lambda:*:*:function:*sagemaker*",
            "arn:aws:lambda:*:*:function:*Sagemaker*",
            "arn:aws:lambda:*:*:function:*LabelingFunction*"
          ]
        },
        {
          "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling",
          "Action": "iam:CreateServiceLinkedRole",
          "Effect": "Allow",
          "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint",
          "Condition": {
            "StringLike": {
              "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com"
            }
          }
        },
        {
          "Sid": "AllowCreateServiceLinkedRoleForRobomaker",
          "Effect": "Allow",
          "Action": "iam:CreateServiceLinkedRole",
          "Resource": "*",
          "Condition": {
            "StringEquals": {
              "iam:AWSServiceName": "robomaker.amazonaws.com"
            }
          }
        },
        {
          "Sid": "AllowSNSActions",
          "Effect": "Allow",
          "Action": [
            "sns:Subscribe",
            "sns:CreateTopic",
            "sns:Publish"
          ],
          "Resource": [
            "arn:aws:sns:*:*:*SageMaker*",
            "arn:aws:sns:*:*:*Sagemaker*",
            "arn:aws:sns:*:*:*sagemaker*"
          ]
        },
        {
          "Sid": "AllowPassRoleForSageMakerRoles",
          "Effect": "Allow",
          "Action": [
            "iam:PassRole"
          ],
          "Resource": "arn:aws:iam::*:role/*AmazonSageMaker*",
          "Condition": {
            "StringEquals": {
              "iam:PassedToService": [
                "glue.amazonaws.com",
                "robomaker.amazonaws.com",
                "states.amazonaws.com"
              ]
            }
          }
        },
        {
          "Sid": "AllowPassRoleToSageMaker",
          "Effect": "Allow",
          "Action": [
            "iam:PassRole"
          ],
          "Resource": "arn:aws:iam::*:role/*",
          "Condition": {
            "StringEquals": {
              "iam:PassedToService": "sagemaker.amazonaws.com"
            }
          }
        },
        {
          "Sid": "AllowAthenaActions",
          "Effect": "Allow",
          "Action": [
            "athena:ListDataCatalogs",
            "athena:ListDatabases",
            "athena:ListTableMetadata",
            "athena:GetQueryExecution",
            "athena:GetQueryResults",
            "athena:StartQueryExecution",
            "athena:StopQueryExecution"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Sid": "AllowGlueCreateTable",
          "Effect": "Allow",
          "Action": [
            "glue:CreateTable"
          ],
          "Resource": [
            "arn:aws:glue:*:*:table/*/sagemaker_tmp_*",
            "arn:aws:glue:*:*:table/sagemaker_featurestore/*",
            "arn:aws:glue:*:*:catalog",
            "arn:aws:glue:*:*:database/*"
          ]
        },
        {
          "Sid": "AllowGlueUpdateTable",
          "Effect": "Allow",
          "Action": [
            "glue:UpdateTable"
          ],
          "Resource": [
            "arn:aws:glue:*:*:table/sagemaker_featurestore/*",
            "arn:aws:glue:*:*:catalog",
            "arn:aws:glue:*:*:database/sagemaker_featurestore"
          ]
        },
        {
          "Sid": "AllowGlueDeleteTable",
          "Effect": "Allow",
          "Action": [
            "glue:DeleteTable"
          ],
          "Resource": [
            "arn:aws:glue:*:*:table/*/sagemaker_tmp_*",
            "arn:aws:glue:*:*:catalog",
            "arn:aws:glue:*:*:database/*"
          ]
        },
        {
          "Sid": "AllowGlueGetTablesAndDatabases",
          "Effect": "Allow",
          "Action": [
            "glue:GetDatabases",
            "glue:GetTable",
            "glue:GetTables"
          ],
          "Resource": [
            "arn:aws:glue:*:*:table/*",
            "arn:aws:glue:*:*:catalog",
            "arn:aws:glue:*:*:database/*"
          ]
        },
        {
          "Sid": "AllowGlueGetAndCreateDatabase",
          "Effect": "Allow",
          "Action": [
            "glue:CreateDatabase",
            "glue:GetDatabase"
          ],
          "Resource": [
            "arn:aws:glue:*:*:catalog",
            "arn:aws:glue:*:*:database/sagemaker_featurestore",
            "arn:aws:glue:*:*:database/sagemaker_processing",
            "arn:aws:glue:*:*:database/default",
            "arn:aws:glue:*:*:database/sagemaker_data_wrangler"
          ]
        },
        {
          "Sid": "AllowRedshiftDataActions",
          "Effect": "Allow",
          "Action": [
            "redshift-data:ExecuteStatement",
            "redshift-data:DescribeStatement",
            "redshift-data:CancelStatement",
            "redshift-data:GetStatementResult",
            "redshift-data:ListSchemas",
            "redshift-data:ListTables"
          ],
          "Resource": [
            "*"
          ]
        },
        {
          "Sid": "AllowRedshiftGetClusterCredentials",
          "Effect": "Allow",
          "Action": [
            "redshift:GetClusterCredentials"
          ],
          "Resource": [
            "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*",
            "arn:aws:redshift:*:*:dbname:*"
          ]
        },
        {
          "Sid": "AllowListTagsForUserProfile",
          "Effect": "Allow",
          "Action": [
            "sagemaker:ListTags"
          ],
          "Resource": [
            "arn:aws:sagemaker:*:*:user-profile/*"
          ]
        },
        {
          "Sid": "AllowCloudformationListStackResources",
          "Effect": "Allow",
          "Action": [
            "cloudformation:ListStackResources"
          ],
          "Resource": "arn:aws:cloudformation:*:*:stack/SC-*"
        },
        {
          "Sid": "AllowS3ExpressObjectActions",
          "Effect": "Allow",
          "Action": [
            "s3express:CreateSession"
          ],
          "Resource": [
            "arn:aws:s3express:*:*:bucket/*SageMaker*",
            "arn:aws:s3express:*:*:bucket/*Sagemaker*",
            "arn:aws:s3express:*:*:bucket/*sagemaker*",
            "arn:aws:s3express:*:*:bucket/*aws-glue*"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        },
        {
          "Sid": "AllowS3ExpressCreateBucketActions",
          "Effect": "Allow",
          "Action": [
            "s3express:CreateBucket"
          ],
          "Resource": [
            "arn:aws:s3express:*:*:bucket/*SageMaker*",
            "arn:aws:s3express:*:*:bucket/*Sagemaker*",
            "arn:aws:s3express:*:*:bucket/*sagemaker*"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        },
        {
          "Sid": "AllowS3ExpressListBucketActions",
          "Effect": "Allow",
          "Action": [
            "s3express:ListAllMyDirectoryBuckets"
          ],
          "Resource": "*"
        }
      ]
    },
    "VersionId": "v29",
    "IsDefaultVersion": true,
    "CreateDate": "2026-02-12T17:58:32+00:00"
  }
}

Version History (30 recorded)

Raw history

AmazonSageMakerFullAccess - Policy Version v29

No recorded action delta - this version predates the change index. View the raw diff.

Mar 12, 2026

f7c1262

AmazonSageMakerFullAccess - Policy Version v29

No recorded action delta - this version predates the change index. View the raw diff.

Feb 12, 2026

9041260

AmazonSageMakerFullAccess - Policy Version v28

No recorded action delta - this version predates the change index. View the raw diff.

Feb 12, 2026

ee5ee57

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Dec 4, 2024

c6b5269

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Sep 18, 2024

aafbae9

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

May 13, 2024

1b36617

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Mar 29, 2024

98f48a8

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Nov 30, 2023

90abd3c

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Nov 30, 2022

d4de1eb

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Jun 29, 2022

6f555ab

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

May 2, 2022

b123112

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Sep 8, 2021

303f1cb

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Jul 16, 2021

e7085da

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Jul 16, 2021

accd90e

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Feb 24, 2021

b9e9613

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Dec 1, 2020

01d8bcb

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Jun 3, 2020

25fe43d

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Jan 14, 2020

595ac90

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Dec 3, 2019

1c2c035

Update detected

No recorded action delta - this version predates the change index. View the raw diff.

Oct 30, 2019

222a3ad