Amazon SageMaker adds permissions boundaries for SCP compliance

Amazon SageMaker Unified Studio Updates

Amazon SageMaker Unified Studio now supports custom IAM permissions boundaries, allowing organizations with Service Control Policies (SCPs) to adopt SageMaker Unified Studio without modifying their security posture.

When creating a project, SageMaker Unified Studio provisions three IAM roles: a project user role, an Amazon Bedrock service role, and a Bedrock Lambda execution role. Administrators can now specify a permissions boundary in the Tooling blueprint configuration, which is applied to all three roles at creation time. This feature ensures that SCP requirements are met and project provisioning is successful without administrator intervention.

The permissions boundary limits what the provisioned roles can do, giving administrators control over project-level permissions. Since the permissions boundary is set at the blueprint level, it automatically applies to every new project.

This feature is available in all AWS Regions where Amazon SageMaker Unified Studio is available. To learn more, visit the Manage Tooling blueprint parameters documentation.

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.