SageMakerStudioAdminIAMConsolePolicy
Last Modified
Aug 26, 2026
August 26, 2026 at 11:03 PM UTC
Version
v9
Total Versions
5
Created
Aug 26, 2026
Actions
71
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can launch resources that run as a more privileged role
Grants the actions of 1 documented escalation path, but only on named resources or under a condition. Review that scope before trusting it.
- iam:PassRole: condition iam:passedToService, on arn:aws:iam::*:role/service-role/AmazonSageMaker*
Use with caution: Check which roles, users or policies fall inside the scope shown above. Within it the escalation works as documented, so keep privileged principals out of it.
- Medium
Can rewrite resource policies and sharing
Grants 4 permissions management actions across 1 service (datazone) on any resource, enough to share resources outside the account.
datazone:addpolicygrantdatazone:deletedomainsharingpolicydatazone:putdomainsharingpolicydatazone:removepolicygrantUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Full datazone access on every resource
Uses datazone:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
datazone:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonDataZoneStatement",
"Effect": "Allow",
"Action": [
"datazone:*"
],
"Resource": [
"*"
]
},
{
"Sid": "ReadOnlyStatement",
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"iam:GetRole",
"iam:GetUser"
],
"Resource": [
"*"
]
},
{
"Sid": "IAMPassRoleStatement",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonSageMaker*"
],
"Condition": {
"StringEquals": {
"iam:passedToService": "datazone.amazonaws.com"
}
}
},
{
"Sid": "SSMParameterStatement",
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:GetParametersByPath",
"ssm:PutParameter",
"ssm:DeleteParameter"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/amazon/datazone/q*"
]
},
{
"Sid": "DescribeEc2Permissions",
"Effect": "Allow",
"Action": [
"ec2:DescribeVpcs",
"ec2:DescribeSubnets",
"ec2:DescribeSecurityGroups",
"ec2:DescribeInternetGateways",
"ec2:DescribeAddresses",
"ec2:DescribeNatGateways",
"ec2:DescribeRouteTables",
"ec2:DescribeVpcEndpoints",
"ec2:DescribeVpcEndpointServices",
"ec2:DescribeAvailabilityZones"
],
"Resource": "*"
},
{
"Sid": "CreateTaggedEc2Resources",
"Effect": "Allow",
"Action": [
"ec2:CreateVpc"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateTaggedSubnet",
"Effect": "Allow",
"Action": [
"ec2:CreateSubnet"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateSubnetInTaggedVPC",
"Effect": "Allow",
"Action": [
"ec2:CreateSubnet"
],
"Resource": "arn:aws:ec2:*:*:vpc/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateTaggedSecurityGroup",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateTaggedSecurityGroupInVPC",
"Effect": "Allow",
"Action": [
"ec2:CreateSecurityGroup"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateTaggedVPCEndpoint",
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint"
],
"Resource": [
"arn:aws:ec2:*:*:vpc-endpoint/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateVPCEndpointInTaggedResources",
"Effect": "Allow",
"Action": [
"ec2:CreateVpcEndpoint"
],
"Resource": [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:vpc/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:route-table/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateInternetGateway",
"Effect": "Allow",
"Action": [
"ec2:CreateInternetGateway"
],
"Resource": "arn:aws:ec2:*:*:internet-gateway/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateTaggedNatGateway",
"Effect": "Allow",
"Action": [
"ec2:CreateNatGateway"
],
"Resource": [
"arn:aws:ec2:*:*:natgateway/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateNatGatewayInTaggedSubnet",
"Effect": "Allow",
"Action": [
"ec2:CreateNatGateway"
],
"Resource": [
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:elastic-ip/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateTaggedRouteTable",
"Effect": "Allow",
"Action": [
"ec2:CreateRouteTable"
],
"Resource": [
"arn:aws:ec2:*:*:route-table/*"
],
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateRouteTableInTaggedSubnet",
"Effect": "Allow",
"Action": [
"ec2:CreateRouteTable"
],
"Resource": [
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "AllocateAddress",
"Effect": "Allow",
"Action": [
"ec2:AllocateAddress"
],
"Resource": "arn:aws:ec2:*:*:elastic-ip/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "ModifyTaggedEc2Resources",
"Effect": "Allow",
"Action": [
"ec2:ModifyVpcAttribute",
"ec2:AuthorizeSecurityGroupIngress",
"ec2:AuthorizeSecurityGroupEgress",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "AttachInternetGateway",
"Effect": "Allow",
"Action": [
"ec2:AttachInternetGateway"
],
"Resource": [
"arn:aws:ec2:*:*:internet-gateway/*",
"arn:aws:ec2:*:*:vpc/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "CreateRoute",
"Effect": "Allow",
"Action": [
"ec2:CreateRoute"
],
"Resource": [
"arn:aws:ec2:*:*:route-table/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "AssociateRouteTable",
"Effect": "Allow",
"Action": [
"ec2:AssociateRouteTable"
],
"Resource": [
"arn:aws:ec2:*:*:route-table/*",
"arn:aws:ec2:*:*:subnet/*"
],
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "Ec2TaggingOperations",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true",
"ec2:CreateAction": [
"CreateVpc",
"CreateSubnet",
"CreateSecurityGroup",
"CreateInternetGateway",
"CreateNatGateway",
"CreateRouteTable",
"CreateVpcEndpoint"
]
}
}
},
{
"Sid": "Ec2TagEIP",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "arn:aws:ec2:*:*:elastic-ip/*",
"Condition": {
"StringEquals": {
"aws:RequestTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "AllowCFNStackCreation",
"Effect": "Allow",
"Action": [
"cloudformation:ListStacks",
"cloudformation:ListStackResources",
"cloudformation:CreateStack",
"cloudformation:GetTemplateSummary",
"cloudformation:DescribeStacks",
"cloudformation:DescribeStackEvents"
],
"Resource": "*"
},
{
"Sid": "CloudFormationTagOnCreate",
"Effect": "Allow",
"Action": [
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"cloudformation:CreateAction": [
"CreateStack"
]
}
}
},
{
"Sid": "DeleteTaggedVpcResources",
"Effect": "Allow",
"Action": [
"ec2:DeleteVpc",
"ec2:DeleteSubnet",
"ec2:DeleteSecurityGroup",
"ec2:DeleteInternetGateway",
"ec2:DetachInternetGateway",
"ec2:DeleteNatGateway",
"ec2:DisassociateRouteTable",
"ec2:DeleteVpcEndpoints",
"ec2:DeleteRouteTable",
"ec2:DeleteRoute",
"ec2:ReleaseAddress"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "DeleteTagsOnTaggedResources",
"Effect": "Allow",
"Action": "ec2:DeleteTags",
"Resource": "*",
"Condition": {
"StringEquals": {
"ec2:ResourceTag/CreatedForUseWithSageMakerUnifiedStudio": "true"
}
}
},
{
"Sid": "S3ReadCFNTemplate",
"Effect": "Allow",
"Action": [
"s3:GetObject"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:CalledViaFirst": "cloudformation.amazonaws.com"
},
"StringNotEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KMSReadPermissions",
"Effect": "Allow",
"Action": [
"kms:DescribeKey",
"kms:ListAliases"
],
"Resource": "*"
},
{
"Sid": "DataZoneKMSPermissions",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"kms:EncryptionContextKeys": "aws:datazone:domainId"
},
"StringLike": {
"kms:ViaService": "datazone.*.amazonaws.com"
}
}
},
{
"Sid": "DataZoneKMSGrantPermissions",
"Effect": "Allow",
"Action": [
"kms:CreateGrant"
],
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": "true"
},
"ForAnyValue:StringEquals": {
"kms:EncryptionContextKeys": "aws:datazone:domainId"
},
"StringLike": {
"kms:ViaService": "datazone.*.amazonaws.com"
}
}
},
{
"Sid": "GlueCatalogPermissions",
"Effect": "Allow",
"Action": [
"glue:GetCatalog"
],
"Resource": "*"
},
{
"Sid": "SSOApplicationPermissions",
"Effect": "Allow",
"Action": [
"sso:DeleteApplication"
],
"Resource": [
"arn:aws:sso::*:application/*/*"
],
"Condition": {
"Bool": {
"aws:ViaAWSService": "true"
},
"ForAnyValue:StringEquals": {
"aws:CalledVia": "datazone.amazonaws.com"
}
}
},
{
"Sid": "SSOKMSPermissions",
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": "*",
"Condition": {
"Null": {
"kms:EncryptionContext:aws:sso:instance-arn": "false"
},
"StringLike": {
"kms:ViaService": "sso.*.amazonaws.com"
}
}
}
]
},
"VersionId": "v9",
"IsDefaultVersion": true,
"CreateDate": "2026-08-26T22:47:07+00:00"
}
}Version History (8 recorded)
Raw historyv9updated
2 actions added
v8updated
1 action added
v7updated
scope changed, no action added or removed
SageMakerStudioAdminIAMConsolePolicy - Policy Version v7
No recorded action delta - this version predates the change index. View the raw diff.
Mar 5, 2026
c603f48SageMakerStudioAdminIAMConsolePolicy - Policy Version v6
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
c50e430SageMakerStudioAdminIAMConsolePolicy - Policy Version v4
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
7b2d61dSageMakerStudioAdminIAMConsolePolicy - Policy Version v2
No recorded action delta - this version predates the change index. View the raw diff.
Nov 17, 2025
320e78aSageMakerStudioAdminIAMConsolePolicy - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Aug 19, 2025
55c5fbf