AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary

AdminAWS managedActivePermissions reviewedShow on map Compare

Summary

The AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary policy is the list of permissions that are permitted on an execution role created in a SageMaker environment provisioned by Amazon DataZone.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
Default version: v13
Created: 2024-04-23
Last edited: 2026-07-17
Services: application-autoscaling, athena, aws-marketplace, cloudformation, cloudwatch, codebuild, codecommit, datazone, ec2, ecr, elasticfilesystem, elasticmapreduce, events, forecast, fsx, glue, groundtruthlabeling, iam, kms, lakeformation, lambda, logs, ram, rds, redshift, redshift-data, redshift-serverless, s3, sagemaker, sagemaker-geospatial, secretsmanager, servicecatalog, sns, sqlworkbench, sso, states, tag

Control-plane actions (1285)

By access level: 258 List, 33 Permissions management, 375 Read, 13 Tagging, 606 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Application Auto Scaling	10 of 14	4 Read, 6 Write; 0 restricted, 0 conditional	application-autoscaling:DeleteScalingPolicy, application-autoscaling:DeleteScheduledAction, application-autoscaling:DeregisterScalableTarget, application-autoscaling:DescribeScalableTargets, application-autoscaling:DescribeScalingActivities, application-autoscaling:DescribeScalingPolicies, application-autoscaling:DescribeScheduledActions, application-autoscaling:PutScalingPolicy, application-autoscaling:PutScheduledAction, application-autoscaling:RegisterScalableTarget
Athena	41 of 86	5 List, 17 Read, 19 Write; 0 restricted, 0 conditional	athena:BatchGetNamedQuery, athena:BatchGetPreparedStatement, athena:BatchGetQueryExecution, athena:CreateNamedQuery, athena:CreateNotebook, athena:CreatePreparedStatement, athena:CreatePresignedNotebookUrl, athena:DeleteNamedQuery, athena:DeleteNotebook, athena:DeletePreparedStatement, athena:ExportNotebook, athena:GetDataCatalog and 29 more
Marketplace	1 of 97	1 List; 0 restricted, 0 conditional	aws-marketplace:ViewSubscriptions
CloudFormation	2 of 104	1 List, 1 Read; 1 restricted, 0 conditional	cloudformation:GetTemplateSummary, cloudformation:ListStackResources
CloudWatch	3 of 160	1 Read, 2 Write; 0 restricted, 0 conditional	cloudwatch:DeleteAlarms, cloudwatch:DescribeAlarms, cloudwatch:PutMetricAlarm
CodeBuild	2 of 67	1 Read, 1 Write; 2 restricted, 0 conditional	codebuild:BatchGetBuilds, codebuild:StartBuild
CodeCommit	13 of 91	8 List, 3 Read, 2 Write; 2 restricted, 0 conditional	codecommit:BatchGetRepositories, codecommit:CreateRepository, codecommit:GetRepository, codecommit:GitPull, codecommit:GitPush, codecommit:List*
DataZone	All 278 actions (see the DataZone page)	55 List, 6 Permissions management, 62 Read, 2 Tagging, 153 Write; 0 restricted, 0 conditional	datazone:*
EC2	12 of 834	8 List, 2 Permissions management, 2 Write; 0 restricted, 0 conditional	ec2:CreateNetworkInterface, ec2:CreateNetworkInterfacePermission, ec2:DeleteNetworkInterface, ec2:DeleteNetworkInterfacePermission, ec2:DescribeDhcpOptions, ec2:DescribeNetworkInterfaces, ec2:DescribeRouteTables, ec2:DescribeSecurityGroups, ec2:DescribeSubnets, ec2:DescribeVpcEndpointServices, ec2:DescribeVpcEndpoints, ec2:DescribeVpcs
Elastic Container Registry	25 of 65	2 List, 2 Permissions management, 11 Read, 2 Tagging, 8 Write; 11 restricted, 0 conditional	ecr:BatchCheckLayerAvailability, ecr:BatchDeleteImage, ecr:BatchGetImage, ecr:CompleteLayerUpload, ecr:CreateRepository, ecr:DeleteRepository, ecr:DeleteRepositoryPolicy, ecr:Describe*, ecr:GetAuthorizationToken, ecr:GetDownloadUrlForLayer, ecr:InitiateLayerUpload, ecr:PutImage and 5 more
EFS	2 of 38	1 List, 1 Read; 0 restricted, 0 conditional	elasticfilesystem:DescribeFileSystems, elasticfilesystem:DescribeMountTargets
EMR	3 of 88	1 List, 2 Read; 0 restricted, 0 conditional	elasticmapreduce:DescribeCluster, elasticmapreduce:ListClusters, elasticmapreduce:ListInstanceGroups
EventBridge	5 of 71	1 List, 1 Read, 1 Tagging, 2 Write; 4 restricted, 4 conditional	events:DescribeRule, events:ListTagsForResource, events:PutRule, events:PutTargets, events:TagResource
Forecast	26 of 70	13 Read, 1 Tagging, 12 Write; 26 restricted, 0 conditional	forecast:CreateAutoPredictor, forecast:CreateDataset, forecast:CreateDatasetGroup, forecast:CreateDatasetImportJob, forecast:CreateExplainability, forecast:CreateExplainabilityExport, forecast:CreateForecast, forecast:CreateForecastEndpoint, forecast:CreateForecastExportJob, forecast:CreatePredictor, forecast:CreatePredictorBacktestExportJob, forecast:DeleteResourceTree and 14 more
FSx	1 of 56	1 Read; 0 restricted, 0 conditional	fsx:DescribeFileSystems
Glue	197 of 306	24 List, 20 Permissions management, 92 Read, 61 Write; 156 restricted, 34 conditional	glue:DataQuality, glue:BatchCreatePartition, glue:BatchDeleteConnection, glue:BatchDeletePartition, glue:BatchDeleteTable, glue:BatchDeleteTableVersion, glue:BatchGet*, glue:BatchGetJobs, glue:BatchGetWorkflows, glue:BatchStopJobRun, glue:BatchUpdatePartition, glue:CreateBlueprint and 58 more
GroundTruth Labeling	All 16 actions (see the GroundTruth Labeling page)	6 Read, 10 Write; 0 restricted, 0 conditional	groundtruthlabeling:*
IAM	4 of 190	1 List, 1 Read, 2 Write; 2 restricted, 2 conditional	iam:CreateServiceLinkedRole, iam:GetRole, iam:ListRoles, iam:PassRole
KMS	7 of 58	2 List, 1 Permissions management, 1 Read, 3 Write; 5 restricted, 5 conditional	kms:Decrypt, kms:DescribeKey, kms:Encrypt, kms:GenerateDataKey, kms:ListAliases, kms:ListKeys, kms:RetireGrant
Lake Formation	1 of 68	1 Write; 0 restricted, 0 conditional	lakeformation:GetDataAccess
Lambda	1 of 121	1 List; 0 restricted, 0 conditional	lambda:ListFunctions
CloudWatch Logs	11 of 133	3 List, 2 Read, 6 Write; 0 restricted, 0 conditional	logs:CreateLogDelivery, logs:CreateLogGroup, logs:CreateLogStream, logs:DeleteLogDelivery, logs:DescribeLogGroups, logs:DescribeLogStreams, logs:GetLogDelivery, logs:GetLogEvents, logs:ListLogDeliveries, logs:PutLogEvents, logs:UpdateLogDelivery
Resource Access Manager	1 of 39	1 Write; 1 restricted, 1 conditional	ram:AcceptResourceShareInvitation
RDS	1 of 173	1 List; 0 restricted, 0 conditional	rds:DescribeDBInstances
Redshift	4 of 167	1 List, 1 Permissions management, 2 Write; 4 restricted, 0 conditional	redshift:CreateClusterUser, redshift:DescribeClusters, redshift:GetClusterCredentials, redshift:GetClusterCredentialsWithIAM
Redshift Data API	8 of 12	1 List, 4 Read, 3 Write; 0 restricted, 0 conditional	redshift-data:BatchExecuteStatement, redshift-data:CancelStatement, redshift-data:DescribeStatement, redshift-data:DescribeTable, redshift-data:ExecuteStatement, redshift-data:GetStatementResult, redshift-data:ListSchemas, redshift-data:ListTables
Redshift Serverless	5 of 69	2 List, 2 Read, 1 Write; 0 restricted, 0 conditional	redshift-serverless:GetCredentials, redshift-serverless:GetNamespace, redshift-serverless:GetWorkgroup, redshift-serverless:ListNamespaces, redshift-serverless:ListWorkgroups
S3	6 of 155	1 List, 3 Read, 2 Write; 6 restricted, 0 conditional	s3:GetBucketAcl, s3:GetBucketCors, s3:GetBucketLocation, s3:ListAllMyBuckets, s3:PutBucketCors, s3:ReplicateObject
SageMaker	438 of 441	96 List, 97 Read, 2 Tagging, 243 Write; 0 restricted, 0 conditional	sagemaker:*, sagemaker:AddTags, sagemaker:CreateApp, sagemaker:CreatePresignedDomainUrl, sagemaker:CreateSpace, sagemaker:CreateUserProfile, sagemaker:DeleteApp, sagemaker:DeleteSpace, sagemaker:DescribeApp, sagemaker:DescribeDomain, sagemaker:DescribeSpace, sagemaker:DescribeUserProfile and 7 more
SageMaker geospatial capabilities	All 19 actions (see the SageMaker geospatial capabilities page)	4 List, 5 Read, 2 Tagging, 8 Write; 0 restricted, 0 conditional	sagemaker-geospatial:*
Secrets Manager	6 of 27	1 List, 1 Permissions management, 2 Read, 1 Tagging, 1 Write; 5 restricted, 1 conditional	secretsmanager:CreateSecret, secretsmanager:DescribeSecret, secretsmanager:GetSecretValue, secretsmanager:ListSecrets, secretsmanager:PutResourcePolicy, secretsmanager:TagResource
Service Catalog	46 of 117	27 List, 16 Read, 3 Write; 2 restricted, 2 conditional	servicecatalog:Describe, servicecatalog:List, servicecatalog:ProvisionProduct, servicecatalog:ScanProvisionedProducts, servicecatalog:SearchProducts, servicecatalog:SearchProvisionedProducts, servicecatalog:TerminateProvisionedProduct, servicecatalog:UpdateProvisionedProduct
SNS	3 of 40	1 List, 2 Write; 2 restricted, 0 conditional	sns:CreateTopic, sns:ListTopics, sns:Subscribe
SQL Workbench	All 79 actions (see the SQL Workbench page)	9 List, 23 Read, 2 Tagging, 45 Write; 0 restricted, 0 conditional	sqlworkbench:*
IAM Identity Center	2 of 126	2 Write; 0 restricted, 0 conditional	sso:AssociateProfile, sso:CreateApplicationAssignment
Step Functions	5 of 37	2 Read, 3 Write; 5 restricted, 0 conditional	states:DescribeExecution, states:GetExecutionHistory, states:StartExecution, states:StopExecution, states:UpdateStateMachine
Resource Group Tagging	1 of 9	1 Read; 0 restricted, 0 conditional	tag:GetResources

The full action list is in actions.json.

Data-plane actions (34)

By access level: 3 List, 1 Permissions management, 10 Read, 20 Write.

Data-plane actions by service
Service	Granted	Access levels and limits	Granted by
CloudWatch	4 of 5	1 List, 2 Read, 1 Write; 0 restricted, 0 conditional	cloudwatch:GetMetricData, cloudwatch:GetMetricStatistics, cloudwatch:ListMetrics, cloudwatch:PutMetricData
Lambda	1 of 14	1 Write; 1 restricted, 0 conditional	lambda:InvokeFunction
S3	9 of 25	1 List, 1 Permissions management, 1 Read, 6 Write; 9 restricted, 0 conditional	s3:AbortMultipartUpload, s3:DeleteObject, s3:DeleteObjectVersion, s3:GetObject, s3:ListBucket, s3:PutObject, s3:PutObjectAcl, s3:PutObjectRetention, s3:RestoreObject
SageMaker	All 19 actions (see the SageMaker page)	1 List, 7 Read, 11 Write; 0 restricted, 0 conditional	sagemaker:*
SNS	All 1 actions (see the SNS page)	1 Write; 1 restricted, 0 conditional	sns:Publish

The full action list is in actions.json.

Excluded and conditional actions

application-autoscaling:DeleteScalingPolicy (deny-not-action, statement 50): 1 matching actions
application-autoscaling:DeleteScheduledAction (deny-not-action, statement 50): 1 matching actions
application-autoscaling:DeregisterScalableTarget (deny-not-action, statement 50): 1 matching actions
application-autoscaling:DescribeScalableTargets (deny-not-action, statement 50): 1 matching actions
application-autoscaling:DescribeScalingActivities (deny-not-action, statement 50): 1 matching actions
application-autoscaling:DescribeScalingPolicies (deny-not-action, statement 50): 1 matching actions
application-autoscaling:DescribeScheduledActions (deny-not-action, statement 50): 1 matching actions
application-autoscaling:PutScalingPolicy (deny-not-action, statement 50): 1 matching actions
application-autoscaling:PutScheduledAction (deny-not-action, statement 50): 1 matching actions
application-autoscaling:RegisterScalableTarget (deny-not-action, statement 50): 1 matching actions
athena:BatchGetNamedQuery (deny-not-action, statement 50): 1 matching actions
athena:BatchGetPreparedStatement (deny-not-action, statement 50): 1 matching actions
athena:BatchGetQueryExecution (deny-not-action, statement 50): 1 matching actions
athena:CreateNamedQuery (deny-not-action, statement 50): 1 matching actions
athena:CreateNotebook (deny-not-action, statement 50): 1 matching actions
athena:CreatePreparedStatement (deny-not-action, statement 50): 1 matching actions
athena:CreatePresignedNotebookUrl (deny-not-action, statement 50): 1 matching actions
athena:DeleteNamedQuery (deny-not-action, statement 50): 1 matching actions
athena:DeleteNotebook (deny-not-action, statement 50): 1 matching actions
athena:DeletePreparedStatement (deny-not-action, statement 50): 1 matching actions
athena:ExportNotebook (deny-not-action, statement 50): 1 matching actions
athena:GetDataCatalog (deny-not-action, statement 50): 1 matching actions
athena:GetDatabase (deny-not-action, statement 50): 1 matching actions
athena:GetNamedQuery (deny-not-action, statement 50): 1 matching actions
athena:GetPreparedStatement (deny-not-action, statement 50): 1 matching actions
athena:GetQueryExecution (deny-not-action, statement 50): 1 matching actions
athena:GetQueryResults (deny-not-action, statement 50): 1 matching actions
athena:GetQueryResultsStream (deny-not-action, statement 50): 1 matching actions
athena:GetQueryRuntimeStatistics (deny-not-action, statement 50): 1 matching actions
athena:GetTableMetadata (deny-not-action, statement 50): 1 matching actions
athena:GetWorkGroup (deny-not-action, statement 50): 1 matching actions
athena:ImportNotebook (deny-not-action, statement 50): 1 matching actions
athena:ListDataCatalogs (deny-not-action, statement 50): 1 matching actions
athena:ListDatabases (deny-not-action, statement 50): 1 matching actions
athena:ListEngineVersions (deny-not-action, statement 50): 1 matching actions
athena:ListNamedQueries (deny-not-action, statement 50): 1 matching actions
athena:ListPreparedStatements (deny-not-action, statement 50): 1 matching actions
athena:ListQueryExecutions (deny-not-action, statement 50): 1 matching actions
athena:ListTableMetadata (deny-not-action, statement 50): 1 matching actions
athena:ListTagsForResource (deny-not-action, statement 50): 1 matching actions
athena:ListWorkGroups (deny-not-action, statement 50): 1 matching actions
athena:StartCalculationExecution (deny-not-action, statement 50): 1 matching actions
athena:StartQueryExecution (deny-not-action, statement 50): 1 matching actions
athena:StartSession (deny-not-action, statement 50): 1 matching actions
athena:StopCalculationExecution (deny-not-action, statement 50): 1 matching actions
athena:StopQueryExecution (deny-not-action, statement 50): 1 matching actions
athena:TerminateSession (deny-not-action, statement 50): 1 matching actions
athena:UpdateNamedQuery (deny-not-action, statement 50): 1 matching actions
athena:UpdateNotebook (deny-not-action, statement 50): 1 matching actions
athena:UpdateNotebookMetadata (deny-not-action, statement 50): 1 matching actions
athena:UpdatePreparedStatement (deny-not-action, statement 50): 1 matching actions
aws-marketplace:ViewSubscriptions (deny-not-action, statement 50): 1 matching actions
cloudformation:GetTemplateSummary (deny-not-action, statement 50): 1 matching actions
cloudformation:ListStackResources (deny-not-action, statement 50): 1 matching actions
cloudwatch:DeleteAlarms (deny-not-action, statement 50): 1 matching actions
cloudwatch:DescribeAlarms (deny-not-action, statement 50): 1 matching actions
cloudwatch:GetMetricData (deny-not-action, statement 50): 1 matching actions
cloudwatch:GetMetricStatistics (deny-not-action, statement 50): 1 matching actions
cloudwatch:ListMetrics (deny-not-action, statement 50): 1 matching actions
cloudwatch:PutMetricAlarm (deny-not-action, statement 50): 1 matching actions
cloudwatch:PutMetricData (deny-not-action, statement 50): 1 matching actions
codebuild:BatchGetBuilds (deny-not-action, statement 50): 1 matching actions
codebuild:StartBuild (deny-not-action, statement 50): 1 matching actions
codecommit:BatchGetRepositories (deny-not-action, statement 50): 1 matching actions
codecommit:CreateRepository (deny-not-action, statement 50): 1 matching actions
codecommit:GetRepository (deny-not-action, statement 50): 1 matching actions
codecommit:GitPull (deny-not-action, statement 50): 1 matching actions
codecommit:GitPush (deny-not-action, statement 50): 1 matching actions
codecommit:List* (deny-not-action, statement 50): 8 matching actions
datazone:* (deny-not-action, statement 50): 278 matching actions
ec2:CreateNetworkInterface (deny-not-action, statement 50): 1 matching actions
ec2:CreateNetworkInterfacePermission (deny-not-action, statement 50): 1 matching actions
ec2:DeleteNetworkInterface (deny-not-action, statement 50): 1 matching actions
ec2:DeleteNetworkInterfacePermission (deny-not-action, statement 50): 1 matching actions
ec2:DescribeDhcpOptions (deny-not-action, statement 50): 1 matching actions
ec2:DescribeNetworkInterfaces (deny-not-action, statement 50): 1 matching actions
ec2:DescribeRouteTables (deny-not-action, statement 50): 1 matching actions
ec2:DescribeSecurityGroups (deny-not-action, statement 50): 1 matching actions
ec2:DescribeSubnets (deny-not-action, statement 50): 1 matching actions
ec2:DescribeVpcEndpointServices (deny-not-action, statement 50): 1 matching actions
ec2:DescribeVpcEndpoints (deny-not-action, statement 50): 1 matching actions
ec2:DescribeVpcs (deny-not-action, statement 50): 1 matching actions
ecr:BatchCheckLayerAvailability (deny-not-action, statement 50): 1 matching actions
ecr:BatchDeleteImage (deny-not-action, statement 50): 1 matching actions
ecr:BatchGetImage (deny-not-action, statement 50): 1 matching actions
ecr:CompleteLayerUpload (deny-not-action, statement 50): 1 matching actions
ecr:CreateRepository (deny-not-action, statement 50): 1 matching actions
ecr:DeleteRepository (deny-not-action, statement 50): 1 matching actions
ecr:DeleteRepositoryPolicy (deny-not-action, statement 50): 1 matching actions
ecr:Describe* (deny-not-action, statement 50): 9 matching actions
ecr:GetAuthorizationToken (deny-not-action, statement 50): 1 matching actions
ecr:GetDownloadUrlForLayer (deny-not-action, statement 50): 1 matching actions
ecr:InitiateLayerUpload (deny-not-action, statement 50): 1 matching actions
ecr:PutImage (deny-not-action, statement 50): 1 matching actions
ecr:SetRepositoryPolicy (deny-not-action, statement 50): 1 matching actions
ecr:StartImageScan (deny-not-action, statement 50): 1 matching actions
ecr:TagResource (deny-not-action, statement 50): 1 matching actions
ecr:UntagResource (deny-not-action, statement 50): 1 matching actions
ecr:UploadLayerPart (deny-not-action, statement 50): 1 matching actions
elasticfilesystem:DescribeFileSystems (deny-not-action, statement 50): 1 matching actions
elasticfilesystem:DescribeMountTargets (deny-not-action, statement 50): 1 matching actions
elasticmapreduce:DescribeCluster (deny-not-action, statement 50): 1 matching actions
elasticmapreduce:ListClusters (deny-not-action, statement 50): 1 matching actions
elasticmapreduce:ListInstanceGroups (deny-not-action, statement 50): 1 matching actions
events:DescribeRule (deny-not-action, statement 50): 1 matching actions
events:ListTagsForResource (deny-not-action, statement 50): 1 matching actions
events:PutRule (deny-not-action, statement 50): 1 matching actions
events:PutTargets (deny-not-action, statement 50): 1 matching actions
events:TagResource (deny-not-action, statement 50): 1 matching actions
forecast:* (deny-not-action, statement 50): 70 matching actions
fsx:DescribeFileSystems (deny-not-action, statement 50): 1 matching actions
glue:*DataQuality* (deny-not-action, statement 50): 21 matching actions
glue:BatchCreatePartition (deny-not-action, statement 50): 1 matching actions
glue:BatchDeleteConnection (deny-not-action, statement 50): 1 matching actions
glue:BatchDeletePartition (deny-not-action, statement 50): 1 matching actions
glue:BatchDeleteTable (deny-not-action, statement 50): 1 matching actions
glue:BatchDeleteTableVersion (deny-not-action, statement 50): 1 matching actions
glue:BatchGet* (deny-not-action, statement 50): 10 matching actions
glue:BatchStopJobRun (deny-not-action, statement 50): 1 matching actions
glue:BatchUpdatePartition (deny-not-action, statement 50): 1 matching actions
glue:CreateBlueprint (deny-not-action, statement 50): 1 matching actions
glue:CreateConnection (deny-not-action, statement 50): 1 matching actions
glue:CreateCrawler (deny-not-action, statement 50): 1 matching actions
glue:CreateDatabase (deny-not-action, statement 50): 1 matching actions
glue:CreateJob (deny-not-action, statement 50): 1 matching actions
glue:CreatePartition (deny-not-action, statement 50): 1 matching actions
glue:CreatePartitionIndex (deny-not-action, statement 50): 1 matching actions
glue:CreateSession (deny-not-action, statement 50): 1 matching actions
glue:CreateTable (deny-not-action, statement 50): 1 matching actions
glue:CreateWorkflow (deny-not-action, statement 50): 1 matching actions
glue:DeleteBlueprint (deny-not-action, statement 50): 1 matching actions
glue:DeleteColumnStatisticsForPartition (deny-not-action, statement 50): 1 matching actions
glue:DeleteColumnStatisticsForTable (deny-not-action, statement 50): 1 matching actions
glue:DeleteConnection (deny-not-action, statement 50): 1 matching actions
glue:DeleteCrawler (deny-not-action, statement 50): 1 matching actions
glue:DeleteJob (deny-not-action, statement 50): 1 matching actions
glue:DeletePartition (deny-not-action, statement 50): 1 matching actions
glue:DeletePartitionIndex (deny-not-action, statement 50): 1 matching actions
glue:DeleteTable (deny-not-action, statement 50): 1 matching actions
glue:DeleteTableVersion (deny-not-action, statement 50): 1 matching actions
glue:DeleteWorkflow (deny-not-action, statement 50): 1 matching actions
glue:Get* (deny-not-action, statement 50): 99 matching actions
glue:List* (deny-not-action, statement 50): 25 matching actions
glue:NotifyEvent (deny-not-action, statement 50): 1 matching actions
glue:PutWorkflowRunProperties (deny-not-action, statement 50): 1 matching actions
glue:ResetJobBookmark (deny-not-action, statement 50): 1 matching actions
glue:ResumeWorkflowRun (deny-not-action, statement 50): 1 matching actions
glue:RunStatement (deny-not-action, statement 50): 1 matching actions
glue:SearchTables (deny-not-action, statement 50): 1 matching actions
glue:StartBlueprintRun (deny-not-action, statement 50): 1 matching actions
glue:StartCrawler (deny-not-action, statement 50): 1 matching actions
glue:StartCrawlerSchedule (deny-not-action, statement 50): 1 matching actions
glue:StartJobRun (deny-not-action, statement 50): 1 matching actions
glue:StartWorkflowRun (deny-not-action, statement 50): 1 matching actions
glue:StopCrawler (deny-not-action, statement 50): 1 matching actions
glue:StopCrawlerSchedule (deny-not-action, statement 50): 1 matching actions
glue:StopWorkflowRun (deny-not-action, statement 50): 1 matching actions
glue:UpdateBlueprint (deny-not-action, statement 50): 1 matching actions
glue:UpdateColumnStatisticsForPartition (deny-not-action, statement 50): 1 matching actions
glue:UpdateColumnStatisticsForTable (deny-not-action, statement 50): 1 matching actions
glue:UpdateConnection (deny-not-action, statement 50): 1 matching actions
glue:UpdateCrawler (deny-not-action, statement 50): 1 matching actions
glue:UpdateCrawlerSchedule (deny-not-action, statement 50): 1 matching actions
glue:UpdateJob (deny-not-action, statement 50): 1 matching actions
glue:UpdatePartition (deny-not-action, statement 50): 1 matching actions
glue:UpdateTable (deny-not-action, statement 50): 1 matching actions
glue:UpdateWorkflow (deny-not-action, statement 50): 1 matching actions
groundtruthlabeling:* (deny-not-action, statement 50): 16 matching actions
iam:CreateServiceLinkedRole (deny-not-action, statement 50): 1 matching actions
iam:GetRole (deny-not-action, statement 50): 1 matching actions
iam:ListRoles (deny-not-action, statement 50): 1 matching actions
iam:PassRole (deny-not-action, statement 50): 1 matching actions
kms:Decrypt (deny-not-action, statement 50): 1 matching actions
kms:DescribeKey (deny-not-action, statement 50): 1 matching actions
kms:Encrypt (deny-not-action, statement 50): 1 matching actions
kms:GenerateDataKey (deny-not-action, statement 50): 1 matching actions
kms:ListAliases (deny-not-action, statement 50): 1 matching actions
kms:ListKeys (deny-not-action, statement 50): 1 matching actions
kms:RetireGrant (deny-not-action, statement 50): 1 matching actions
lakeformation:GetDataAccess (deny-not-action, statement 50): 1 matching actions
lambda:InvokeFunction (deny-not-action, statement 50): 1 matching actions
lambda:ListFunctions (deny-not-action, statement 50): 1 matching actions
logs:CreateLogDelivery (deny-not-action, statement 50): 1 matching actions
logs:CreateLogGroup (deny-not-action, statement 50): 1 matching actions
logs:CreateLogStream (deny-not-action, statement 50): 1 matching actions
logs:DeleteLogDelivery (deny-not-action, statement 50): 1 matching actions
logs:Describe* (deny-not-action, statement 50): 19 matching actions
logs:GetLogDelivery (deny-not-action, statement 50): 1 matching actions
logs:GetLogEvents (deny-not-action, statement 50): 1 matching actions
logs:ListLogDeliveries (deny-not-action, statement 50): 1 matching actions
logs:PutLogEvents (deny-not-action, statement 50): 1 matching actions
logs:UpdateLogDelivery (deny-not-action, statement 50): 1 matching actions
ram:AcceptResourceShareInvitation (deny-not-action, statement 50): 1 matching actions
rds:DescribeDBInstances (deny-not-action, statement 50): 1 matching actions
redshift-data:BatchExecuteStatement (deny-not-action, statement 50): 1 matching actions
redshift-data:CancelStatement (deny-not-action, statement 50): 1 matching actions
redshift-data:DescribeStatement (deny-not-action, statement 50): 1 matching actions
redshift-data:DescribeTable (deny-not-action, statement 50): 1 matching actions
redshift-data:ExecuteStatement (deny-not-action, statement 50): 1 matching actions
redshift-data:GetStatementResult (deny-not-action, statement 50): 1 matching actions
redshift-data:ListSchemas (deny-not-action, statement 50): 1 matching actions
redshift-data:ListTables (deny-not-action, statement 50): 1 matching actions
redshift-serverless:GetCredentials (deny-not-action, statement 50): 1 matching actions
redshift-serverless:GetNamespace (deny-not-action, statement 50): 1 matching actions
redshift-serverless:GetWorkgroup (deny-not-action, statement 50): 1 matching actions
redshift-serverless:ListNamespaces (deny-not-action, statement 50): 1 matching actions
redshift-serverless:ListWorkgroups (deny-not-action, statement 50): 1 matching actions
redshift:CreateClusterUser (deny-not-action, statement 50): 1 matching actions
redshift:DescribeClusters (deny-not-action, statement 50): 1 matching actions
redshift:GetClusterCredentials (deny-not-action, statement 50): 1 matching actions
redshift:GetClusterCredentialsWithIAM (deny-not-action, statement 50): 1 matching actions
s3:AbortMultipartUpload (deny-not-action, statement 50): 1 matching actions
s3:CreateBucket (deny-not-action, statement 50): 1 matching actions
s3:DeleteObject (deny-not-action, statement 50): 1 matching actions
s3:DeleteObjectVersion (deny-not-action, statement 50): 1 matching actions
s3:GetBucketAcl (deny-not-action, statement 50): 1 matching actions
s3:GetBucketCors (deny-not-action, statement 50): 1 matching actions
s3:GetBucketLocation (deny-not-action, statement 50): 1 matching actions
s3:GetObject (deny-not-action, statement 50): 1 matching actions
s3:ListAllMyBuckets (deny-not-action, statement 50): 1 matching actions
s3:ListBucket (deny-not-action, statement 50): 1 matching actions
s3:PutBucketCors (deny-not-action, statement 50): 1 matching actions
s3:PutObject (deny-not-action, statement 50): 1 matching actions
s3:PutObjectAcl (deny-not-action, statement 50): 1 matching actions
s3:PutObjectRetention (deny-not-action, statement 50): 1 matching actions
s3:ReplicateObject (deny-not-action, statement 50): 1 matching actions
s3:RestoreObject (deny-not-action, statement 50): 1 matching actions
sagemaker-geospatial:* (deny-not-action, statement 50): 19 matching actions
sagemaker:* (deny-not-action, statement 50): 460 matching actions
secretsmanager:CreateSecret (deny-not-action, statement 50): 1 matching actions
secretsmanager:DescribeSecret (deny-not-action, statement 50): 1 matching actions
secretsmanager:GetSecretValue (deny-not-action, statement 50): 1 matching actions
secretsmanager:ListSecrets (deny-not-action, statement 50): 1 matching actions
secretsmanager:PutResourcePolicy (deny-not-action, statement 50): 1 matching actions
secretsmanager:TagResource (deny-not-action, statement 50): 1 matching actions
servicecatalog:Describe* (deny-not-action, statement 50): 16 matching actions
servicecatalog:List* (deny-not-action, statement 50): 24 matching actions
servicecatalog:ProvisionProduct (deny-not-action, statement 50): 1 matching actions
servicecatalog:ScanProvisionedProducts (deny-not-action, statement 50): 1 matching actions
servicecatalog:SearchProducts (deny-not-action, statement 50): 1 matching actions
servicecatalog:SearchProvisionedProducts (deny-not-action, statement 50): 1 matching actions
servicecatalog:TerminateProvisionedProduct (deny-not-action, statement 50): 1 matching actions
servicecatalog:UpdateProvisionedProduct (deny-not-action, statement 50): 1 matching actions
sns:CreateTopic (deny-not-action, statement 50): 1 matching actions
sns:ListTopics (deny-not-action, statement 50): 1 matching actions
sns:Publish (deny-not-action, statement 50): 1 matching actions
sns:Subscribe (deny-not-action, statement 50): 1 matching actions
sqlworkbench:* (deny-not-action, statement 50): 79 matching actions
sso:AssociateProfile (deny-not-action, statement 50): 1 matching actions
sso:CreateApplicationAssignment (deny-not-action, statement 50): 1 matching actions
states:DescribeExecution (deny-not-action, statement 50): 1 matching actions
states:GetExecutionHistory (deny-not-action, statement 50): 1 matching actions
states:StartExecution (deny-not-action, statement 50): 1 matching actions
states:StopExecution (deny-not-action, statement 50): 1 matching actions
states:UpdateStateMachine (deny-not-action, statement 50): 1 matching actions
tag:GetResources (deny-not-action, statement 50): 1 matching actions
sagemaker:CreateNotebookInstanceLifecycleConfig (deny, statement 51): 1 matching actions
sagemaker:DeleteNotebookInstanceLifecycleConfig (deny, statement 51): 1 matching actions
sagemaker:UpdateNotebookInstanceLifecycleConfig (deny, statement 51): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants at least 80% of the write and permissions-management actions of: application-autoscaling (6 of 6), datazone (159 of 159), groundtruthlabeling (10 of 10), sagemaker (254 of 257), sagemaker-geospatial (8 of 8), sqlworkbench (45 of 45).
Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowAllNonAdminSageMakerActions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:*",
        "sagemaker-geospatial:*"
      ],
      "NotResource": [
        "arn:aws:sagemaker:*:*:domain/*",
        "arn:aws:sagemaker:*:*:user-profile/*",
        "arn:aws:sagemaker:*:*:app/*",
        "arn:aws:sagemaker:*:*:space/*",
        "arn:aws:sagemaker:*:*:flow-definition/*"
      ]
    },
    {
      "Sid": "AllowSageMakerProfileManagement",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateUserProfile",
        "sagemaker:DescribeUserProfile",
        "sagemaker:UpdateUserProfile",
        "sagemaker:CreatePresignedDomainUrl"
      ],
      "Resource": "arn:aws:sagemaker:*:*:*/*"
    },
    {
      "Sid": "AllowLakeFormation",
      "Effect": "Allow",
      "Action": [
        "lakeformation:GetDataAccess"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowAddTagsForDomainResources",
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddTags"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:app/*",
        "arn:aws:sagemaker:*:*:space/*",
        "arn:aws:sagemaker:*:*:user-profile/*"
      ],
      "Condition": {
        "StringEquals": {
          "sagemaker:TaggingAction": [
            "CreateApp",
            "CreateSpace",
            "CreateUserProfile"
          ]
        }
      }
    },
    {
      "Sid": "AllowStudioActions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreatePresignedDomainUrl",
        "sagemaker:DescribeApp",
        "sagemaker:DescribeDomain",
        "sagemaker:DescribeSpace",
        "sagemaker:DescribeUserProfile",
        "sagemaker:ListApps",
        "sagemaker:ListDomains",
        "sagemaker:ListSpaces",
        "sagemaker:ListUserProfiles"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowAppActionsForUserProfile",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateApp",
        "sagemaker:DeleteApp"
      ],
      "Resource": "arn:aws:sagemaker:*:*:app/*/*/*/*",
      "Condition": {
        "Null": {
          "sagemaker:OwnerUserProfileArn": "true"
        }
      }
    },
    {
      "Sid": "AllowAppActionsForSharedSpaces",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateApp",
        "sagemaker:DeleteApp"
      ],
      "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*",
      "Condition": {
        "StringEquals": {
          "sagemaker:SpaceSharingType": [
            "Shared"
          ]
        }
      }
    },
    {
      "Sid": "AllowMutatingActionsOnSharedSpacesWithoutOwner",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateSpace",
        "sagemaker:DeleteSpace",
        "sagemaker:UpdateSpace"
      ],
      "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*",
      "Condition": {
        "Null": {
          "sagemaker:OwnerUserProfileArn": "true"
        }
      }
    },
    {
      "Sid": "RestrictMutatingActionsOnSpacesToOwnerUserProfile",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateSpace",
        "sagemaker:DeleteSpace",
        "sagemaker:UpdateSpace"
      ],
      "Resource": "arn:aws:sagemaker:*:*:space/${sagemaker:DomainId}/*",
      "Condition": {
        "ArnLike": {
          "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}"
        },
        "StringEquals": {
          "sagemaker:SpaceSharingType": [
            "Private",
            "Shared"
          ]
        }
      }
    },
    {
      "Sid": "RestrictMutatingActionsOnPrivateSpaceAppsToOwnerUserProfile",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateApp",
        "sagemaker:DeleteApp"
      ],
      "Resource": "arn:aws:sagemaker:*:*:app/${sagemaker:DomainId}/*/*/*",
      "Condition": {
        "ArnLike": {
          "sagemaker:OwnerUserProfileArn": "arn:aws:sagemaker:*:*:user-profile/${sagemaker:DomainId}/${sagemaker:UserProfileName}"
        },
        "StringEquals": {
          "sagemaker:SpaceSharingType": [
            "Private"
          ]
        }
      }
    },
    {
      "Sid": "AllowFlowDefinitionActions",
      "Effect": "Allow",
      "Action": "sagemaker:*",
      "Resource": [
        "arn:aws:sagemaker:*:*:flow-definition/*"
      ],
      "Condition": {
        "StringEqualsIfExists": {
          "sagemaker:WorkteamType": [
            "private-crowd",
            "vendor-crowd"
          ]
        }
      }
    },
    {
      "Sid": "AllowAWSServiceActions",
      "Effect": "Allow",
      "Action": [
        "sqlworkbench:*",
        "datazone:*",
        "application-autoscaling:DeleteScalingPolicy",
        "application-autoscaling:DeleteScheduledAction",
        "application-autoscaling:DeregisterScalableTarget",
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingActivities",
        "application-autoscaling:DescribeScalingPolicies",
        "application-autoscaling:DescribeScheduledActions",
        "application-autoscaling:PutScalingPolicy",
        "application-autoscaling:PutScheduledAction",
        "application-autoscaling:RegisterScalableTarget",
        "aws-marketplace:ViewSubscriptions",
        "cloudformation:GetTemplateSummary",
        "cloudwatch:DeleteAlarms",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "cloudwatch:PutMetricAlarm",
        "cloudwatch:PutMetricData",
        "codecommit:BatchGetRepositories",
        "codecommit:CreateRepository",
        "codecommit:GetRepository",
        "codecommit:List*",
        "ec2:CreateNetworkInterface",
        "ec2:CreateNetworkInterfacePermission",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteNetworkInterfacePermission",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcEndpointServices",
        "ec2:DescribeVpcs",
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:Describe*",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
        "ecr:StartImageScan",
        "elastic-inference:Connect",
        "elasticfilesystem:DescribeFileSystems",
        "elasticfilesystem:DescribeMountTargets",
        "fsx:DescribeFileSystems",
        "groundtruthlabeling:*",
        "iam:GetRole",
        "iam:ListRoles",
        "kms:DescribeKey",
        "kms:ListAliases",
        "lambda:ListFunctions",
        "logs:CreateLogDelivery",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DeleteLogDelivery",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:GetLogDelivery",
        "logs:GetLogEvents",
        "logs:ListLogDeliveries",
        "logs:PutLogEvents",
        "logs:UpdateLogDelivery",
        "redshift-data:BatchExecuteStatement",
        "redshift-data:CancelStatement",
        "redshift-data:DescribeStatement",
        "redshift-data:DescribeTable",
        "redshift-data:ExecuteStatement",
        "redshift-data:GetStatementResult",
        "redshift-data:ListSchemas",
        "redshift-data:ListTables",
        "redshift-serverless:GetCredentials",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetWorkgroup",
        "redshift-serverless:ListNamespaces",
        "redshift-serverless:ListWorkgroups",
        "secretsmanager:ListSecrets",
        "servicecatalog:Describe*",
        "servicecatalog:List*",
        "servicecatalog:ScanProvisionedProducts",
        "servicecatalog:SearchProducts",
        "servicecatalog:SearchProvisionedProducts",
        "sns:ListTopics",
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowRAMInvitation",
      "Effect": "Allow",
      "Action": "ram:AcceptResourceShareInvitation",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ram:ResourceShareName": "dzd*"
        }
      }
    },
    {
      "Sid": "AllowECRActions",
      "Effect": "Allow",
      "Action": [
        "ecr:SetRepositoryPolicy",
        "ecr:CompleteLayerUpload",
        "ecr:CreateRepository",
        "ecr:BatchDeleteImage",
        "ecr:UploadLayerPart",
        "ecr:DeleteRepositoryPolicy",
        "ecr:InitiateLayerUpload",
        "ecr:DeleteRepository",
        "ecr:PutImage",
        "ecr:TagResource",
        "ecr:UntagResource"
      ],
      "Resource": [
        "arn:aws:ecr:*:*:repository/sagemaker*",
        "arn:aws:ecr:*:*:repository/datazone*"
      ]
    },
    {
      "Sid": "AllowCodeCommitActions",
      "Effect": "Allow",
      "Action": [
        "codecommit:GitPull",
        "codecommit:GitPush"
      ],
      "Resource": [
        "arn:aws:codecommit:*:*:*sagemaker*",
        "arn:aws:codecommit:*:*:*SageMaker*",
        "arn:aws:codecommit:*:*:*Sagemaker*"
      ]
    },
    {
      "Sid": "AllowCodeBuildActions",
      "Effect": "Allow",
      "Action": [
        "codebuild:BatchGetBuilds",
        "codebuild:StartBuild"
      ],
      "Resource": [
        "arn:aws:codebuild:*:*:project/sagemaker*",
        "arn:aws:codebuild:*:*:build/*"
      ]
    },
    {
      "Sid": "AllowStepFunctionsActions",
      "Effect": "Allow",
      "Action": [
        "states:DescribeExecution",
        "states:GetExecutionHistory",
        "states:StartExecution",
        "states:StopExecution",
        "states:UpdateStateMachine"
      ],
      "Resource": [
        "arn:aws:states:*:*:statemachine:*sagemaker*",
        "arn:aws:states:*:*:execution:*sagemaker*:*"
      ]
    },
    {
      "Sid": "AllowSecretManagerActions",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:CreateSecret",
        "secretsmanager:PutResourcePolicy"
      ],
      "Resource": [
        "arn:aws:secretsmanager:*:*:secret:AmazonSageMaker-*"
      ]
    },
    {
      "Sid": "AllowServiceCatalogProvisionProduct",
      "Effect": "Allow",
      "Action": [
        "servicecatalog:ProvisionProduct"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowServiceCatalogTerminateUpdateProvisionProduct",
      "Effect": "Allow",
      "Action": [
        "servicecatalog:TerminateProvisionedProduct",
        "servicecatalog:UpdateProvisionedProduct"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "servicecatalog:userLevel": "self"
        }
      }
    },
    {
      "Sid": "AllowS3ObjectActions",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:PutObject",
        "s3:PutObjectRetention",
        "s3:ReplicateObject",
        "s3:RestoreObject",
        "s3:GetBucketAcl",
        "s3:PutObjectAcl"
      ],
      "Resource": [
        "arn:aws:s3:::SageMaker-DataZone*",
        "arn:aws:s3:::DataZone-SageMaker*",
        "arn:aws:s3:::Sagemaker-DataZone*",
        "arn:aws:s3:::DataZone-Sagemaker*",
        "arn:aws:s3:::sagemaker-datazone*",
        "arn:aws:s3:::datazone-sagemaker*",
        "arn:aws:s3:::amazon-datazone*"
      ]
    },
    {
      "Sid": "AllowS3GetObjectWithSageMakerExistingObjectTag",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::*"
      ],
      "Condition": {
        "StringEqualsIgnoreCase": {
          "s3:ExistingObjectTag/SageMaker": "true"
        }
      }
    },
    {
      "Sid": "AllowS3GetObjectWithServiceCatalogProvisioningExistingObjectTag",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::*"
      ],
      "Condition": {
        "StringEquals": {
          "s3:ExistingObjectTag/servicecatalog:provisioning": "true"
        }
      }
    },
    {
      "Sid": "AllowS3BucketActions",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListAllMyBuckets",
        "s3:GetBucketCors",
        "s3:PutBucketCors"
      ],
      "Resource": [
        "arn:aws:s3:::SageMaker-DataZone*",
        "arn:aws:s3:::DataZone-SageMaker*",
        "arn:aws:s3:::Sagemaker-DataZone*",
        "arn:aws:s3:::DataZone-Sagemaker*",
        "arn:aws:s3:::sagemaker-datazone*",
        "arn:aws:s3:::datazone-sagemaker*",
        "arn:aws:s3:::amazon-datazone*"
      ]
    },
    {
      "Sid": "ReadSageMakerJumpstartArtifacts",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": [
        "arn:aws:s3:::jumpstart-cache-prod-us-west-2/*",
        "arn:aws:s3:::jumpstart-cache-prod-us-east-1/*",
        "arn:aws:s3:::jumpstart-cache-prod-us-east-2/*",
        "arn:aws:s3:::jumpstart-cache-prod-eu-west-1/*",
        "arn:aws:s3:::jumpstart-cache-prod-eu-central-1/*",
        "arn:aws:s3:::jumpstart-cache-prod-ap-south-1/*",
        "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-2/*",
        "arn:aws:s3:::jumpstart-cache-prod-ap-northeast-1/*",
        "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-1/*",
        "arn:aws:s3:::jumpstart-cache-prod-ap-southeast-2/*"
      ]
    },
    {
      "Sid": "AllowLambdaInvokeFunction",
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "arn:aws:lambda:*:*:function:*SageMaker*",
        "arn:aws:lambda:*:*:function:*sagemaker*",
        "arn:aws:lambda:*:*:function:*Sagemaker*",
        "arn:aws:lambda:*:*:function:*LabelingFunction*"
      ]
    },
    {
      "Sid": "AllowCreateServiceLinkedRoleForSageMakerApplicationAutoscaling",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint",
      "Condition": {
        "StringLike": {
          "iam:AWSServiceName": "sagemaker.application-autoscaling.amazonaws.com"
        }
      }
    },
    {
      "Sid": "AllowSNSActions",
      "Effect": "Allow",
      "Action": [
        "sns:Subscribe",
        "sns:CreateTopic",
        "sns:Publish"
      ],
      "Resource": [
        "arn:aws:sns:*:*:*SageMaker*",
        "arn:aws:sns:*:*:*Sagemaker*",
        "arn:aws:sns:*:*:*sagemaker*"
      ]
    },
    {
      "Sid": "AllowPassRoleForSageMakerRoles",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/sm-provisioning/datazone_usr_sagemaker_execution_role_*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "glue.amazonaws.com",
            "bedrock.amazonaws.com",
            "states.amazonaws.com",
            "lakeformation.amazonaws.com",
            "events.amazonaws.com",
            "sagemaker.amazonaws.com",
            "forecast.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "CrossAccountKmsOperations",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Decrypt",
        "kms:ListKeys"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "KmsOperationsWithResourceTag",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:Decrypt",
        "kms:ListKeys",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:RetireGrant"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "AllowAthenaActions",
      "Effect": "Allow",
      "Action": [
        "athena:BatchGetNamedQuery",
        "athena:BatchGetPreparedStatement",
        "athena:BatchGetQueryExecution",
        "athena:CreateNamedQuery",
        "athena:CreateNotebook",
        "athena:CreatePreparedStatement",
        "athena:CreatePresignedNotebookUrl",
        "athena:DeleteNamedQuery",
        "athena:DeleteNotebook",
        "athena:DeletePreparedStatement",
        "athena:ExportNotebook",
        "athena:GetDatabase",
        "athena:GetDataCatalog",
        "athena:GetNamedQuery",
        "athena:GetPreparedStatement",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:GetQueryResultsStream",
        "athena:GetQueryRuntimeStatistics",
        "athena:GetTableMetadata",
        "athena:GetWorkGroup",
        "athena:ImportNotebook",
        "athena:ListDatabases",
        "athena:ListDataCatalogs",
        "athena:ListEngineVersions",
        "athena:ListNamedQueries",
        "athena:ListPreparedStatements",
        "athena:ListQueryExecutions",
        "athena:ListTableMetadata",
        "athena:ListTagsForResource",
        "athena:ListWorkGroups",
        "athena:StartCalculationExecution",
        "athena:StartQueryExecution",
        "athena:StartSession",
        "athena:StopCalculationExecution",
        "athena:StopQueryExecution",
        "athena:TerminateSession",
        "athena:UpdateNamedQuery",
        "athena:UpdateNotebook",
        "athena:UpdateNotebookMetadata",
        "athena:UpdatePreparedStatement"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowGlueCreateDatabase",
      "Effect": "Allow",
      "Action": [
        "glue:CreateDatabase"
      ],
      "Resource": [
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:database/default"
      ]
    },
    {
      "Sid": "AllowRedshiftGetClusterCredentials",
      "Effect": "Allow",
      "Action": [
        "redshift:GetClusterCredentials"
      ],
      "Resource": [
        "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*",
        "arn:aws:redshift:*:*:dbname:*"
      ]
    },
    {
      "Sid": "AllowListTags",
      "Effect": "Allow",
      "Action": [
        "sagemaker:ListTags"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:user-profile/*",
        "arn:aws:sagemaker:*:*:domain/*"
      ]
    },
    {
      "Sid": "AllowCloudformationListStackResources",
      "Effect": "Allow",
      "Action": [
        "cloudformation:ListStackResources"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/SC-*"
    },
    {
      "Sid": "AllowGlueActions",
      "Effect": "Allow",
      "Action": [
        "glue:GetColumnStatisticsForPartition",
        "glue:GetColumnStatisticsForTable",
        "glue:ListJobs",
        "glue:CreateSession",
        "glue:RunStatement",
        "glue:BatchCreatePartition",
        "glue:CreatePartitionIndex",
        "glue:CreateTable",
        "glue:BatchGetWorkflows",
        "glue:BatchUpdatePartition",
        "glue:BatchDeletePartition",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:UpdateTable",
        "glue:DeleteTableVersion",
        "glue:DeleteTable",
        "glue:DeleteColumnStatisticsForPartition",
        "glue:DeleteColumnStatisticsForTable",
        "glue:DeletePartitionIndex",
        "glue:UpdateColumnStatisticsForPartition",
        "glue:UpdateColumnStatisticsForTable",
        "glue:BatchDeleteTableVersion",
        "glue:BatchDeleteTable",
        "glue:CreatePartition",
        "glue:DeletePartition",
        "glue:UpdatePartition",
        "glue:CreateBlueprint",
        "glue:CreateJob",
        "glue:CreateConnection",
        "glue:CreateCrawler",
        "glue:CreateDataQualityRuleset",
        "glue:CreateWorkflow",
        "glue:GetDatabases",
        "glue:GetTables",
        "glue:GetTable",
        "glue:SearchTables",
        "glue:NotifyEvent",
        "glue:ListSchemas",
        "glue:BatchGetJobs",
        "glue:GetConnection",
        "glue:GetDatabase"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "AllowGlueActionsWithEnvironmentTag",
      "Effect": "Allow",
      "Action": [
        "glue:SearchTables",
        "glue:NotifyEvent",
        "glue:StartBlueprintRun",
        "glue:PutWorkflowRunProperties",
        "glue:StopCrawler",
        "glue:DeleteJob",
        "glue:DeleteWorkflow",
        "glue:UpdateCrawler",
        "glue:DeleteBlueprint",
        "glue:UpdateWorkflow",
        "glue:StartCrawler",
        "glue:ResetJobBookmark",
        "glue:UpdateJob",
        "glue:StartWorkflowRun",
        "glue:StopCrawlerSchedule",
        "glue:ResumeWorkflowRun",
        "glue:ListSchemas",
        "glue:DeleteCrawler",
        "glue:UpdateBlueprint",
        "glue:BatchStopJobRun",
        "glue:StopWorkflowRun",
        "glue:BatchGetJobs",
        "glue:BatchGetWorkflows",
        "glue:UpdateCrawlerSchedule",
        "glue:DeleteConnection",
        "glue:UpdateConnection",
        "glue:GetConnection",
        "glue:GetDatabase",
        "glue:GetTable",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:BatchDeleteConnection",
        "glue:StartCrawlerSchedule",
        "glue:StartJobRun",
        "glue:CreateWorkflow",
        "glue:*DataQuality*"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneEnvironment": "false"
        }
      }
    },
    {
      "Sid": "AllowGlueDefaultAccess",
      "Effect": "Allow",
      "Action": [
        "glue:BatchGet*",
        "glue:Get*",
        "glue:SearchTables",
        "glue:List*",
        "glue:RunStatement"
      ],
      "Resource": [
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:database/default",
        "arn:aws:glue:*:*:connection/dz-sm-*",
        "arn:aws:glue:*:*:session/*"
      ]
    },
    {
      "Sid": "AllowRedshiftClusterActions",
      "Effect": "Allow",
      "Action": [
        "redshift:GetClusterCredentialsWithIAM",
        "redshift:DescribeClusters"
      ],
      "Resource": [
        "arn:aws:redshift:*:*:cluster:*",
        "arn:aws:redshift:*:*:dbname:*"
      ]
    },
    {
      "Sid": "AllowCreateClusterUser",
      "Effect": "Allow",
      "Action": [
        "redshift:CreateClusterUser"
      ],
      "Resource": [
        "arn:aws:redshift:*:*:dbuser:*"
      ]
    },
    {
      "Sid": "AllowCreateSecretActions",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:TagResource"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "AmazonDataZoneDomain",
            "AmazonDataZoneProject"
          ]
        },
        "Null": {
          "aws:RequestTag/AmazonDataZoneDomain": "false",
          "aws:RequestTag/AmazonDataZoneProject": "false",
          "aws:ResourceTag/AmazonDataZoneDomain": "false",
          "aws:ResourceTag/AmazonDataZoneProject": "false",
          "aws:TagKeys": "false"
        },
        "StringLike": {
          "aws:RequestTag/AmazonDataZoneDomain": "dzd*",
          "aws:ResourceTag/AmazonDataZoneDomain": "dzd*"
        }
      }
    },
    {
      "Sid": "ForecastOperations",
      "Effect": "Allow",
      "Action": [
        "forecast:CreateExplainabilityExport",
        "forecast:CreateExplainability",
        "forecast:CreateForecastEndpoint",
        "forecast:CreateAutoPredictor",
        "forecast:CreateDatasetImportJob",
        "forecast:CreateDatasetGroup",
        "forecast:CreateDataset",
        "forecast:CreateForecast",
        "forecast:CreateForecastExportJob",
        "forecast:CreatePredictorBacktestExportJob",
        "forecast:CreatePredictor",
        "forecast:DescribeExplainabilityExport",
        "forecast:DescribeExplainability",
        "forecast:DescribeAutoPredictor",
        "forecast:DescribeForecastEndpoint",
        "forecast:DescribeDatasetImportJob",
        "forecast:DescribeDataset",
        "forecast:DescribeForecast",
        "forecast:DescribeForecastExportJob",
        "forecast:DescribePredictorBacktestExportJob",
        "forecast:GetAccuracyMetrics",
        "forecast:InvokeForecastEndpoint",
        "forecast:GetRecentForecastContext",
        "forecast:DescribePredictor",
        "forecast:TagResource",
        "forecast:DeleteResourceTree"
      ],
      "Resource": [
        "arn:aws:forecast:*:*:*Canvas*"
      ]
    },
    {
      "Sid": "RDSOperation",
      "Effect": "Allow",
      "Action": "rds:DescribeDBInstances",
      "Resource": "*"
    },
    {
      "Sid": "AllowEventBridgeRule",
      "Effect": "Allow",
      "Action": [
        "events:PutRule"
      ],
      "Resource": "arn:aws:events:*:*:rule/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true"
        }
      }
    },
    {
      "Sid": "EventBridgeOperations",
      "Effect": "Allow",
      "Action": [
        "events:DescribeRule",
        "events:PutTargets"
      ],
      "Resource": "arn:aws:events:*:*:rule/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true"
        }
      }
    },
    {
      "Sid": "EventBridgeTagBasedOperations",
      "Effect": "Allow",
      "Action": [
        "events:TagResource"
      ],
      "Resource": "arn:aws:events:*:*:rule/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true",
          "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true"
        }
      }
    },
    {
      "Sid": "EventBridgeListTagOperation",
      "Effect": "Allow",
      "Action": "events:ListTagsForResource",
      "Resource": "*"
    },
    {
      "Sid": "AllowEMR",
      "Effect": "Allow",
      "Action": [
        "elasticmapreduce:DescribeCluster",
        "elasticmapreduce:ListInstanceGroups",
        "elasticmapreduce:ListClusters"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowSSOAction",
      "Effect": "Allow",
      "Action": [
        "sso:CreateApplicationAssignment",
        "sso:AssociateProfile"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyNotAction",
      "Effect": "Deny",
      "NotAction": [
        "sagemaker:*",
        "sagemaker-geospatial:*",
        "sqlworkbench:*",
        "datazone:*",
        "forecast:*",
        "application-autoscaling:DeleteScalingPolicy",
        "application-autoscaling:DeleteScheduledAction",
        "application-autoscaling:DeregisterScalableTarget",
        "application-autoscaling:DescribeScalableTargets",
        "application-autoscaling:DescribeScalingActivities",
        "application-autoscaling:DescribeScalingPolicies",
        "application-autoscaling:DescribeScheduledActions",
        "application-autoscaling:PutScalingPolicy",
        "application-autoscaling:PutScheduledAction",
        "application-autoscaling:RegisterScalableTarget",
        "athena:BatchGetNamedQuery",
        "athena:BatchGetPreparedStatement",
        "athena:BatchGetQueryExecution",
        "athena:CreateNamedQuery",
        "athena:CreateNotebook",
        "athena:CreatePreparedStatement",
        "athena:CreatePresignedNotebookUrl",
        "athena:DeleteNamedQuery",
        "athena:DeleteNotebook",
        "athena:DeletePreparedStatement",
        "athena:ExportNotebook",
        "athena:GetDatabase",
        "athena:GetDataCatalog",
        "athena:GetNamedQuery",
        "athena:GetPreparedStatement",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:GetQueryResultsStream",
        "athena:GetQueryRuntimeStatistics",
        "athena:GetTableMetadata",
        "athena:GetWorkGroup",
        "athena:ImportNotebook",
        "athena:ListDatabases",
        "athena:ListDataCatalogs",
        "athena:ListEngineVersions",
        "athena:ListNamedQueries",
        "athena:ListPreparedStatements",
        "athena:ListQueryExecutions",
        "athena:ListTableMetadata",
        "athena:ListTagsForResource",
        "athena:ListWorkGroups",
        "athena:StartCalculationExecution",
        "athena:StartQueryExecution",
        "athena:StartSession",
        "athena:StopCalculationExecution",
        "athena:StopQueryExecution",
        "athena:TerminateSession",
        "athena:UpdateNamedQuery",
        "athena:UpdateNotebook",
        "athena:UpdateNotebookMetadata",
        "athena:UpdatePreparedStatement",
        "aws-marketplace:ViewSubscriptions",
        "cloudformation:GetTemplateSummary",
        "cloudformation:ListStackResources",
        "cloudwatch:DeleteAlarms",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:GetMetricData",
        "cloudwatch:GetMetricStatistics",
        "cloudwatch:ListMetrics",
        "cloudwatch:PutMetricAlarm",
        "cloudwatch:PutMetricData",
        "codebuild:BatchGetBuilds",
        "codebuild:StartBuild",
        "codecommit:BatchGetRepositories",
        "codecommit:CreateRepository",
        "codecommit:GetRepository",
        "codecommit:List*",
        "codecommit:GitPull",
        "codecommit:GitPush",
        "ec2:CreateNetworkInterface",
        "ec2:CreateNetworkInterfacePermission",
        "ec2:DeleteNetworkInterface",
        "ec2:DeleteNetworkInterfacePermission",
        "ec2:DescribeDhcpOptions",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeRouteTables",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcEndpointServices",
        "ec2:DescribeVpcs",
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:CreateRepository",
        "ecr:Describe*",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer",
        "ecr:SetRepositoryPolicy",
        "ecr:CompleteLayerUpload",
        "ecr:BatchDeleteImage",
        "ecr:UploadLayerPart",
        "ecr:DeleteRepositoryPolicy",
        "ecr:InitiateLayerUpload",
        "ecr:DeleteRepository",
        "ecr:PutImage",
        "ecr:StartImageScan",
        "ecr:TagResource",
        "ecr:UntagResource",
        "elasticfilesystem:DescribeFileSystems",
        "elasticfilesystem:DescribeMountTargets",
        "elasticmapreduce:DescribeCluster",
        "elasticmapreduce:ListInstanceGroups",
        "elasticmapreduce:ListClusters",
        "events:PutRule",
        "events:DescribeRule",
        "events:PutTargets",
        "events:TagResource",
        "events:ListTagsForResource",
        "fsx:DescribeFileSystems",
        "glue:SearchTables",
        "glue:NotifyEvent",
        "glue:StartBlueprintRun",
        "glue:PutWorkflowRunProperties",
        "glue:StopCrawler",
        "glue:DeleteJob",
        "glue:DeleteWorkflow",
        "glue:UpdateCrawler",
        "glue:DeleteBlueprint",
        "glue:UpdateWorkflow",
        "glue:StartCrawler",
        "glue:ResetJobBookmark",
        "glue:UpdateJob",
        "glue:StartWorkflowRun",
        "glue:StopCrawlerSchedule",
        "glue:ResumeWorkflowRun",
        "glue:DeleteCrawler",
        "glue:UpdateBlueprint",
        "glue:BatchStopJobRun",
        "glue:StopWorkflowRun",
        "glue:BatchGet*",
        "glue:UpdateCrawlerSchedule",
        "glue:DeleteConnection",
        "glue:UpdateConnection",
        "glue:Get*",
        "glue:BatchDeleteConnection",
        "glue:StartCrawlerSchedule",
        "glue:StartJobRun",
        "glue:CreateWorkflow",
        "glue:*DataQuality*",
        "glue:List*",
        "glue:CreateSession",
        "glue:RunStatement",
        "glue:BatchCreatePartition",
        "glue:CreateDatabase",
        "glue:CreatePartitionIndex",
        "glue:CreateTable",
        "glue:BatchUpdatePartition",
        "glue:BatchDeletePartition",
        "glue:UpdateTable",
        "glue:DeleteTableVersion",
        "glue:DeleteTable",
        "glue:DeleteColumnStatisticsForPartition",
        "glue:DeleteColumnStatisticsForTable",
        "glue:DeletePartitionIndex",
        "glue:UpdateColumnStatisticsForPartition",
        "glue:UpdateColumnStatisticsForTable",
        "glue:BatchDeleteTableVersion",
        "glue:BatchDeleteTable",
        "glue:CreatePartition",
        "glue:DeletePartition",
        "glue:UpdatePartition",
        "glue:CreateBlueprint",
        "glue:CreateJob",
        "glue:CreateConnection",
        "glue:CreateCrawler",
        "groundtruthlabeling:*",
        "iam:CreateServiceLinkedRole",
        "iam:GetRole",
        "iam:ListRoles",
        "iam:PassRole",
        "kms:DescribeKey",
        "kms:ListAliases",
        "kms:Decrypt",
        "kms:ListKeys",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:RetireGrant",
        "lakeformation:GetDataAccess",
        "lambda:ListFunctions",
        "lambda:InvokeFunction",
        "logs:CreateLogDelivery",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:DeleteLogDelivery",
        "logs:Describe*",
        "logs:GetLogDelivery",
        "logs:GetLogEvents",
        "logs:ListLogDeliveries",
        "logs:PutLogEvents",
        "logs:UpdateLogDelivery",
        "ram:AcceptResourceShareInvitation",
        "rds:DescribeDBInstances",
        "redshift:CreateClusterUser",
        "redshift:GetClusterCredentials",
        "redshift:GetClusterCredentialsWithIAM",
        "redshift:DescribeClusters",
        "redshift-data:BatchExecuteStatement",
        "redshift-data:CancelStatement",
        "redshift-data:DescribeStatement",
        "redshift-data:DescribeTable",
        "redshift-data:ExecuteStatement",
        "redshift-data:GetStatementResult",
        "redshift-data:ListSchemas",
        "redshift-data:ListTables",
        "redshift-serverless:ListNamespaces",
        "redshift-serverless:ListWorkgroups",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetWorkgroup",
        "redshift-serverless:GetCredentials",
        "s3:GetBucketAcl",
        "s3:PutObjectAcl",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:CreateBucket",
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:ListAllMyBuckets",
        "s3:GetBucketCors",
        "s3:PutBucketCors",
        "s3:DeleteObjectVersion",
        "s3:PutObjectRetention",
        "s3:ReplicateObject",
        "s3:RestoreObject",
        "secretsmanager:ListSecrets",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:CreateSecret",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:TagResource",
        "servicecatalog:Describe*",
        "servicecatalog:List*",
        "servicecatalog:ScanProvisionedProducts",
        "servicecatalog:SearchProducts",
        "servicecatalog:SearchProvisionedProducts",
        "servicecatalog:ProvisionProduct",
        "servicecatalog:TerminateProvisionedProduct",
        "servicecatalog:UpdateProvisionedProduct",
        "sns:ListTopics",
        "sns:Subscribe",
        "sns:CreateTopic",
        "sns:Publish",
        "states:DescribeExecution",
        "states:GetExecutionHistory",
        "states:StartExecution",
        "states:StopExecution",
        "states:UpdateStateMachine",
        "tag:GetResources",
        "sso:CreateApplicationAssignment",
        "sso:AssociateProfile"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyUpdateNotebookInstanceLifecycleConfig",
      "Effect": "Deny",
      "Action": [
        "sagemaker:CreateNotebookInstanceLifecycleConfig",
        "sagemaker:UpdateNotebookInstanceLifecycleConfig",
        "sagemaker:DeleteNotebookInstanceLifecycleConfig"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v13, edited by AWS on 2026-07-17. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary

Terraform

resource "aws_iam_role_policy_attachment" "amazondatazonesagemakerenvironmentrolepermissionsboundary" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary"),
);

Sources

Pending editorial review. No editorial sources are listed yet.