SageMakerStudioDomainExecutionRolePolicy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "DataZonePermissions",
          "Effect": "Allow",
          "Action": [
            "datazone:AcceptPredictions",
            "datazone:AcceptSubscriptionRequest",
            "datazone:AddEntityOwner",
            "datazone:AddPolicyGrant",
            "datazone:AssociateGovernedTerms",
            "datazone:BatchGetAttributesMetadata",
            "datazone:BatchPutAttributesMetadata",
            "datazone:BatchUpdateNotifications",
            "datazone:CancelMetadataGenerationRun",
            "datazone:CancelSubscription",
            "datazone:CreateAsset",
            "datazone:CreateAssetFilter",
            "datazone:CreateAssetRevision",
            "datazone:CreateAssetType",
            "datazone:CreateConnection",
            "datazone:CreateDataProduct",
            "datazone:CreateDataProductRevision",
            "datazone:CreateDataSource",
            "datazone:CreateDomainUnit",
            "datazone:CreateEnvironment",
            "datazone:CreateEnvironmentProfile",
            "datazone:CreateFormType",
            "datazone:CreateGlossary",
            "datazone:CreateGlossaryTerm",
            "datazone:CreateListingChangeSet",
            "datazone:CreateProject",
            "datazone:CreateProjectMembership",
            "datazone:CreateRule",
            "datazone:CreateSubscriptionGrant",
            "datazone:CreateSubscriptionRequest",
            "datazone:DeleteAsset",
            "datazone:DeleteAssetFilter",
            "datazone:DeleteAssetType",
            "datazone:DeleteConnection",
            "datazone:DeleteDataProduct",
            "datazone:DeleteDataSource",
            "datazone:DeleteDomainUnit",
            "datazone:DeleteEnvironment",
            "datazone:DeleteEnvironmentProfile",
            "datazone:DeleteFormType",
            "datazone:DeleteGlossary",
            "datazone:DeleteGlossaryTerm",
            "datazone:DeleteListing",
            "datazone:DeleteProject",
            "datazone:DeleteProjectMembership",
            "datazone:DeleteRule",
            "datazone:DeleteSubscriptionGrant",
            "datazone:DeleteSubscriptionRequest",
            "datazone:DeleteSubscriptionTarget",
            "datazone:DeleteTimeSeriesDataPoints",
            "datazone:DisassociateGovernedTerms",
            "datazone:GetAsset",
            "datazone:GetAssetFilter",
            "datazone:GetAssetType",
            "datazone:GetConnection",
            "datazone:GetCurrentEffectivePolicy",
            "datazone:GetDataProduct",
            "datazone:GetDataSource",
            "datazone:GetDataSourceRun",
            "datazone:GetDesignation",
            "datazone:GetDomain",
            "datazone:GetDomainUnit",
            "datazone:GetEnvironment",
            "datazone:GetEnvironmentAction",
            "datazone:GetEnvironmentActionLink",
            "datazone:GetEnvironmentBlueprint",
            "datazone:GetEnvironmentBlueprintConfiguration",
            "datazone:GetEnvironmentCredentials",
            "datazone:GetEnvironmentProfile",
            "datazone:GetFormType",
            "datazone:GetGlossary",
            "datazone:GetGlossaryTerm",
            "datazone:GetGroupProfile",
            "datazone:GetLineageNode",
            "datazone:GetListing",
            "datazone:GetMetadataGenerationRun",
            "datazone:GetProject",
            "datazone:GetRule",
            "datazone:GetSubscription",
            "datazone:GetSubscriptionEligibility",
            "datazone:GetSubscriptionGrant",
            "datazone:GetSubscriptionRequestDetails",
            "datazone:GetSubscriptionTarget",
            "datazone:GetTimeSeriesDataPoint",
            "datazone:GetUpdateEligibility",
            "datazone:GetUserProfile",
            "datazone:ListAccountEnvironments",
            "datazone:ListAssetFilters",
            "datazone:ListAssetRevisions",
            "datazone:ListConnections",
            "datazone:ListDataProductRevisions",
            "datazone:ListDataSourceRunActivities",
            "datazone:ListDataSourceRuns",
            "datazone:ListDataSources",
            "datazone:ListDesignations",
            "datazone:ListDomainUnitsForParent",
            "datazone:ListEntityOwners",
            "datazone:ListEnvironmentActions",
            "datazone:ListEnvironmentBlueprintConfigurationSummaries",
            "datazone:ListEnvironmentBlueprintConfigurations",
            "datazone:ListEnvironmentBlueprints",
            "datazone:ListEnvironmentProfiles",
            "datazone:ListEnvironments",
            "datazone:ListGroupsForUser",
            "datazone:ListLineageNodeHistory",
            "datazone:ListMetadataGenerationRuns",
            "datazone:ListNotifications",
            "datazone:ListPolicyGrants",
            "datazone:ListProjectMemberships",
            "datazone:ListProjects",
            "datazone:ListRules",
            "datazone:ListSubscriptionGrants",
            "datazone:ListSubscriptionRequests",
            "datazone:ListSubscriptionTargets",
            "datazone:ListSubscriptions",
            "datazone:ListTimeSeriesDataPoints",
            "datazone:ListWarehouseMetadata",
            "datazone:QueryGraph",
            "datazone:RejectPredictions",
            "datazone:RejectSubscriptionRequest",
            "datazone:RemoveEntityOwner",
            "datazone:RemovePolicyGrant",
            "datazone:RevokeSubscription",
            "datazone:Search",
            "datazone:SearchGroupProfiles",
            "datazone:SearchListings",
            "datazone:SearchRules",
            "datazone:SearchTypes",
            "datazone:SearchUserProfiles",
            "datazone:StartDataSourceRun",
            "datazone:StartMetadataGenerationRun",
            "datazone:UpdateAssetFilter",
            "datazone:UpdateConnection",
            "datazone:UpdateDataSource",
            "datazone:UpdateDomainUnit",
            "datazone:UpdateEnvironment",
            "datazone:UpdateEnvironmentDeploymentStatus",
            "datazone:UpdateEnvironmentProfile",
            "datazone:UpdateGlossary",
            "datazone:UpdateGlossaryTerm",
            "datazone:UpdateProject",
            "datazone:UpdateRule",
            "datazone:UpdateSubscriptionGrantStatus",
            "datazone:UpdateSubscriptionRequest"
          ],
          "Resource": "*"
        },
        {
          "Sid": "RAMResourceShareStatement",
          "Effect": "Allow",
          "Action": [
            "ram:GetResourceShareAssociations",
            "ram:GetResourceShares"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AmazonQPermissionsStatement",
          "Effect": "Allow",
          "Action": [
            "q:StartConversation",
            "q:SendMessage",
            "q:ListConversations",
            "q:GetConversation",
            "q:PassRequest",
            "q:GetIdentityMetadata",
            "glue:StartCompletion",
            "glue:GetCompletion"
          ],
          "Resource": "*"
        },
        {
          "Sid": "AllowSetTrustedIdentity",
          "Effect": "Allow",
          "Action": [
            "sts:SetContext"
          ],
          "Resource": "arn:aws:sts::*:self"
        },
        {
          "Sid": "SSMGetParameterStatement",
          "Effect": "Allow",
          "Action": [
            "ssm:GetParameter"
          ],
          "Resource": [
            "arn:aws:ssm:*:*:parameter/amazon/datazone/q/${aws:PrincipalTag/datazone-domainId}*",
            "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/${aws:PrincipalTag/datazone-domainId}/*"
          ],
          "Condition": {
            "StringEquals": {
              "aws:ResourceAccount": "${aws:PrincipalAccount}"
            }
          }
        },
        {
          "Sid": "GetCodeConnectionsPermissionsStatement",
          "Effect": "Allow",
          "Action": [
            "codeconnections:GetConnection",
            "codeconnections:GetHost",
            "codestar-connections:GetConnection",
            "codestar-connections:GetHost"
          ],
          "Resource": "*",
          "Condition": {
            "Null": {
              "aws:ResourceTag/for-use-with-all-datazone-projects": "false"
            },
            "StringEquals": {
              "aws:ResourceTag/for-use-with-all-datazone-projects": "true"
            }
          }
        },
        {
          "Sid": "ListCodeConnectionsPermissionsStatement",
          "Effect": "Allow",
          "Action": [
            "codeconnections:ListConnections",
            "codeconnections:ListTagsForResource",
            "codestar-connections:ListConnections",
            "codestar-connections:ListTagsForResource"
          ],
          "Resource": "*"
        },
        {
          "Sid": "UseCodeConnectionsPermissionsStatement",
          "Effect": "Allow",
          "Action": [
            "codeconnections:UseConnection",
            "codestar-connections:UseConnection"
          ],
          "Resource": "*",
          "Condition": {
            "Null": {
              "aws:ResourceTag/for-use-with-all-datazone-projects": "false"
            },
            "StringEquals": {
              "aws:ResourceTag/for-use-with-all-datazone-projects": "true"
            }
          }
        },
        {
          "Sid": "ProjectProfilePermissionsStatement",
          "Effect": "Allow",
          "Action": [
            "datazone:GetProjectProfile",
            "datazone:ListProjectProfiles"
          ],
          "Resource": "arn:aws:datazone:*:*:domain/*"
        },
        {
          "Sid": "AccountPoolPermissionsStatement",
          "Effect": "Allow",
          "Action": [
            "datazone:GetAccountPool",
            "datazone:ListAccountPools",
            "datazone:ListAccountsInAccountPool"
          ],
          "Resource": "arn:aws:datazone:*:*:domain/*"
        }
      ]
    },
    "VersionId": "v23",
    "IsDefaultVersion": true,
    "CreateDate": "2026-08-12T17:27:19+00:00"
  }
}