SageMakerStudioFullAccess

Summary

This policy provides full access to Amazon SageMaker Unified Studio via the Amazon SageMaker management console.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/SageMakerStudioFullAccessCopy ARN

Default version

v15

Created

2024-11-28

Last edited

2026-02-12

Services

aoss, bedrock, cloudformation, codeconnections, codewhisperer, datazone, ec2, glue, iam, kms, quicksight, ram, redshift, redshift-serverless, s3, secretsmanager, ssm, sso

Control-plane actions (338)

By access level: 73 List, 7 Permissions management, 81 Read, 6 Tagging, 171 Write.

Data-plane actions (4)

By access level: 2 List, 1 Read, 1 Write.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: datazone (159 of 159).
• Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

• AmazonDataZoneDomainExecutionRolePolicy
• AmazonDataZoneEnvironmentRolePermissionsBoundary
• AmazonDataZoneFullAccess
• AmazonDataZoneFullUserAccess
• AmazonDataZoneProjectRolePermissionsBoundary
• AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
• SageMakerStudioAdminIAMConsolePolicy
• SageMakerStudioDataAppsAccessRolePolicy

Same domain

• AmazonAthenaFullAccess
• AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy
• AmazonChimeSDKMessagingServiceRolePolicy
• AmazonDataZoneGlueManageAccessRolePolicy
• AmazonDataZoneRedshiftGlueProvisioningPolicy
• AmazonDataZoneRedshiftManageAccessRolePolicy
• AmazonElasticMapReduceforAutoScalingRole
• AmazonElasticMapReduceReadOnlyAccess

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AmazonDataZoneStatement",
      "Effect": "Allow",
      "Action": [
        "datazone:*"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "ReadOnlyStatement",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:ListAliases",
        "iam:ListRoles",
        "iam:ListPolicies",
        "sso:DescribeRegisteredRegions",
        "s3:ListAllMyBuckets",
        "redshift:DescribeClusters",
        "redshift-serverless:ListWorkgroups",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSubnets",
        "ec2:DescribeVpcs",
        "secretsmanager:ListSecrets",
        "iam:ListUsers",
        "glue:GetDatabases",
        "codeconnections:ListConnections",
        "codeconnections:ListTagsForResource",
        "codewhisperer:ListProfiles",
        "bedrock:ListInferenceProfiles",
        "bedrock:ListFoundationModels",
        "bedrock:ListTagsForResource",
        "aoss:ListSecurityPolicies",
        "quicksight:DescribeAccountSubscription",
        "cloudformation:ValidateTemplate"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Sid": "BucketReadOnlyStatement",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation",
        "s3:ListBucketVersions"
      ],
      "Resource": "arn:aws:s3:::*"
    },
    {
      "Sid": "ReadManagedBlueprintTemplatesStatement",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": [
        "arn:aws:s3:::default-env-blueprint-*/*",
        "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint*"
      ],
      "Condition": {
        "ArnLike": {
          "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint"
        },
        "StringNotEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "CreateBucketStatement",
      "Effect": "Allow",
      "Action": [
        "s3:CreateBucket"
      ],
      "Resource": [
        "arn:aws:s3:::amazon-datazone*",
        "arn:aws:s3:::amazon-sagemaker*"
      ]
    },
    {
      "Sid": "ConfigureBucketStatement",
      "Effect": "Allow",
      "Action": [
        "s3:PutBucketCORS",
        "s3:PutBucketPolicy",
        "s3:PutBucketVersioning"
      ],
      "Resource": [
        "arn:aws:s3:::amazon-sagemaker*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "PutObjectStatement",
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::amazon-sagemaker*/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "RamCreateResourceStatement",
      "Effect": "Allow",
      "Action": [
        "ram:CreateResourceShare"
      ],
      "Resource": "*",
      "Condition": {
        "StringEqualsIfExists": {
          "ram:RequestedResourceType": "datazone:Domain"
        }
      }
    },
    {
      "Sid": "RamResourceStatement",
      "Effect": "Allow",
      "Action": [
        "ram:DeleteResourceShare",
        "ram:AssociateResourceShare",
        "ram:DisassociateResourceShare",
        "ram:RejectResourceShareInvitation"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ram:ResourceShareName": [
            "DataZone*"
          ]
        }
      }
    },
    {
      "Sid": "RamResourceReadOnlyStatement",
      "Effect": "Allow",
      "Action": [
        "ram:GetResourceShares",
        "ram:GetResourceShareInvitations",
        "ram:GetResourceShareAssociations",
        "ram:ListResourceSharePermissions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RamAssociateResourceSharePermissionStatement",
      "Effect": "Allow",
      "Action": "ram:AssociateResourceSharePermission",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ram:PermissionArn": [
            "arn:aws:ram::aws:permission/AWSRAMDefaultPermissionAmazonDataZoneDomain",
            "arn:aws:ram::aws:permission/AWSRAMPermissionAmazonDataZoneDomainFullAccessWithPortalAccess",
            "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceAccess",
            "arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceWithPortalAccess"
          ]
        }
      }
    },
    {
      "Sid": "IAMPassRoleStatement",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": [
        "arn:aws:iam::*:role/AmazonDataZone*",
        "arn:aws:iam::*:role/service-role/AmazonDataZone*",
        "arn:aws:iam::*:role/service-role/AmazonSageMaker*"
      ],
      "Condition": {
        "StringEquals": {
          "iam:passedToService": "datazone.amazonaws.com"
        }
      }
    },
    {
      "Sid": "IAMGetPolicyStatement",
      "Effect": "Allow",
      "Action": "iam:GetPolicy",
      "Resource": [
        "arn:aws:iam::*:policy/service-role/AmazonDataZoneRedshiftAccessPolicy*"
      ]
    },
    {
      "Sid": "DataZoneTagOnCreateDomainProjectTags",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:TagResource"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "AmazonDataZoneDomain",
            "AmazonDataZoneProject"
          ]
        },
        "StringLike": {
          "aws:RequestTag/AmazonDataZoneDomain": "dzd*",
          "aws:ResourceTag/AmazonDataZoneDomain": "dzd*"
        }
      }
    },
    {
      "Sid": "DataZoneTagOnCreate",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:TagResource"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "AmazonDataZoneDomain"
          ]
        },
        "StringLike": {
          "aws:RequestTag/AmazonDataZoneDomain": "dzd*",
          "aws:ResourceTag/AmazonDataZoneDomain": "dzd*"
        }
      }
    },
    {
      "Sid": "CreateSecretStatement",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret"
      ],
      "Resource": "arn:aws:secretsmanager:*:*:secret:AmazonDataZone-*",
      "Condition": {
        "StringLike": {
          "aws:RequestTag/AmazonDataZoneDomain": "dzd*"
        }
      }
    },
    {
      "Sid": "ConnectionStatement",
      "Effect": "Allow",
      "Action": [
        "codeconnections:GetConnection"
      ],
      "Resource": [
        "arn:aws:codeconnections:*:*:connection/*"
      ]
    },
    {
      "Sid": "TagCodeConnectionsStatement",
      "Effect": "Allow",
      "Action": [
        "codeconnections:TagResource"
      ],
      "Resource": [
        "arn:aws:codeconnections:*:*:connection/*",
        "arn:aws:codeconnections:*:*:host/*"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "for-use-with-all-datazone-projects"
          ]
        },
        "StringEquals": {
          "aws:RequestTag/for-use-with-all-datazone-projects": "true"
        }
      }
    },
    {
      "Sid": "UntagCodeConnectionsStatement",
      "Effect": "Allow",
      "Action": [
        "codeconnections:UntagResource"
      ],
      "Resource": [
        "arn:aws:codeconnections:*:*:connection/*",
        "arn:aws:codeconnections:*:*:host/*"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "aws:TagKeys": "for-use-with-all-datazone-projects"
        }
      }
    },
    {
      "Sid": "SSMParameterStatement",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParametersByPath",
        "ssm:PutParameter",
        "ssm:DeleteParameter"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:parameter/amazon/datazone/q*",
        "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI*",
        "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*"
      ]
    },
    {
      "Sid": "UseKMSKeyPermissionsStatement",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/EnableKeyForAmazonDataZone": "true"
        },
        "Null": {
          "aws:ResourceTag/EnableKeyForAmazonDataZone": "false"
        },
        "StringLike": {
          "kms:ViaService": "ssm.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SecurityPolicyStatement",
      "Effect": "Allow",
      "Action": [
        "aoss:GetSecurityPolicy",
        "aoss:CreateSecurityPolicy"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringLike": {
          "aoss:collection": "bedrock-ide-*"
        }
      }
    },
    {
      "Sid": "GetFoundationModelStatement",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetFoundationModel",
        "bedrock:GetFoundationModelAvailability"
      ],
      "Resource": [
        "arn:aws:bedrock:*::foundation-model/*"
      ]
    },
    {
      "Sid": "GetInferenceProfileStatement",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetInferenceProfile"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:inference-profile/*",
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ]
    },
    {
      "Sid": "ApplicationInferenceProfileStatement",
      "Effect": "Allow",
      "Action": [
        "bedrock:CreateInferenceProfile"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ],
      "Condition": {
        "Null": {
          "aws:RequestTag/AmazonDataZoneProject": "true",
          "aws:RequestTag/AmazonDataZoneDomain": "false"
        }
      }
    },
    {
      "Sid": "TagApplicationInferenceProfileStatement",
      "Effect": "Allow",
      "Action": [
        "bedrock:TagResource"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneProject": "true",
          "aws:RequestTag/AmazonDataZoneProject": "true",
          "aws:ResourceTag/AmazonDataZoneDomain": "false",
          "aws:RequestTag/AmazonDataZoneDomain": "false"
        }
      }
    },
    {
      "Sid": "DeleteApplicationInferenceProfileStatement",
      "Effect": "Allow",
      "Action": [
        "bedrock:DeleteInferenceProfile"
      ],
      "Resource": [
        "arn:aws:bedrock:*:*:application-inference-profile/*"
      ],
      "Condition": {
        "Null": {
          "aws:ResourceTag/AmazonDataZoneProject": "true",
          "aws:ResourceTag/AmazonDataZoneDomain": "false"
        }
      }
    },
    {
      "Sid": "ModelAccessUseCaseStatement",
      "Effect": "Allow",
      "Action": [
        "bedrock:GetUseCaseForModelAccess",
        "bedrock:PutUseCaseForModelAccess"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

Version history

Current version v15, edited by AWS on 2026-02-12. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioFullAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SageMakerStudioFullAccess

resource "aws_iam_role_policy_attachment" "sagemakerstudiofullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/SageMakerStudioFullAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("SageMakerStudioFullAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for SageMakerStudioFullAccess
• Report a data issue