SageMakerStudioAdminIAMDefaultExecutionPolicy

Summary

Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in your account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/SageMakerStudioAdminIAMDefaultExecutionPolicyCopy ARN

Default version

v28

Created

2025-08-18

Last edited

2026-10-29

Services

airflow, airflow-serverless, application-autoscaling, athena, bedrock, bedrock-agentcore, cloudformation, cloudwatch, codeconnections, codestar-connections, codewhisperer, comprehend, datazone, dynamodb, ec2, ecr, ecr-public, elasticmapreduce, emr-containers, emr-serverless, events, glue, iam, identitystore, kms, lakeformation, logs, organizations, q, quicksight, ram, rds, redshift, redshift-data, redshift-serverless, rekognition, resource-groups, s3, s3tables, sagemaker, sagemaker-data-science-assistant, sagemaker-mlflow, sagemaker-unified-studio-mcp, scheduler, secretsmanager, sqlworkbench, ssm, sso, sts, tag, textract, xray

Control-plane actions (2769)

By access level: 648 List, 81 Permissions management, 823 Read, 46 Tagging, 1171 Write.

The full action list is in actions.json.

Data-plane actions (148)

By access level: 20 List, 2 Permissions management, 55 Read, 2 Tagging, 69 Write.

The full action list is in actions.json.

Excluded and conditional actions

• athena:GetResourceDashboard (deny-conditional, statement 26): 1 matching actions
• athena:GetSession (deny-conditional, statement 26): 1 matching actions
• athena:GetSessionEndpoint (deny-conditional, statement 26): 1 matching actions
• athena:GetSessionStatus (deny-conditional, statement 26): 1 matching actions
• athena:StartSession (deny-conditional, statement 26): 1 matching actions
• athena:TerminateSession (deny-conditional, statement 26): 1 matching actions
• elasticmapreduce:*Session* (deny-conditional, statement 26): 11 matching actions
• emr-containers:*ManagedEndpoint* (deny-conditional, statement 26): 5 matching actions
• emr-serverless:*Dashboard* (deny-conditional, statement 26): 2 matching actions
• emr-serverless:*Session* (deny-conditional, statement 26): 5 matching actions
• glue:CancelStatement (deny-conditional, statement 26): 1 matching actions
• glue:CreateSession (deny-conditional, statement 26): 1 matching actions
• glue:DeleteSession (deny-conditional, statement 26): 1 matching actions
• glue:GetDashboardUrl (deny-conditional, statement 26): 1 matching actions
• glue:GetSession (deny-conditional, statement 26): 1 matching actions
• glue:GetSessionEndpoint (deny-conditional, statement 26): 1 matching actions
• glue:GetStatement (deny-conditional, statement 26): 1 matching actions
• glue:RunStatement (deny-conditional, statement 26): 1 matching actions
• glue:StopSession (deny-conditional, statement 26): 1 matching actions
• athena:TagResource (deny-conditional, statement 27): 1 matching actions
• athena:UntagResource (deny-conditional, statement 27): 1 matching actions
• elasticmapreduce:AddTags (deny-conditional, statement 27): 1 matching actions
• elasticmapreduce:RemoveTags (deny-conditional, statement 27): 1 matching actions
• emr-containers:*Resource (deny-conditional, statement 27): 3 matching actions
• emr-serverless:*Resource (deny-conditional, statement 27): 3 matching actions
• glue:TagResource (deny-conditional, statement 27): 1 matching actions
• glue:UntagResource (deny-conditional, statement 27): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: airflow-serverless (5 of 5), athena (36 of 36), bedrock (136 of 136), bedrock-agentcore (148 of 148), codeconnections (13 of 13), codestar-connections (13 of 13), comprehend (33 of 33), datazone (159 of 159), and 5 more.
• Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).
• Grants permissions-management actions on iam, but only for scoped resources or under conditions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

• AmazonAthenaFullAccess
• AmazonAugmentedAIFullAccess
• AmazonAugmentedAIHumanLoopFullAccess
• AmazonAugmentedAIIntegratedAPIAccess
• AmazonBedrockMarketplaceAccess
• AmazonBraketFullAccess
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneGlueManageAccessRolePolicy

Same domain

• AgentRegistryFullAccess
• AgentRegistryReadOnlyAccess
• AIOpsAssistantIncidentReportPolicy
• AIOpsAssistantPolicy
• AIOpsConsoleAdminPolicy
• AIOpsOperatorAccess
• AIOpsReadOnlyAccess
• AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataZone",
      "Effect": "Allow",
      "Action": [
        "datazone:*"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "SageMakerUnifiedStudioMcp",
      "Effect": "Allow",
      "Action": [
        "sagemaker-unified-studio-mcp:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "IamSts",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:ListRoles",
        "iam:GetUser",
        "iam:ListUsers",
        "sts:AssumeRole",
        "ecr-public:GetAuthorizationToken",
        "sts:GetServiceBearerToken"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CreateSLR",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": [
        "arn:aws:iam::*:role/aws-service-role/neptune-graph.amazonaws.com/AWSServiceRoleForNeptuneGraph",
        "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift",
        "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks",
        "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless",
        "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA",
        "arn:aws:iam::*:role/aws-service-role/airflow-serverless.amazonaws.com/AWSServiceRoleForAmazonMWAAServerless",
        "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup",
        "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint",
        "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless",
        "arn:aws:iam::*:role/aws-service-role/ops.athena.amazonaws.com/AWSServiceRoleForAmazonAthena",
        "arn:aws:iam::*:role/aws-service-role/runtime-identity.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreRuntimeIdentity",
        "arn:aws:iam::*:role/aws-service-role/network.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreNetwork",
        "arn:aws:iam::*:role/aws-service-role/bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreGatewayNetwork",
        "arn:aws:iam::*:role/aws-service-role/identity-network.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreIdentity"
      ]
    },
    {
      "Sid": "TagRoleAndSession",
      "Effect": "Allow",
      "Action": [
        "iam:TagRole",
        "sts:TagSession"
      ],
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringLike": {
          "aws:TagKeys": [
            "AmazonDataZone*",
            "SageMakerSpacesDomainId"
          ]
        }
      }
    },
    {
      "Sid": "UpdateDzManagedRoleTrustPolicy",
      "Effect": "Allow",
      "Action": "iam:UpdateAssumeRolePolicy",
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMakerAdminIAMExecutionRole*",
        "arn:aws:iam::*:role/service-role/AmazonSageMakerUserIAMExecutionRole*",
        "arn:aws:iam::*:role/AmazonSageMakerAdminIAMExecutionRole*",
        "arn:aws:iam::*:role/AmazonSageMakerUserIAMExecutionRole*"
      ]
    },
    {
      "Sid": "CreateRole",
      "Effect": "Allow",
      "Action": [
        "iam:CreateRole"
      ],
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMaker*"
      ]
    },
    {
      "Sid": "AttachPolicy",
      "Effect": "Allow",
      "Action": "iam:AttachRolePolicy",
      "Resource": "arn:aws:iam::*:role/service-role/AmazonSageMaker*",
      "Condition": {
        "ArnEquals": {
          "iam:PolicyARN": [
            "arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy",
            "arn:aws:iam::aws:policy/SageMakerStudioUserIAMPermissiveExecutionPolicy",
            "arn:aws:iam::aws:policy/service-role/AmazonS3TablesLakeFormationServiceRole",
            "arn:aws:iam::aws:policy/service-role/SageMakerStudioDataAppsAccessRolePolicy"
          ]
        }
      }
    },
    {
      "Sid": "SourceIdentity",
      "Effect": "Allow",
      "Action": "sts:SetSourceIdentity",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}"
        }
      }
    },
    {
      "Sid": "PassRoleForProvisioning",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "iam:PassedToService": [
            "sagemaker.amazonaws.com",
            "lakeformation.amazonaws.com",
            "athena.amazonaws.com",
            "glue.amazonaws.com",
            "datazone.amazonaws.com",
            "airflow-serverless.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "PassRole",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/service-role/AmazonSageMaker*",
        "arn:aws:iam::*:role/${aws:PrincipalTag/AmazonDataZonePassedRolePath}"
      ],
      "Condition": {
        "StringEquals": {
          "iam:PassedToService": [
            "datazone.amazonaws.com",
            "bedrock.amazonaws.com",
            "bedrock-agentcore.amazonaws.com",
            "agent-registry.amazonaws.com",
            "scheduler.amazonaws.com",
            "emr-serverless.amazonaws.com",
            "elasticmapreduce.amazonaws.com",
            "redshift.amazonaws.com",
            "airflow-serverless.amazonaws.com",
            "events.amazonaws.com",
            "pods.eks.amazonaws.com",
            "access-grants.s3.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "Q",
      "Effect": "Allow",
      "Action": [
        "glue:StartCompletion",
        "q:Get*",
        "q:List*",
        "q:PassRequest",
        "q:SendMessage",
        "q:StartConversation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSMParameter",
      "Effect": "Allow",
      "Action": [
        "ssm:DeleteParameter",
        "ssm:GetParameter*",
        "ssm:PutParameter"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:parameter/amazon/datazone/q*",
        "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/*",
        "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*"
      ]
    },
    {
      "Sid": "ManageSageMakerSpace",
      "Effect": "Allow",
      "Action": "sagemaker:*",
      "Resource": [
        "arn:aws:sagemaker:*:*:app/*",
        "arn:aws:sagemaker:*:*:space/*",
        "arn:aws:sagemaker:*:*:domain/*",
        "arn:aws:sagemaker:*:*:user-profile/*"
      ]
    },
    {
      "Sid": "ResourceGroupsPermissions",
      "Effect": "Allow",
      "Action": [
        "resource-groups:GetGroupQuery",
        "resource-groups:ListGroupResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SageMakerPermissions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddTags",
        "sagemaker:Batch*",
        "sagemaker:DeleteTags",
        "sagemaker:Describe*",
        "sagemaker:List*",
        "sagemaker:Search",
        "sagemaker:*Endpoint*",
        "sagemaker:*Model*",
        "sagemaker:*Context*",
        "sagemaker:*Artifact*",
        "sagemaker:*Action*",
        "sagemaker:*Association*",
        "sagemaker:QueryLineage",
        "sagemaker:*InferenceComponent*",
        "sagemaker:*Job*",
        "sagemaker:*MlflowApp*",
        "sagemaker:StartMlflowTrackingServer",
        "sagemaker:StopMlflowTrackingServer",
        "sagemaker:CreatePresignedMlflowTrackingServerUrl",
        "sagemaker-mlflow:*",
        "sagemaker:*Feature*",
        "sagemaker:*Record"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CreateBucket",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket",
        "s3:DeleteBucketPolicy",
        "s3:Get*",
        "s3:Put*",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload"
      ],
      "Resource": [
        "arn:aws:s3:::amazon-sagemaker*"
      ]
    },
    {
      "Sid": "S3List",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketAcl",
        "s3:GetAccessGrantsInstance",
        "s3:GetAccessGrantsInstanceForPrefix",
        "s3:GetDataAccess",
        "s3:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CrossAccount",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject*",
        "s3:List*",
        "s3:PutObject*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CfnManage",
      "Effect": "Allow",
      "Action": [
        "cloudformation:*"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/DataZone*",
        "arn:aws:cloudformation:*:*:transform/*"
      ]
    },
    {
      "Sid": "ValidateCfn",
      "Effect": "Allow",
      "Action": "cloudformation:ValidateTemplate",
      "Resource": "*"
    },
    {
      "Sid": "LogsAndMetrics",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:PutMetricData",
        "cloudwatch:GetMetricData",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:PutMetricAlarm",
        "cloudwatch:DeleteAlarms",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:Describe*",
        "logs:Get*",
        "logs:PutLogEvents",
        "logs:StopQuery",
        "logs:StartQuery"
      ],
      "Resource": "*"
    },
    {
      "Sid": "LFManage",
      "Effect": "Allow",
      "Action": [
        "lakeformation:BatchGrantPermissions",
        "lakeformation:BatchRevokePermissions",
        "lakeformation:DeregisterResource",
        "lakeformation:DescribeResource",
        "lakeformation:GetDataAccess",
        "lakeformation:GetDataLakeSettings",
        "lakeformation:GrantPermissions",
        "lakeformation:ListPermissions",
        "lakeformation:ListResources",
        "lakeformation:PutDataLakeSettings",
        "lakeformation:RegisterResource",
        "lakeformation:RevokePermissions",
        "lakeformation:ListLakeFormationOptIns",
        "lakeformation:CreateLakeFormationOptIn",
        "lakeformation:DeleteLakeFormationOptIn",
        "lakeformation:*DataCellsFilter"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GlueDatabase",
      "Effect": "Allow",
      "Action": [
        "glue:*"
      ],
      "Resource": [
        "arn:aws:glue:*:*:database/*",
        "arn:aws:glue:*:*:table/*",
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:catalog/*",
        "arn:aws:glue:*:*:connection/*"
      ]
    },
    {
      "Sid": "GlueLakeFormation",
      "Effect": "Allow",
      "Action": [
        "glue:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "glue:LakeFormationPermissions": "Enabled"
        }
      }
    },
    {
      "Sid": "Glue",
      "Effect": "Allow",
      "Action": [
        "glue:CancelStatement",
        "glue:CreateSession",
        "glue:DeleteSession",
        "glue:Describe*",
        "glue:Get*",
        "glue:List*",
        "glue:NotifyEvent",
        "glue:RunStatement",
        "glue:StartCompletion",
        "glue:StopSession",
        "glue:*Resource",
        "glue:UseGlueStudio",
        "glue:*Job*",
        "glue:TestConnection",
        "glue:*DataQuality*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyForeignSessionAccess",
      "Effect": "Deny",
      "Action": [
        "athena:GetResourceDashboard",
        "athena:GetSession",
        "athena:GetSessionEndpoint",
        "athena:GetSessionStatus",
        "athena:StartSession",
        "athena:TerminateSession",
        "emr-serverless:*Session*",
        "emr-serverless:*Dashboard*",
        "emr-containers:*ManagedEndpoint*",
        "elasticmapreduce:*Session*",
        "glue:CancelStatement",
        "glue:CreateSession",
        "glue:DeleteSession",
        "glue:GetDashboardUrl",
        "glue:GetSession",
        "glue:GetSessionEndpoint",
        "glue:GetStatement",
        "glue:RunStatement",
        "glue:StopSession"
      ],
      "Resource": [
        "arn:aws:athena:*:*:workgroup/*/session/*",
        "arn:aws:emr-serverless:*:*:/applications/*/sessions/*",
        "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*",
        "arn:aws:elasticmapreduce:*:*:cluster/*/session/*",
        "arn:aws:glue:*:*:session/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:RequestTag/AmazonDataZoneSessionOwner": "${aws:SourceIdentity}",
          "aws:ResourceTag/AmazonDataZoneSessionOwner": "${aws:SourceIdentity}"
        }
      }
    },
    {
      "Sid": "DenyTaggingUntaggingForeignSessions",
      "Effect": "Deny",
      "Action": [
        "athena:TagResource",
        "athena:UntagResource",
        "emr-serverless:*Resource",
        "emr-containers:*Resource",
        "elasticmapreduce:AddTags",
        "elasticmapreduce:RemoveTags",
        "glue:TagResource",
        "glue:UntagResource"
      ],
      "Resource": [
        "arn:aws:athena:*:*:workgroup/*/session/*",
        "arn:aws:emr-serverless:*:*:/applications/*/sessions/*",
        "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*",
        "arn:aws:elasticmapreduce:*:*:cluster/*/session/*",
        "arn:aws:glue:*:*:session/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceTag/AmazonDataZoneSessionOwner": "${aws:SourceIdentity}"
        }
      }
    },
    {
      "Sid": "SQLWorkBench",
      "Effect": "Allow",
      "Action": [
        "sqlworkbench:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RedshiftData",
      "Effect": "Allow",
      "Action": "redshift-data:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "redshift-data:statement-owner-iam-userid": "${aws:userid}"
        }
      }
    },
    {
      "Sid": "RedShiftActions",
      "Effect": "Allow",
      "Action": [
        "redshift-data:BatchExecuteStatement",
        "redshift-data:Describe*",
        "redshift-data:ExecuteStatement",
        "redshift-data:List*",
        "redshift-serverless:GetManagedWorkgroup",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetWorkgroup",
        "redshift-serverless:List*",
        "redshift:Describe*",
        "redshift:GetClusterCredentialsWithIAM",
        "redshift-serverless:GetCredentials"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Bedrock",
      "Effect": "Allow",
      "Action": "bedrock:*",
      "Resource": "*"
    },
    {
      "Sid": "FederatedConn",
      "Effect": "Allow",
      "Action": [
        "dynamodb:List*",
        "dynamodb:Describe*",
        "dynamodb:Scan",
        "dynamodb:PartiQLSelect",
        "dynamodb:Query",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Athena",
      "Effect": "Allow",
      "Action": [
        "athena:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AirflowServerless",
      "Effect": "Allow",
      "Action": [
        "airflow-serverless:List*",
        "airflow-serverless:Get*",
        "airflow-serverless:CreateWorkflow",
        "airflow-serverless:UpdateWorkflow",
        "airflow-serverless:DeleteWorkflow",
        "airflow-serverless:StartWorkflowRun",
        "airflow-serverless:StopWorkflowRun",
        "airflow-serverless:TagResource",
        "airflow-serverless:UntagResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AirflowMWAA",
      "Effect": "Allow",
      "Action": [
        "airflow:GetEnvironment",
        "airflow:ListEnvironments",
        "airflow:CreateWebLoginToken",
        "airflow:InvokeRestApi"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ManagePrivateSecret",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:TagResource",
        "secretsmanager:UpdateSecret",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:PutSecretValue"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneProject": "false"
        }
      }
    },
    {
      "Sid": "ManageSharedSecret",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:TagResource",
        "secretsmanager:UpdateSecret",
        "secretsmanager:PutSecretValue"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneProject": "true"
        },
        "StringEquals": {
          "aws:ResourceTag/for-use-with-all-datazone-projects": "true"
        }
      }
    },
    {
      "Sid": "RedshiftSecret",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:RotateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:UpdateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:TagResource"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:redshift!*"
    },
    {
      "Sid": "GenerateRecommendations",
      "Effect": "Allow",
      "Action": [
        "codewhisperer:GenerateRecommendations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ManageScheduler",
      "Effect": "Allow",
      "Action": "scheduler:*",
      "Resource": "*"
    },
    {
      "Sid": "Ecr",
      "Effect": "Allow",
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CodeConnectionsAdmin",
      "Effect": "Allow",
      "Action": [
        "codeconnections:*",
        "codestar-connections:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "KmsListAndDescribe",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:ListAliases",
        "kms:ListGrants"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataZoneKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "kms:Encrypt",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:ReEncryptTo",
        "kms:ReEncryptFrom"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:datazone:domainId"
        },
        "StringLike": {
          "kms:ViaService": "datazone.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "S3Kms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:s3:arn": "false"
        },
        "StringLike": {
          "kms:ViaService": "s3.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SchedulerKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:scheduler:schedule:arn": "false"
        }
      }
    },
    {
      "Sid": "SecretsKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:SecretARN": "false"
        },
        "StringLike": {
          "kms:ViaService": "secretsmanager.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SageMakerKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:ReEncryptTo",
        "kms:ReEncryptFrom"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContextKeys": "false"
        },
        "StringLike": {
          "kms:ViaService": "sagemaker.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SageMakerCreateGrant",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:ViaService": "sagemaker.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "DataZoneCreateGrant",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant"
      ],
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "kms:GrantOperations": [
            "Encrypt",
            "Decrypt",
            "ReEncryptFrom",
            "ReEncryptTo",
            "GenerateDataKeyWithoutPlaintext",
            "GenerateDataKey",
            "DescribeKey",
            "RetireGrant",
            "CreateGrant"
          ]
        },
        "StringLike": {
          "kms:ViaService": "datazone.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "GlueKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContextKeys": "false"
        },
        "StringLike": {
          "kms:ViaService": "glue.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "BedrockKms",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContextKeys": "false"
        },
        "StringLike": {
          "kms:ViaService": "bedrock.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "WorkflowsCreateGrant",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant"
      ],
      "Resource": "arn:*:kms:*:*:key/*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "kms:GrantOperations": [
            "Decrypt",
            "Encrypt",
            "GenerateDataKey",
            "GenerateDataKeyWithoutPlaintext",
            "RetireGrant"
          ]
        },
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:airflow-serverless:workflow-arn"
        },
        "StringLike": {
          "kms:ViaService": "airflow-serverless.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "WorkflowsKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext"
      ],
      "Resource": "arn:*:kms:*:*:key/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:airflow-serverless:workflow-arn"
        }
      }
    },
    {
      "Sid": "CreateSG",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateSecurityGroup"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*",
        "arn:aws:ec2:*:*:vpc/*"
      ]
    },
    {
      "Sid": "SGManage",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteSecurityGroup",
        "ec2:RevokeSecurityGroupEgress",
        "ec2:RevokeSecurityGroupIngress"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*"
      ]
    },
    {
      "Sid": "SGAuth",
      "Effect": "Allow",
      "Action": [
        "ec2:AuthorizeSecurityGroupEgress",
        "ec2:AuthorizeSecurityGroupIngress"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:security-group/*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneProject": "false"
        }
      }
    },
    {
      "Sid": "Ec2DescribeOnly",
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*"
    },
    {
      "Sid": "SGCreateTags",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": "arn:aws:ec2:*:*:security-group/*",
      "Condition": {
        "ForAllValues:StringLike": {
          "aws:TagKeys": [
            "AmazonDataZone*",
            "for-use-with-amazon-emr-managed-policies",
            "aws:cloudformation:*"
          ]
        }
      }
    },
    {
      "Sid": "VpcAccess",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:CreateNetworkInterfacePermission",
        "ec2:DeleteNetworkInterfacePermission",
        "ec2:CreateVpcEndpoint"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2TagAccessForVpc",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags",
        "ec2:DeleteTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:network-interface/*"
      ]
    },
    {
      "Sid": "EMR",
      "Effect": "Allow",
      "Action": [
        "emr-serverless:Get*",
        "emr-serverless:List*",
        "emr-serverless:Start*",
        "emr-serverless:Access*",
        "emr-serverless:Terminate*",
        "emr-serverless:*Resource",
        "emr-containers:*ManagedEndpoint*",
        "emr-containers:*SecurityConfiguration*",
        "emr-containers:*VirtualCluster*",
        "emr-containers:*Resource",
        "elasticmapreduce:*PersistentAppUI*",
        "elasticmapreduce:Start*",
        "elasticmapreduce:Get*",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:List*",
        "elasticmapreduce:Terminate*",
        "elasticmapreduce:*Tag*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSOApplicationPermissions",
      "Effect": "Allow",
      "Action": [
        "identitystore:DescribeUser",
        "identitystore:DescribeGroup",
        "sso:CreateApplication",
        "sso:DeleteApplication",
        "sso:DescribeInstance",
        "sso:DescribeApplication",
        "sso:PutApplicationGrant",
        "sso:PutApplicationAssignmentConfiguration",
        "sso:PutApplicationAuthenticationMethod",
        "sso:PutApplicationAccessScope",
        "sso:UpdateApplication",
        "sso:CreateApplicationAssignment",
        "sso:DeleteApplicationAssignment"
      ],
      "Resource": "*",
      "Condition": {
        "Bool": {
          "aws:ViaAWSService": "true"
        }
      }
    },
    {
      "Sid": "SSOReadOnlyPermissions",
      "Effect": "Allow",
      "Action": [
        "sso:ListInstances",
        "organizations:DescribeOrganization"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSOKMSPermissions",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:sso:instance-arn": "false"
        },
        "StringLike": {
          "kms:ViaService": "sso.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IdentityStoreKMSPermissions",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:identitystore:identitystore-arn": "false"
        },
        "StringLike": {
          "kms:ViaService": "identitystore.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "RAMReadOnlyPermissions",
      "Effect": "Allow",
      "Action": [
        "ram:Get*",
        "ram:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RAMCreateResourcePermission",
      "Effect": "Allow",
      "Action": [
        "ram:CreateResourceShare"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ram:RequestedResourceType": "datazone:Domain"
        }
      }
    },
    {
      "Sid": "RAMResourceSharePermissions",
      "Effect": "Allow",
      "Action": [
        "ram:AssociateResourceShare",
        "ram:DisassociateResourceShare",
        "ram:DeleteResourceShare"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ram:ResourceShareName": [
            "DataZone*"
          ]
        }
      }
    },
    {
      "Sid": "RAMAssociateResourceSharePermission",
      "Effect": "Allow",
      "Action": "ram:AssociateResourceSharePermission",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ram:PermissionArn": [
            "arn:aws:ram::aws:permission/AWSRAMDefaultPermissionAmazonDataZoneDomain",
            "arn:aws:ram::aws:permission/AWSRAMPermissionAmazonDataZoneDomainFullAccessWithPortalAccess",
            "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceAccess",
            "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceWithPortalAccess"
          ]
        }
      }
    },
    {
      "Sid": "CanvasGeneralPermissions",
      "Effect": "Allow",
      "Action": [
        "comprehend:*",
        "textract:*",
        "rekognition:*",
        "sagemaker-data-science-assistant:*",
        "rds:DescribeDBInstances",
        "application-autoscaling:PutScalingPolicy",
        "application-autoscaling:RegisterScalableTarget",
        "application-autoscaling:DescribeScalingActivities",
        "quicksight:ListNamespaces",
        "events:PutRule",
        "events:DescribeRule",
        "events:PutTargets",
        "events:TagResource",
        "events:ListTagsForResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CanvasRedshiftAccess",
      "Effect": "Allow",
      "Action": [
        "redshift:GetClusterCredentials"
      ],
      "Resource": [
        "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*",
        "arn:aws:redshift:*:*:dbname:*"
      ]
    },
    {
      "Sid": "AgentCore",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:*",
      "Resource": "*"
    },
    {
      "Sid": "ACXRay",
      "Effect": "Allow",
      "Action": [
        "xray:GetTraceSegmentDestination",
        "xray:GetSamplingRules",
        "xray:GetSamplingTargets",
        "xray:PutTraceSegments",
        "xray:PutTelemetryRecords"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ACLogRetention",
      "Effect": "Allow",
      "Action": "logs:PutRetentionPolicy",
      "Resource": "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": "bedrock-agentcore.amazonaws.com"
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "TagLookup",
      "Effect": "Allow",
      "Action": [
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3AGObjectPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:GetObjectAcl",
        "s3:GetObjectVersionAcl",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:PutObjectVersionAcl"
      ],
      "Resource": "*",
      "Condition": {
        "ArnEquals": {
          "s3:AccessGrantsInstanceArn": [
            "arn:aws:s3:*:*:access-grants/default"
          ]
        }
      }
    },
    {
      "Sid": "S3AGInstancePermissions",
      "Effect": "Allow",
      "Action": [
        "s3:AssociateAccessGrantsIdentityCenter",
        "s3:GetAccessGrantsInstance",
        "s3:CreateAccessGrantsInstance"
      ],
      "Resource": [
        "arn:aws:s3:*:*:access-grants/default"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3AGLocationPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:CreateAccessGrantsLocation",
        "s3:DeleteAccessGrantsLocation",
        "s3:GetAccessGrantsLocation"
      ],
      "Resource": "arn:aws:s3:*:*:access-grants/default/location/*",
      "Condition": {
        "Null": {
          "aws:PrincipalTag/AmazonDataZoneProjectBucket": "false"
        },
        "StringEquals": {
          "s3:accessGrantsLocationScope": "s3://${aws:PrincipalTag/AmazonDataZoneProjectBucket}"
        }
      }
    },
    {
      "Sid": "S3AGPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:CreateAccessGrant",
        "s3:DeleteAccessGrant"
      ],
      "Resource": "arn:aws:s3:*:*:access-grants/default/grant/*",
      "Condition": {
        "Null": {
          "aws:PrincipalTag/AmazonDataZoneProjectBucket": "false"
        },
        "StringLike": {
          "s3:accessGrantScope": "s3://${aws:PrincipalTag/AmazonDataZoneProjectBucket}/*"
        }
      }
    },
    {
      "Sid": "S3AGTaggingPermission",
      "Effect": "Allow",
      "Action": [
        "s3:TagResource"
      ],
      "Resource": [
        "arn:aws:s3:*:*:access-grants/default/location/*",
        "arn:aws:s3:*:*:access-grants/default/grant/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3TableBucketPermissions",
      "Effect": "Allow",
      "Action": [
        "s3tables:CreateTableBucket",
        "s3tables:PutTableBucketPolicy"
      ],
      "Resource": "arn:aws:s3tables:*:*:bucket/aws-sagemaker-unified-studio"
    }
  ]
}

Version history

Current version v28, edited by AWS on 2026-10-29. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioAdminIAMDefaultExecutionPolicy
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioAdminIAMDefaultExecutionPolicy
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioAdminIAMDefaultExecutionPolicy

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SageMakerStudioAdminIAMDefaultExecutionPolicy

resource "aws_iam_role_policy_attachment" "sagemakerstudioadminiamdefaultexecutionpolicy" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/SageMakerStudioAdminIAMDefaultExecutionPolicy"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("SageMakerStudioAdminIAMDefaultExecutionPolicy"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for SageMakerStudioAdminIAMDefaultExecutionPolicy
• Report a data issue