SageMakerStudioFullAccess
Last Modified
Mar 12, 2026
March 12, 2026 at 09:29 PM UTC
Version
v15
Total Versions
5
Created
Feb 12, 2026
Actions
67
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can rewrite resource policies and sharing
Grants 4 permissions management actions across 1 service (datazone) on any resource, enough to share resources outside the account.
datazone:addpolicygrantdatazone:deletedomainsharingpolicydatazone:putdomainsharingpolicydatazone:removepolicygrantUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Full datazone access on every resource
Uses datazone:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
datazone:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonDataZoneStatement",
"Effect": "Allow",
"Action": [
"datazone:*"
],
"Resource": [
"*"
]
},
{
"Sid": "ReadOnlyStatement",
"Effect": "Allow",
"Action": [
"kms:DescribeKey",
"kms:ListAliases",
"iam:ListRoles",
"iam:ListPolicies",
"sso:DescribeRegisteredRegions",
"s3:ListAllMyBuckets",
"redshift:DescribeClusters",
"redshift-serverless:ListWorkgroups",
"ec2:DescribeSecurityGroups",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"secretsmanager:ListSecrets",
"iam:ListUsers",
"glue:GetDatabases",
"codeconnections:ListConnections",
"codeconnections:ListTagsForResource",
"codewhisperer:ListProfiles",
"bedrock:ListInferenceProfiles",
"bedrock:ListFoundationModels",
"bedrock:ListTagsForResource",
"aoss:ListSecurityPolicies",
"quicksight:DescribeAccountSubscription",
"cloudformation:ValidateTemplate"
],
"Resource": [
"*"
]
},
{
"Sid": "BucketReadOnlyStatement",
"Effect": "Allow",
"Action": [
"s3:ListBucket",
"s3:GetBucketLocation",
"s3:ListBucketVersions"
],
"Resource": "arn:aws:s3:::*"
},
{
"Sid": "ReadManagedBlueprintTemplatesStatement",
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": [
"arn:aws:s3:::default-env-blueprint-*/*",
"arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint*"
],
"Condition": {
"ArnLike": {
"s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint"
},
"StringNotEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "CreateBucketStatement",
"Effect": "Allow",
"Action": [
"s3:CreateBucket"
],
"Resource": [
"arn:aws:s3:::amazon-datazone*",
"arn:aws:s3:::amazon-sagemaker*"
]
},
{
"Sid": "ConfigureBucketStatement",
"Effect": "Allow",
"Action": [
"s3:PutBucketCORS",
"s3:PutBucketPolicy",
"s3:PutBucketVersioning"
],
"Resource": [
"arn:aws:s3:::amazon-sagemaker*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "PutObjectStatement",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject"
],
"Resource": [
"arn:aws:s3:::amazon-sagemaker*/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "RamCreateResourceStatement",
"Effect": "Allow",
"Action": [
"ram:CreateResourceShare"
],
"Resource": "*",
"Condition": {
"StringEqualsIfExists": {
"ram:RequestedResourceType": "datazone:Domain"
}
}
},
{
"Sid": "RamResourceStatement",
"Effect": "Allow",
"Action": [
"ram:DeleteResourceShare",
"ram:AssociateResourceShare",
"ram:DisassociateResourceShare",
"ram:RejectResourceShareInvitation"
],
"Resource": "*",
"Condition": {
"StringLike": {
"ram:ResourceShareName": [
"DataZone*"
]
}
}
},
{
"Sid": "RamResourceReadOnlyStatement",
"Effect": "Allow",
"Action": [
"ram:GetResourceShares",
"ram:GetResourceShareInvitations",
"ram:GetResourceShareAssociations",
"ram:ListResourceSharePermissions"
],
"Resource": "*"
},
{
"Sid": "RamAssociateResourceSharePermissionStatement",
"Effect": "Allow",
"Action": "ram:AssociateResourceSharePermission",
"Resource": "*",
"Condition": {
"StringEquals": {
"ram:PermissionArn": [
"arn:aws:ram::aws:permission/AWSRAMDefaultPermissionAmazonDataZoneDomain",
"arn:aws:ram::aws:permission/AWSRAMPermissionAmazonDataZoneDomainFullAccessWithPortalAccess",
"arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceAccess",
"arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceWithPortalAccess"
]
}
}
},
{
"Sid": "IAMPassRoleStatement",
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": [
"arn:aws:iam::*:role/AmazonDataZone*",
"arn:aws:iam::*:role/service-role/AmazonDataZone*",
"arn:aws:iam::*:role/service-role/AmazonSageMaker*"
],
"Condition": {
"StringEquals": {
"iam:passedToService": "datazone.amazonaws.com"
}
}
},
{
"Sid": "IAMGetPolicyStatement",
"Effect": "Allow",
"Action": "iam:GetPolicy",
"Resource": [
"arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*"
]
},
{
"Sid": "DataZoneTagOnCreateDomainProjectTags",
"Effect": "Allow",
"Action": [
"secretsmanager:TagResource"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"AmazonDataZoneDomain",
"AmazonDataZoneProject"
]
},
"StringLike": {
"aws:RequestTag/AmazonDataZoneDomain": "dzd*",
"aws:ResourceTag/AmazonDataZoneDomain": "dzd*"
}
}
},
{
"Sid": "DataZoneTagOnCreate",
"Effect": "Allow",
"Action": [
"secretsmanager:TagResource"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"AmazonDataZoneDomain"
]
},
"StringLike": {
"aws:RequestTag/AmazonDataZoneDomain": "dzd*",
"aws:ResourceTag/AmazonDataZoneDomain": "dzd*"
}
}
},
{
"Sid": "CreateSecretStatement",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
"Condition": {
"StringLike": {
"aws:RequestTag/AmazonDataZoneDomain": "dzd*"
}
}
},
{
"Sid": "ConnectionStatement",
"Effect": "Allow",
"Action": [
"codeconnections:GetConnection"
],
"Resource": [
"arn:aws:codeconnections:*:*:connection/*"
]
},
{
"Sid": "TagCodeConnectionsStatement",
"Effect": "Allow",
"Action": [
"codeconnections:TagResource"
],
"Resource": [
"arn:aws:codeconnections:*:*:connection/*",
"arn:aws:codeconnections:*:*:host/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": [
"for-use-with-all-datazone-projects"
]
},
"StringEquals": {
"aws:RequestTag/for-use-with-all-datazone-projects": "true"
}
}
},
{
"Sid": "UntagCodeConnectionsStatement",
"Effect": "Allow",
"Action": [
"codeconnections:UntagResource"
],
"Resource": [
"arn:aws:codeconnections:*:*:connection/*",
"arn:aws:codeconnections:*:*:host/*"
],
"Condition": {
"ForAllValues:StringEquals": {
"aws:TagKeys": "for-use-with-all-datazone-projects"
}
}
},
{
"Sid": "SSMParameterStatement",
"Effect": "Allow",
"Action": [
"ssm:GetParameter",
"ssm:GetParametersByPath",
"ssm:PutParameter",
"ssm:DeleteParameter"
],
"Resource": [
"arn:aws:ssm:*:*:parameter/amazon/datazone/q*",
"arn:aws:ssm:*:*:parameter/amazon/datazone/genAI*",
"arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*"
]
},
{
"Sid": "UseKMSKeyPermissionsStatement",
"Effect": "Allow",
"Action": [
"kms:Decrypt"
],
"Resource": [
"*"
],
"Condition": {
"StringEquals": {
"aws:ResourceTag/EnableKeyForAmazonDataZone": "true"
},
"Null": {
"aws:ResourceTag/EnableKeyForAmazonDataZone": "false"
},
"StringLike": {
"kms:ViaService": "ssm.*.amazonaws.com"
}
}
},
{
"Sid": "SecurityPolicyStatement",
"Effect": "Allow",
"Action": [
"aoss:GetSecurityPolicy",
"aoss:CreateSecurityPolicy"
],
"Resource": [
"*"
],
"Condition": {
"StringLike": {
"aoss:collection": "bedrock-ide-*"
}
}
},
{
"Sid": "GetFoundationModelStatement",
"Effect": "Allow",
"Action": [
"bedrock:GetFoundationModel",
"bedrock:GetFoundationModelAvailability"
],
"Resource": [
"arn:aws:bedrock:*::foundation-model/*"
]
},
{
"Sid": "GetInferenceProfileStatement",
"Effect": "Allow",
"Action": [
"bedrock:GetInferenceProfile"
],
"Resource": [
"arn:aws:bedrock:*:*:inference-profile/*",
"arn:aws:bedrock:*:*:application-inference-profile/*"
]
},
{
"Sid": "ApplicationInferenceProfileStatement",
"Effect": "Allow",
"Action": [
"bedrock:CreateInferenceProfile"
],
"Resource": [
"arn:aws:bedrock:*:*:application-inference-profile/*"
],
"Condition": {
"Null": {
"aws:RequestTag/AmazonDataZoneProject": "true",
"aws:RequestTag/AmazonDataZoneDomain": "false"
}
}
},
{
"Sid": "TagApplicationInferenceProfileStatement",
"Effect": "Allow",
"Action": [
"bedrock:TagResource"
],
"Resource": [
"arn:aws:bedrock:*:*:application-inference-profile/*"
],
"Condition": {
"Null": {
"aws:ResourceTag/AmazonDataZoneProject": "true",
"aws:RequestTag/AmazonDataZoneProject": "true",
"aws:ResourceTag/AmazonDataZoneDomain": "false",
"aws:RequestTag/AmazonDataZoneDomain": "false"
}
}
},
{
"Sid": "DeleteApplicationInferenceProfileStatement",
"Effect": "Allow",
"Action": [
"bedrock:DeleteInferenceProfile"
],
"Resource": [
"arn:aws:bedrock:*:*:application-inference-profile/*"
],
"Condition": {
"Null": {
"aws:ResourceTag/AmazonDataZoneProject": "true",
"aws:ResourceTag/AmazonDataZoneDomain": "false"
}
}
},
{
"Sid": "ModelAccessUseCaseStatement",
"Effect": "Allow",
"Action": [
"bedrock:GetUseCaseForModelAccess",
"bedrock:PutUseCaseForModelAccess"
],
"Resource": [
"*"
]
}
]
},
"VersionId": "v15",
"IsDefaultVersion": true,
"CreateDate": "2026-02-12T18:00:59+00:00"
}
}Version History (8 recorded)
Raw historyv15updated
scope changed, no action added or removed
SageMakerStudioFullAccess - Policy Version v15
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
ca65d8bSageMakerStudioFullAccess - Policy Version v10
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
937ad81SageMakerStudioFullAccess - Policy Version v5
No recorded action delta - this version predates the change index. View the raw diff.
Jul 23, 2025
748910cUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 6, 2025
2c1c73bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 22, 2025
11f6eabUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 21, 2025
f4fe72fUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 28, 2024
d4034d5