SageMakerStudioUserIAMDefaultExecutionPolicy

Summary

Execution policy for using IAM roles with SageMaker Unified Studio. Allows users to access resources in the local account (excluding access to data resources) for IAM-based usage of SageMaker Unified Studio.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicyCopy ARN

Default version

v32

Created

2025-08-18

Last edited

2026-10-29

Services

airflow, airflow-serverless, application-autoscaling, athena, bedrock, bedrock-agentcore, cloudformation, cloudwatch, codeconnections, codestar-connections, codewhisperer, comprehend, datazone, dynamodb, ec2, ecr, ecr-public, elasticmapreduce, emr-containers, emr-serverless, events, glue, iam, identitystore, kms, lakeformation, logs, q, quicksight, rds, redshift, redshift-data, redshift-serverless, rekognition, resource-groups, s3, sagemaker, sagemaker-data-science-assistant, sagemaker-mlflow, scheduler, secretsmanager, sqlworkbench, ssm, sso, sts, tag, textract, xray

Control-plane actions (2022)

By access level: 600 List, 56 Permissions management, 628 Read, 25 Tagging, 713 Write.

The full action list is in actions.json.

Data-plane actions (109)

By access level: 15 List, 2 Permissions management, 44 Read, 4 Tagging, 44 Write.

The full action list is in actions.json.

Excluded and conditional actions

• athena:GetResourceDashboard (deny-conditional, statement 18): 1 matching actions
• athena:GetSession (deny-conditional, statement 18): 1 matching actions
• athena:GetSessionEndpoint (deny-conditional, statement 18): 1 matching actions
• athena:GetSessionStatus (deny-conditional, statement 18): 1 matching actions
• athena:StartSession (deny-conditional, statement 18): 1 matching actions
• athena:TerminateSession (deny-conditional, statement 18): 1 matching actions
• elasticmapreduce:*Session* (deny-conditional, statement 18): 11 matching actions
• emr-containers:*ManagedEndpoint* (deny-conditional, statement 18): 5 matching actions
• emr-serverless:*Dashboard* (deny-conditional, statement 18): 2 matching actions
• emr-serverless:*Session* (deny-conditional, statement 18): 5 matching actions
• glue:CancelStatement (deny-conditional, statement 18): 1 matching actions
• glue:CreateSession (deny-conditional, statement 18): 1 matching actions
• glue:DeleteSession (deny-conditional, statement 18): 1 matching actions
• glue:GetDashboardUrl (deny-conditional, statement 18): 1 matching actions
• glue:GetSession (deny-conditional, statement 18): 1 matching actions
• glue:GetSessionEndpoint (deny-conditional, statement 18): 1 matching actions
• glue:GetStatement (deny-conditional, statement 18): 1 matching actions
• glue:RunStatement (deny-conditional, statement 18): 1 matching actions
• glue:StopSession (deny-conditional, statement 18): 1 matching actions
• athena:TagResource (deny-conditional, statement 19): 1 matching actions
• athena:UntagResource (deny-conditional, statement 19): 1 matching actions
• elasticmapreduce:AddTags (deny-conditional, statement 19): 1 matching actions
• elasticmapreduce:RemoveTags (deny-conditional, statement 19): 1 matching actions
• emr-containers:*Resource (deny-conditional, statement 19): 3 matching actions
• emr-serverless:*Resource (deny-conditional, statement 19): 3 matching actions
• glue:TagResource (deny-conditional, statement 19): 1 matching actions
• glue:UntagResource (deny-conditional, statement 19): 1 matching actions

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants at least 80% of the write and permissions-management actions of: airflow-serverless (5 of 5), bedrock (136 of 136), sagemaker-mlflow (41 of 41), sqlworkbench (45 of 45).
• Grants data-plane write actions on a data store, but only for scoped resources or under conditions.
• Grants iam:PassRole, but only for scoped roles or under conditions (for example iam:PassedToService).

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

• AmazonAthenaFullAccess
• AmazonAugmentedAIFullAccess
• AmazonAugmentedAIHumanLoopFullAccess
• AmazonAugmentedAIIntegratedAPIAccess
• AmazonBedrockAgentCoreMemoryBedrockModelInferenceExecutionRolePolicy
• AmazonBedrockFullAccess
• AmazonBedrockLimitedAccess
• AmazonBedrockMarketplaceAccess

Same domain

• AgentRegistryFullAccess
• AgentRegistryReadOnlyAccess
• AIOpsAssistantIncidentReportPolicy
• AIOpsAssistantPolicy
• AIOpsConsoleAdminPolicy
• AIOpsOperatorAccess
• AIOpsReadOnlyAccess
• AmazonBedrockExternalWebSearchFullAccess

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DataZone",
      "Effect": "Allow",
      "Action": [
        "datazone:AcceptPredictions",
        "datazone:AcceptSubscriptionRequest",
        "datazone:BatchGetAttributesMetadata",
        "datazone:BatchPutAttributesMetadata",
        "datazone:BatchUpdateNotifications",
        "datazone:CancelMetadataGenerationRun",
        "datazone:CancelSubscription",
        "datazone:CreateAsset*",
        "datazone:CreateConnection",
        "datazone:CreateEnvironment",
        "datazone:CreateListingChangeSet",
        "datazone:CreateProject",
        "datazone:CreateProjectMembership",
        "datazone:CreateSubscriptionGrant",
        "datazone:CreateSubscriptionRequest",
        "datazone:DeleteAsset*",
        "datazone:DeleteConnection",
        "datazone:DeleteEnvironment",
        "datazone:DeleteListing",
        "datazone:DeleteProject",
        "datazone:DeleteProjectMembership",
        "datazone:DeleteSubscriptionGrant",
        "datazone:DeleteSubscriptionRequest",
        "datazone:Get*",
        "datazone:List*",
        "datazone:PostLineageEvent",
        "datazone:RejectPredictions",
        "datazone:RejectSubscriptionRequest",
        "datazone:RevokeSubscription",
        "datazone:Search",
        "datazone:SearchListings",
        "datazone:SearchRules",
        "datazone:SearchTypes",
        "datazone:SearchUserProfiles",
        "datazone:SearchGroupProfiles",
        "datazone:StartMetadataGenerationRun",
        "datazone:UpdateAssetFilter",
        "datazone:UpdateConnection",
        "datazone:UpdateEnvironment",
        "datazone:UpdateProject",
        "datazone:UpdateSubscriptionRequest",
        "datazone:*Notebook*",
        "datazone:CreateCell",
        "datazone:UpdateCell",
        "datazone:DeleteCell",
        "datazone:BatchGetCell",
        "datazone:CreateCellRun",
        "datazone:UpdateCellRun",
        "datazone:DeleteCellRun",
        "datazone:BatchGetCellRun",
        "datazone:PutCellRunResult",
        "datazone:StartConversation",
        "datazone:GenerateCode",
        "datazone:SendMessage",
        "datazone:CancelMessage",
        "datazone:QueryGraph",
        "datazone:StartCompute",
        "datazone:StopCompute",
        "datazone:InvokeAgent",
        "datazone:StopAgent",
        "datazone:RegisterAgentArtifact",
        "datazone:DeregisterAgentArtifact",
        "datazone:DeleteConversation",
        "datazone:UpdateConversation",
        "datazone:CreateDataApp",
        "datazone:UpdateDataApp",
        "datazone:DeleteDataApp",
        "datazone:PutAgentApprovalPolicy",
        "datazone:DeleteAgentApprovalPolicy"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CfnManage",
      "Effect": "Allow",
      "Action": [
        "cloudformation:*"
      ],
      "Resource": [
        "arn:aws:cloudformation:*:*:stack/DataZone*"
      ]
    },
    {
      "Sid": "ValidateCfn",
      "Effect": "Allow",
      "Action": "cloudformation:ValidateTemplate",
      "Resource": "*"
    },
    {
      "Sid": "IamSts",
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:ListRoles",
        "sts:AssumeRole",
        "ecr-public:GetAuthorizationToken",
        "sts:GetServiceBearerToken"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CreateSLR",
      "Effect": "Allow",
      "Action": "iam:CreateServiceLinkedRole",
      "Resource": [
        "arn:aws:iam::*:role/aws-service-role/neptune-graph.amazonaws.com/AWSServiceRoleForNeptuneGraph",
        "arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift",
        "arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks",
        "arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless",
        "arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA",
        "arn:aws:iam::*:role/aws-service-role/airflow-serverless.amazonaws.com/AWSServiceRoleForAmazonMWAAServerless",
        "arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup",
        "arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint",
        "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless",
        "arn:aws:iam::*:role/aws-service-role/runtime-identity.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreRuntimeIdentity",
        "arn:aws:iam::*:role/aws-service-role/network.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreNetwork",
        "arn:aws:iam::*:role/aws-service-role/bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreGatewayNetwork",
        "arn:aws:iam::*:role/aws-service-role/identity-network.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreIdentity"
      ]
    },
    {
      "Sid": "TagSession",
      "Effect": "Allow",
      "Action": "sts:TagSession",
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringLike": {
          "aws:TagKeys": [
            "AmazonDataZone*"
          ]
        }
      }
    },
    {
      "Sid": "SourceIdentity",
      "Effect": "Allow",
      "Action": "sts:SetSourceIdentity",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "sts:SourceIdentity": "${aws:PrincipalTag/datazone:userId}"
        }
      }
    },
    {
      "Sid": "Q",
      "Effect": "Allow",
      "Action": [
        "glue:StartCompletion",
        "q:Get*",
        "q:List*",
        "q:PassRequest",
        "q:SendMessage",
        "q:StartConversation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SSM",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter*"
      ],
      "Resource": [
        "arn:aws:ssm:*:*:parameter/amazon/datazone/q*",
        "arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/*",
        "arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*"
      ]
    },
    {
      "Sid": "SageMakerUserTagPermissions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreatePresignedDomainUrl",
        "sagemaker:CreateUserProfile",
        "sagemaker:DeleteUserProfile",
        "sagemaker:UpdateUserProfile"
      ],
      "Resource": "arn:aws:sagemaker:*:*:user-profile/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonDataZoneUser": "${aws:PrincipalTag/datazone:userId}"
        }
      }
    },
    {
      "Sid": "SageMakerPrivateSpace",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateApp",
        "sagemaker:CreateSpace",
        "sagemaker:DeleteApp",
        "sagemaker:DeleteSpace",
        "sagemaker:UpdateSpace"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:space/*",
        "arn:aws:sagemaker:*:*:app/*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonDataZoneUser": "${aws:PrincipalTag/datazone:userId}",
          "sagemaker:SpaceSharingType": [
            "Private"
          ]
        }
      }
    },
    {
      "Sid": "CanvasUserProfileApp",
      "Effect": "Allow",
      "Action": [
        "sagemaker:CreateApp",
        "sagemaker:DeleteApp",
        "sagemaker:CreateSpace",
        "sagemaker:DeleteSpace"
      ],
      "Resource": [
        "arn:aws:sagemaker:*:*:app/*/Canvas/*",
        "arn:aws:sagemaker:*:*:space/*/CanvasManagedSpace*"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonDataZoneUser": "${aws:PrincipalTag/datazone:userId}"
        }
      }
    },
    {
      "Sid": "AllowStartSessionForSpaceRemoteConnection",
      "Effect": "Allow",
      "Action": [
        "sagemaker:StartSession"
      ],
      "Resource": "arn:aws:sagemaker:*:*:space/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonDataZoneUser": "${aws:PrincipalTag/datazone:userId}"
        }
      }
    },
    {
      "Sid": "ResourceGroupsPermissions",
      "Effect": "Allow",
      "Action": [
        "resource-groups:GetGroupQuery",
        "resource-groups:ListGroupResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SageMakerPermissions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:Batch*",
        "sagemaker:Describe*",
        "sagemaker:List*",
        "sagemaker:Search",
        "sagemaker:*Endpoint*",
        "sagemaker:*Model*",
        "sagemaker:*Context*",
        "sagemaker:*Artifact*",
        "sagemaker:*Action*",
        "sagemaker:*Association*",
        "sagemaker:QueryLineage",
        "sagemaker:*InferenceComponent*",
        "sagemaker:*Job*",
        "sagemaker:*MlflowApp*",
        "sagemaker:StartMlflowTrackingServer",
        "sagemaker:StopMlflowTrackingServer",
        "sagemaker:CreatePresignedMlflowTrackingServerUrl",
        "sagemaker-mlflow:*",
        "sagemaker:*Feature*",
        "sagemaker:*Record"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SageMakerTagPermissions",
      "Effect": "Allow",
      "Action": [
        "sagemaker:AddTags",
        "sagemaker:DeleteTags"
      ],
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringLike": {
          "aws:TagKeys": [
            "ProjectUserTag*",
            "sagemaker*",
            "sm-jumpstart*",
            "endpoint-has-jumpstart-model",
            "aws-jumpstart*",
            "Source",
            "CanvasModelName",
            "Canvas",
            "SageMaker",
            "ProjectS3Path",
            "Owner"
          ]
        },
        "ForAllValues:StringNotLike": {
          "aws:TagKeys": [
            "AmazonDataZone*",
            "sagemaker:shared-with:*"
          ]
        }
      }
    },
    {
      "Sid": "LogsAndMetrics",
      "Effect": "Allow",
      "Action": [
        "cloudwatch:PutMetricData",
        "cloudwatch:GetMetricData",
        "cloudwatch:DescribeAlarms",
        "cloudwatch:PutMetricAlarm",
        "cloudwatch:DeleteAlarms",
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:Describe*",
        "logs:Get*",
        "logs:PutLogEvents",
        "logs:StopQuery",
        "logs:StartQuery"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Glue",
      "Effect": "Allow",
      "Action": [
        "glue:CancelStatement",
        "glue:CreateSession",
        "glue:DeleteSession",
        "glue:CreateCatalog",
        "glue:Describe*",
        "glue:Get*",
        "glue:List*",
        "glue:NotifyEvent",
        "glue:RunStatement",
        "glue:StartCompletion",
        "glue:StopSession",
        "glue:UseGlueStudio",
        "glue:*Resource",
        "glue:*Job*",
        "glue:TestConnection",
        "glue:*DataQuality*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DenyForeignSessionAccess",
      "Effect": "Deny",
      "Action": [
        "athena:GetResourceDashboard",
        "athena:GetSession",
        "athena:GetSessionEndpoint",
        "athena:GetSessionStatus",
        "athena:StartSession",
        "athena:TerminateSession",
        "emr-serverless:*Session*",
        "emr-serverless:*Dashboard*",
        "emr-containers:*ManagedEndpoint*",
        "elasticmapreduce:*Session*",
        "glue:CancelStatement",
        "glue:CreateSession",
        "glue:DeleteSession",
        "glue:GetDashboardUrl",
        "glue:GetSession",
        "glue:GetSessionEndpoint",
        "glue:GetStatement",
        "glue:RunStatement",
        "glue:StopSession"
      ],
      "Resource": [
        "arn:aws:athena:*:*:workgroup/*/session/*",
        "arn:aws:emr-serverless:*:*:/applications/*/sessions/*",
        "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*",
        "arn:aws:elasticmapreduce:*:*:cluster/*/session/*",
        "arn:aws:glue:*:*:session/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:RequestTag/AmazonDataZoneSessionOwner": "${aws:SourceIdentity}",
          "aws:ResourceTag/AmazonDataZoneSessionOwner": "${aws:SourceIdentity}"
        }
      }
    },
    {
      "Sid": "DenyTaggingUntaggingForeignSessions",
      "Effect": "Deny",
      "Action": [
        "athena:TagResource",
        "athena:UntagResource",
        "emr-serverless:*Resource",
        "emr-containers:*Resource",
        "elasticmapreduce:AddTags",
        "elasticmapreduce:RemoveTags",
        "glue:TagResource",
        "glue:UntagResource"
      ],
      "Resource": [
        "arn:aws:athena:*:*:workgroup/*/session/*",
        "arn:aws:emr-serverless:*:*:/applications/*/sessions/*",
        "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*",
        "arn:aws:elasticmapreduce:*:*:cluster/*/session/*",
        "arn:aws:glue:*:*:session/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceTag/AmazonDataZoneSessionOwner": "${aws:SourceIdentity}"
        }
      }
    },
    {
      "Sid": "GlueDatabase",
      "Effect": "Allow",
      "Action": [
        "glue:*"
      ],
      "Resource": [
        "arn:aws:glue:*:*:database/*",
        "arn:aws:glue:*:*:table/*",
        "arn:aws:glue:*:*:catalog",
        "arn:aws:glue:*:*:catalog/*"
      ]
    },
    {
      "Sid": "GlueLakeFormation",
      "Effect": "Allow",
      "Action": [
        "glue:*"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "glue:LakeFormationPermissions": "Enabled"
        }
      }
    },
    {
      "Sid": "LFAccess",
      "Effect": "Allow",
      "Action": [
        "lakeformation:BatchGrantPermissions",
        "lakeformation:BatchRevokePermissions",
        "lakeformation:DescribeResource",
        "lakeformation:GetDataAccess",
        "lakeformation:GrantPermissions",
        "lakeformation:ListResources",
        "lakeformation:ListPermissions",
        "lakeformation:RevokePermissions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "SQLWorkBench",
      "Effect": "Allow",
      "Action": [
        "sqlworkbench:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "RedshiftData",
      "Effect": "Allow",
      "Action": "redshift-data:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "redshift-data:statement-owner-iam-userid": "${aws:userid}"
        }
      }
    },
    {
      "Sid": "RedShiftActions",
      "Effect": "Allow",
      "Action": [
        "redshift-data:BatchExecuteStatement",
        "redshift-data:Describe*",
        "redshift-data:ExecuteStatement",
        "redshift-data:List*",
        "redshift-serverless:GetManagedWorkgroup",
        "redshift-serverless:GetNamespace",
        "redshift-serverless:GetWorkgroup",
        "redshift-serverless:List*",
        "redshift:Describe*",
        "redshift:GetClusterCredentialsWithIAM",
        "redshift-serverless:GetCredentials"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Bedrock",
      "Effect": "Allow",
      "Action": "bedrock:*",
      "Resource": "*"
    },
    {
      "Sid": "PassRole",
      "Effect": "Allow",
      "Action": [
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/${aws:PrincipalTag/AmazonDataZonePassedRolePath}",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}",
          "iam:PassedToService": [
            "bedrock-agentcore.amazonaws.com",
            "agent-registry.amazonaws.com",
            "bedrock.amazonaws.com",
            "glue.amazonaws.com",
            "lakeformation.amazonaws.com",
            "sagemaker.amazonaws.com",
            "scheduler.amazonaws.com",
            "emr-serverless.amazonaws.com",
            "elasticmapreduce.amazonaws.com",
            "redshift.amazonaws.com",
            "airflow-serverless.amazonaws.com",
            "events.amazonaws.com",
            "pods.eks.amazonaws.com",
            "access-grants.s3.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "AirflowServerless",
      "Effect": "Allow",
      "Action": [
        "airflow-serverless:List*",
        "airflow-serverless:Get*",
        "airflow-serverless:CreateWorkflow",
        "airflow-serverless:UpdateWorkflow",
        "airflow-serverless:DeleteWorkflow",
        "airflow-serverless:StartWorkflowRun",
        "airflow-serverless:StopWorkflowRun",
        "airflow-serverless:TagResource",
        "airflow-serverless:UntagResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AirflowMWAA",
      "Effect": "Allow",
      "Action": [
        "airflow:GetEnvironment",
        "airflow:ListEnvironments",
        "airflow:CreateWebLoginToken",
        "airflow:InvokeRestApi"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3List",
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketAcl",
        "s3:GetAccessGrantsInstance",
        "s3:GetAccessGrantsInstanceForPrefix",
        "s3:GetDataAccess",
        "s3:List*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CrossAccount",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject*"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "Scheduler",
      "Effect": "Allow",
      "Action": [
        "scheduler:CreateSchedule",
        "scheduler:DeleteSchedule",
        "scheduler:Get*",
        "scheduler:List*",
        "scheduler:UpdateSchedule"
      ],
      "Resource": "*"
    },
    {
      "Sid": "FederatedConn",
      "Effect": "Allow",
      "Action": [
        "dynamodb:List*",
        "dynamodb:Describe*",
        "dynamodb:Scan",
        "dynamodb:PartiQLSelect",
        "dynamodb:Query",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Athena",
      "Effect": "Allow",
      "Action": [
        "athena:BatchGet*",
        "athena:CreateNamedQuery",
        "athena:CreateNotebook",
        "athena:CreatePreparedStatement",
        "athena:CreatePresignedNotebookUrl",
        "athena:DeleteNamedQuery",
        "athena:DeleteNotebook",
        "athena:DeletePreparedStatement",
        "athena:ExportNotebook",
        "athena:Get*",
        "athena:ImportNotebook",
        "athena:List*",
        "athena:StartCalculationExecution",
        "athena:StartQueryExecution",
        "athena:StartSession",
        "athena:StopCalculationExecution",
        "athena:StopQueryExecution",
        "athena:TagResource",
        "athena:TerminateSession",
        "athena:UpdateNamedQuery",
        "athena:UpdateNotebook",
        "athena:UpdateNotebookMetadata",
        "athena:UpdatePreparedStatement"
      ],
      "Resource": "*"
    },
    {
      "Sid": "PrivateSecret",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:DeleteSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:UpdateSecret",
        "secretsmanager:PutResourcePolicy",
        "secretsmanager:PutSecretValue"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/AmazonDataZoneProject": "${datazone:projectId}"
        }
      }
    },
    {
      "Sid": "SharedSecret",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:CreateSecret",
        "secretsmanager:DescribeSecret",
        "secretsmanager:GetSecretValue",
        "secretsmanager:UpdateSecret",
        "secretsmanager:PutSecretValue"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/for-use-with-all-datazone-projects": "true"
        }
      }
    },
    {
      "Sid": "GenerateRecommendations",
      "Effect": "Allow",
      "Action": [
        "codewhisperer:GenerateRecommendations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Ecr",
      "Effect": "Allow",
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:BatchGetImage",
        "ecr:DescribeImages",
        "ecr:GetAuthorizationToken",
        "ecr:GetDownloadUrlForLayer"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CodeConnectionsUser",
      "Effect": "Allow",
      "Action": [
        "codeconnections:GetConnection",
        "codeconnections:UseConnection",
        "codestar-connections:GetConnection",
        "codestar-connections:UseConnection"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/for-use-with-all-datazone-projects": "true"
        }
      }
    },
    {
      "Sid": "CodeConnectionsUserList",
      "Effect": "Allow",
      "Action": [
        "codeconnections:GetHost",
        "codeconnections:ListConnections",
        "codeconnections:ListTagsForResource",
        "codestar-connections:GetHost",
        "codestar-connections:ListConnections",
        "codestar-connections:ListTagsForResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "KmsListAndDescribe",
      "Effect": "Allow",
      "Action": [
        "kms:DescribeKey",
        "kms:ListAliases",
        "kms:ListGrants"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DataZoneKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey",
        "kms:Encrypt",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:ReEncryptTo",
        "kms:ReEncryptFrom"
      ],
      "Resource": "*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:datazone:domainId"
        },
        "StringLike": {
          "kms:ViaService": "datazone.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "S3Kms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:s3:arn": "false"
        },
        "StringLike": {
          "kms:ViaService": "s3.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SchedulerKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:aws:scheduler:schedule:arn": "false"
        }
      }
    },
    {
      "Sid": "SecretsKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContext:SecretARN": "false"
        },
        "StringLike": {
          "kms:ViaService": "secretsmanager.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SageMakerKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext",
        "kms:ReEncryptTo",
        "kms:ReEncryptFrom"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContextKeys": "false"
        },
        "StringLike": {
          "kms:ViaService": "sagemaker.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "SageMakerCreateGrant",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "kms:ViaService": "sagemaker.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "DataZoneCreateGrant",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant"
      ],
      "Resource": "*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "kms:GrantOperations": [
            "Encrypt",
            "Decrypt",
            "ReEncryptFrom",
            "ReEncryptTo",
            "GenerateDataKeyWithoutPlaintext",
            "GenerateDataKey",
            "DescribeKey",
            "RetireGrant",
            "CreateGrant"
          ]
        },
        "StringLike": {
          "kms:ViaService": "datazone.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "GlueKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContextKeys": "false"
        },
        "StringLike": {
          "kms:ViaService": "glue.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "BedrockKms",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant",
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "Null": {
          "kms:EncryptionContextKeys": "false"
        },
        "StringLike": {
          "kms:ViaService": "bedrock.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "WorkflowsCreateGrant",
      "Effect": "Allow",
      "Action": [
        "kms:CreateGrant"
      ],
      "Resource": "arn:*:kms:*:*:key/*",
      "Condition": {
        "ForAllValues:StringEquals": {
          "kms:GrantOperations": [
            "Decrypt",
            "Encrypt",
            "GenerateDataKey",
            "GenerateDataKeyWithoutPlaintext",
            "RetireGrant"
          ]
        },
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:airflow-serverless:workflow-arn"
        },
        "StringLike": {
          "kms:ViaService": "airflow-serverless.*.amazonaws.com"
        }
      }
    },
    {
      "Sid": "WorkflowsKms",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt",
        "kms:Encrypt",
        "kms:GenerateDataKey",
        "kms:GenerateDataKeyWithoutPlaintext"
      ],
      "Resource": "arn:*:kms:*:*:key/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "kms:EncryptionContextKeys": "aws:airflow-serverless:workflow-arn"
        }
      }
    },
    {
      "Sid": "Ec2DescribeOnly",
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*"
    },
    {
      "Sid": "VpcAccess",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface",
        "ec2:CreateNetworkInterfacePermission",
        "ec2:DeleteNetworkInterfacePermission",
        "ec2:CreateVpcEndpoint"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2TagAccessForVpc",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags",
        "ec2:DeleteTags"
      ],
      "Resource": [
        "arn:aws:ec2:*:*:network-interface/*"
      ]
    },
    {
      "Sid": "AccessProjectS3BucketPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject*",
        "s3:PutObject*",
        "s3:RestoreObject",
        "s3:ReplicateObject",
        "s3:DeleteObject*",
        "s3:ListMultipartUploadParts",
        "s3:AbortMultipartUpload"
      ],
      "Resource": [
        "arn:aws:s3:::${aws:PrincipalTag/AmazonDataZoneProjectBucket}/*"
      ],
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalTag/AmazonDataZoneProjectBucket": ""
        }
      }
    },
    {
      "Sid": "EMR",
      "Effect": "Allow",
      "Action": [
        "emr-serverless:Get*",
        "emr-serverless:List*",
        "emr-serverless:Start*",
        "emr-serverless:Access*Endpoints",
        "emr-serverless:Terminate*",
        "emr-serverless:*Resource",
        "emr-containers:*ManagedEndpoint*",
        "emr-containers:*SecurityConfiguration*",
        "emr-containers:*VirtualCluster*",
        "emr-containers:*Resource",
        "elasticmapreduce:*PersistentAppUI*",
        "elasticmapreduce:Start*",
        "elasticmapreduce:Get*",
        "elasticmapreduce:Describe*",
        "elasticmapreduce:List*",
        "elasticmapreduce:Terminate*",
        "elasticmapreduce:*Tag*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CanvasGeneralPermissions",
      "Effect": "Allow",
      "Action": [
        "comprehend:BatchDetect*",
        "comprehend:Detect*",
        "textract:Analyze*",
        "textract:Start*",
        "textract:Get*",
        "rekognition:Detect*",
        "sagemaker-data-science-assistant:*",
        "rds:DescribeDBInstances",
        "application-autoscaling:PutScalingPolicy",
        "application-autoscaling:RegisterScalableTarget",
        "application-autoscaling:DescribeScalingActivities",
        "quicksight:ListNamespaces",
        "events:ListTagsForResource"
      ],
      "Resource": "*"
    },
    {
      "Sid": "CanvasRedshiftAccess",
      "Effect": "Allow",
      "Action": [
        "redshift:GetClusterCredentials"
      ],
      "Resource": [
        "arn:aws:redshift:*:*:dbuser:*/sagemaker_access*",
        "arn:aws:redshift:*:*:dbname:*"
      ]
    },
    {
      "Sid": "CanvasEventBridgePutOperation",
      "Effect": "Allow",
      "Action": [
        "events:PutRule"
      ],
      "Resource": "arn:aws:events:*:*:rule/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true"
        }
      }
    },
    {
      "Sid": "CanvasEventBridgeOperations",
      "Effect": "Allow",
      "Action": [
        "events:DescribeRule",
        "events:PutTargets"
      ],
      "Resource": "arn:aws:events:*:*:rule/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true"
        }
      }
    },
    {
      "Sid": "CanvasEventBridgeTagBasedOperations",
      "Effect": "Allow",
      "Action": [
        "events:TagResource"
      ],
      "Resource": "arn:aws:events:*:*:rule/*",
      "Condition": {
        "StringEquals": {
          "aws:RequestTag/sagemaker:is-canvas-data-prep-job": "true",
          "aws:ResourceTag/sagemaker:is-canvas-data-prep-job": "true"
        }
      }
    },
    {
      "Sid": "ACActions",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:*Harness*",
        "bedrock-agentcore:*AgentRuntime",
        "bedrock-agentcore:*AgentRuntimeEndpoint",
        "bedrock-agentcore:StopRuntimeSession",
        "bedrock-agentcore:*Memory",
        "bedrock-agentcore:*MemoryRecord*",
        "bedrock-agentcore:*Event",
        "bedrock-agentcore:ListEvents",
        "bedrock-agentcore:*Gateway",
        "bedrock-agentcore:*GatewayTarget",
        "bedrock-agentcore:*GatewayTargets",
        "bedrock-agentcore:*Dataset*",
        "bedrock-agentcore:*BatchEvaluation*",
        "bedrock-agentcore:*WorkloadIdentity",
        "bedrock-agentcore:GetWorkloadAccessToken",
        "bedrock-agentcore:GetWorkloadAccessTokenForJWT",
        "bedrock-agentcore:ListHarnesses",
        "bedrock-agentcore:ListAgentRuntimes",
        "bedrock-agentcore:ListAgentRuntimeEndpoints",
        "bedrock-agentcore:ListGateways",
        "bedrock-agentcore:ListDatasets",
        "bedrock-agentcore:ListBatchEvaluations",
        "bedrock-agentcore:ListEvaluators",
        "bedrock-agentcore:ListMemories",
        "bedrock-agentcore:ListAgentRuntimeVersions",
        "bedrock-agentcore:ListActors",
        "bedrock-agentcore:ListSessions",
        "bedrock-agentcore:ListTagsForResource",
        "bedrock-agentcore:GetEvaluator",
        "bedrock-agentcore:GetConfigurationBundleVersion",
        "bedrock-agentcore:ListCodeInterpreterSessions",
        "bedrock-agentcore:ListBrowserSessions"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ACManagedBuiltInTools",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:*CodeInterpreterSession",
        "bedrock-agentcore:InvokeCodeInterpreter",
        "bedrock-agentcore:*BrowserSession",
        "bedrock-agentcore:ConnectBrowserAutomationStream"
      ],
      "Resource": [
        "arn:*:bedrock-agentcore:*:aws:code-interpreter/*",
        "arn:*:bedrock-agentcore:*:aws:browser/*"
      ]
    },
    {
      "Sid": "ACTagOwnProject",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:TagResource",
      "Resource": "*",
      "Condition": {
        "StringEqualsIfExists": {
          "aws:RequestTag/AmazonDataZoneProject": "${datazone:projectId}",
          "aws:ResourceTag/AmazonDataZoneProject": "${datazone:projectId}"
        }
      }
    },
    {
      "Sid": "ACXRay",
      "Effect": "Allow",
      "Action": [
        "xray:GetTraceSegmentDestination",
        "xray:GetSamplingRules",
        "xray:GetSamplingTargets",
        "xray:PutTraceSegments",
        "xray:PutTelemetryRecords"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ACLogRetention",
      "Effect": "Allow",
      "Action": "logs:PutRetentionPolicy",
      "Resource": "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": "bedrock-agentcore.amazonaws.com"
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "ACResourcePolicy",
      "Effect": "Allow",
      "Action": [
        "logs:PutResourcePolicy"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/runtimes/*",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "TagLookup",
      "Effect": "Allow",
      "Action": [
        "tag:GetResources"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ACIdentityDirectory",
      "Effect": "Allow",
      "Action": "bedrock-agentcore:DeleteWorkloadIdentity",
      "Resource": "arn:*:bedrock-agentcore:*:*:workload-identity-directory/default",
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3AGObjectPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:GetObject",
        "s3:GetObjectVersion",
        "s3:GetObjectAcl",
        "s3:GetObjectVersionAcl",
        "s3:PutObject",
        "s3:PutObjectAcl",
        "s3:PutObjectVersionAcl"
      ],
      "Resource": "*",
      "Condition": {
        "ArnEquals": {
          "s3:AccessGrantsInstanceArn": [
            "arn:aws:s3:*:*:access-grants/default"
          ]
        }
      }
    },
    {
      "Sid": "S3AGInstancePermissions",
      "Effect": "Allow",
      "Action": [
        "s3:GetAccessGrantsInstance",
        "s3:CreateAccessGrantsInstance"
      ],
      "Resource": [
        "arn:aws:s3:*:*:access-grants/default"
      ],
      "Condition": {
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "S3AGLocationPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:CreateAccessGrantsLocation",
        "s3:DeleteAccessGrantsLocation",
        "s3:GetAccessGrantsLocation"
      ],
      "Resource": "arn:aws:s3:*:*:access-grants/default/location/*",
      "Condition": {
        "Null": {
          "aws:PrincipalTag/AmazonDataZoneProjectBucket": "false"
        },
        "StringEquals": {
          "s3:accessGrantsLocationScope": "s3://${aws:PrincipalTag/AmazonDataZoneProjectBucket}"
        }
      }
    },
    {
      "Sid": "S3AGPermissions",
      "Effect": "Allow",
      "Action": [
        "s3:CreateAccessGrant",
        "s3:DeleteAccessGrant"
      ],
      "Resource": "arn:aws:s3:*:*:access-grants/default/grant/*",
      "Condition": {
        "Null": {
          "aws:PrincipalTag/AmazonDataZoneProjectBucket": "false"
        },
        "StringLike": {
          "s3:accessGrantScope": "s3://${aws:PrincipalTag/AmazonDataZoneProjectBucket}/*"
        }
      }
    },
    {
      "Sid": "S3AGTaggingPermission",
      "Effect": "Allow",
      "Action": [
        "s3:TagResource"
      ],
      "Resource": [
        "arn:aws:s3:*:*:access-grants/default/location/*",
        "arn:aws:s3:*:*:access-grants/default/grant/*"
      ],
      "Condition": {
        "ForAllValues:StringLike": {
          "aws:TagKeys": [
            "AWSDataZone*",
            "AmazonDataZone*"
          ]
        },
        "StringEquals": {
          "aws:ResourceAccount": "${aws:PrincipalAccount}"
        }
      }
    },
    {
      "Sid": "SSOInstanceReadOnlyPermissions",
      "Effect": "Allow",
      "Action": [
        "sso:DescribeInstance",
        "sso:DescribeApplication"
      ],
      "Resource": [
        "arn:aws:sso:::instance/*",
        "arn:aws:sso::*:application/*/*"
      ],
      "Condition": {
        "Bool": {
          "aws:ViaAWSService": "true"
        }
      }
    },
    {
      "Sid": "IdentityStoreReadOnlyPermissions",
      "Effect": "Allow",
      "Action": [
        "identitystore:DescribeUser",
        "identitystore:DescribeGroup"
      ],
      "Resource": [
        "arn:aws:identitystore::*:identitystore/*",
        "arn:aws:identitystore:::user/*",
        "arn:aws:identitystore:::group/*"
      ],
      "Condition": {
        "Bool": {
          "aws:ViaAWSService": "true"
        }
      }
    }
  ]
}

Version history

Current version v32, edited by AWS on 2026-10-29. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy

resource "aws_iam_role_policy_attachment" "sagemakerstudiouseriamdefaultexecutionpolicy" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("SageMakerStudioUserIAMDefaultExecutionPolicy"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for SageMakerStudioUserIAMDefaultExecutionPolicy
• Report a data issue