# SageMakerStudioAdminIAMPermissiveExecutionPolicy
**Description**: Administrative execution policy for using IAM roles with SageMaker Unified Studio. Allows admins to provision, manage and access resources in the local account (including broad access to all APIs in data services like S3, Glue, CloudWatch Logs, and others) for IAM-based usage of SageMaker Unified Studio.
`SageMakerStudioAdminIAMPermissiveExecutionPolicy` is an [AWS managed policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies).
## Using this policy
You can attach `SageMakerStudioAdminIAMPermissiveExecutionPolicy` to your users, groups, and roles.
## Policy details
+ **Type**: AWS managed policy
+ **Creation time**: August 18, 2025, 17:19 UTC
+ **Edited time:** November 14, 2026, 00:07 UTC
+ **ARN**: `arn:aws:iam::aws:policy/SageMakerStudioAdminIAMPermissiveExecutionPolicy`
## Policy version
**Policy version:** v26 (default)
The policy's default version is the version that defines the permissions for the policy. When a user or role with the policy makes a request to access an AWS resource, AWS checks the default version of the policy to determine whether to allow the request.
## JSON policy document
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "DataAccess",
"Effect" : "Allow",
"Action" : [
"cloudwatch:*",
"glue:*",
"logs:*",
"redshift-data:*",
"redshift-serverless:*",
"redshift:*",
"s3:*",
"s3tables:*",
"comprehend:*",
"textract:*",
"rekognition:*",
"sagemaker-data-science-assistant:*",
"rds:*",
"quicksight:*",
"events:*",
"xray:*"
],
"Resource" : "*"
},
{
"Sid" : "ManageViaEmrContainers",
"Effect" : "Allow",
"Action" : [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : "emr-containers.amazonaws.com"
}
}
},
{
"Sid" : "ComputeAccess",
"Effect" : "Allow",
"Action" : [
"athena:*",
"bedrock:*",
"bedrock-agentcore:*",
"agent-registry:*",
"codewhisperer:*",
"sagemaker-unified-studio-mcp:*",
"datazone:*",
"elasticmapreduce:*",
"emr-containers:*",
"eks:*",
"q:*",
"sagemaker:*",
"sagemaker-mlflow:*",
"scheduler:*",
"sqlworkbench:*",
"emr-serverless:*",
"airflow-serverless:*",
"airflow:*",
"application-autoscaling:*"
],
"Resource" : "*"
},
{
"Sid" : "CfnManage",
"Effect" : "Allow",
"Action" : [
"cloudformation:*"
],
"Resource" : [
"arn:aws:cloudformation:*:*:stack/DataZone*",
"arn:aws:cloudformation:*:*:transform/*"
]
},
{
"Sid" : "ValidateCfn",
"Effect" : "Allow",
"Action" : "cloudformation:ValidateTemplate",
"Resource" : "*"
},
{
"Sid" : "DenyForeignSessionAccess",
"Effect" : "Deny",
"Action" : [
"athena:GetResourceDashboard",
"athena:GetSession",
"athena:GetSessionEndpoint",
"athena:GetSessionStatus",
"athena:StartSession",
"athena:TerminateSession",
"emr-serverless:*Session*",
"emr-serverless:*Dashboard*",
"elasticmapreduce:*Session*",
"glue:CancelStatement",
"glue:CreateSession",
"glue:DeleteSession",
"glue:GetDashboardUrl",
"glue:GetSession",
"glue:GetSessionEndpoint",
"glue:GetStatement",
"glue:RunStatement",
"glue:StopSession"
],
"Resource" : [
"arn:aws:athena:*:*:workgroup/*/session/*",
"arn:aws:emr-serverless:*:*:/applications/*/sessions/*",
"arn:aws:elasticmapreduce:*:*:cluster/*/session/*",
"arn:aws:glue:*:*:session/*"
],
"Condition" : {
"StringNotEquals" : {
"aws:RequestTag/AmazonDataZoneSessionOwner" : "${aws:SourceIdentity}",
"aws:ResourceTag/AmazonDataZoneSessionOwner" : "${aws:SourceIdentity}"
}
}
},
{
"Sid" : "DenyTaggingUntaggingForeignSessions",
"Effect" : "Deny",
"Action" : [
"athena:TagResource",
"athena:UntagResource",
"emr-serverless:*Resource",
"elasticmapreduce:AddTags",
"elasticmapreduce:RemoveTags",
"glue:TagResource",
"glue:UntagResource"
],
"Resource" : [
"arn:aws:athena:*:*:workgroup/*/session/*",
"arn:aws:emr-serverless:*:*:/applications/*/sessions/*",
"arn:aws:elasticmapreduce:*:*:cluster/*/session/*",
"arn:aws:glue:*:*:session/*"
],
"Condition" : {
"StringNotEquals" : {
"aws:ResourceTag/AmazonDataZoneSessionOwner" : "${aws:SourceIdentity}"
}
}
},
{
"Sid" : "DenyForeignEmrOnEksSessions",
"Effect" : "Deny",
"Action" : [
"emr-containers:GetManagedEndpointSessionCredentials",
"emr-containers:DeleteManagedEndpoint",
"emr-containers:*Resource"
],
"Resource" : "arn:aws:emr-containers:*:*:/virtualclusters/*/endpoints/*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AmazonDataZoneSessionOwner" : "false"
},
"StringNotEquals" : {
"aws:ResourceTag/AmazonDataZoneSessionOwner" : "${aws:SourceIdentity}"
}
}
},
{
"Sid" : "IamSts",
"Effect" : "Allow",
"Action" : [
"iam:GetRole",
"iam:ListRoles",
"iam:GetUser",
"iam:ListUsers",
"iam:ListAttachedRolePolicies",
"iam:ListRolePolicies",
"iam:GetRolePolicy",
"access-analyzer:CheckNoNewAccess",
"sts:AssumeRole",
"ecr-public:GetAuthorizationToken",
"sts:GetServiceBearerToken"
],
"Resource" : "*"
},
{
"Sid" : "CreateSLR",
"Effect" : "Allow",
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : [
"arn:aws:iam::*:role/aws-service-role/emr-containers.amazonaws.com/AWSServiceRoleForAmazonEMRContainers",
"arn:aws:iam::*:role/aws-service-role/neptune-graph.amazonaws.com/AWSServiceRoleForNeptuneGraph",
"arn:aws:iam::*:role/aws-service-role/redshift.amazonaws.com/AWSServiceRoleForRedshift",
"arn:aws:iam::*:role/aws-service-role/sagemaker.amazonaws.com/AWSServiceRoleForAmazonSageMakerNotebooks",
"arn:aws:iam::*:role/aws-service-role/ops.emr-serverless.amazonaws.com/AWSServiceRoleForAmazonEMRServerless",
"arn:aws:iam::*:role/aws-service-role/airflow.amazonaws.com/AWSServiceRoleForAmazonMWAA",
"arn:aws:iam::*:role/aws-service-role/airflow-serverless.amazonaws.com/AWSServiceRoleForAmazonMWAAServerless",
"arn:aws:iam::*:role/aws-service-role/elasticmapreduce.amazonaws.com/AWSServiceRoleForEMRCleanup",
"arn:aws:iam::*:role/aws-service-role/sagemaker.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_SageMakerEndpoint",
"arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless",
"arn:aws:iam::*:role/aws-service-role/ops.athena.amazonaws.com/AWSServiceRoleForAmazonAthena",
"arn:aws:iam::*:role/aws-service-role/runtime-identity.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreRuntimeIdentity",
"arn:aws:iam::*:role/aws-service-role/network.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreNetwork",
"arn:aws:iam::*:role/aws-service-role/bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreGatewayNetwork",
"arn:aws:iam::*:role/aws-service-role/identity-network.bedrock-agentcore.amazonaws.com/AWSServiceRoleForBedrockAgentCoreIdentity",
"arn:aws:iam::*:role/aws-service-role/agent-registry.amazonaws.com/AWSServiceRoleForAgentRegistry"
]
},
{
"Sid" : "TagRoleAndSession",
"Effect" : "Allow",
"Action" : [
"iam:TagRole",
"iam:UntagRole",
"sts:TagSession"
],
"Resource" : "*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : [
"AmazonDataZone*",
"DataZone*",
"SageMakerSpacesDomainId",
"for-use-with-amazon-emr-managed-policies",
"DomainBucketName",
"KmsKeyId",
"VpcId"
]
}
}
},
{
"Sid" : "UpdateDzManagedRoleTrustPolicy",
"Effect" : "Allow",
"Action" : "iam:UpdateAssumeRolePolicy",
"Resource" : [
"arn:aws:iam::*:role/datazone_emr_containers_system_namespace_role_*",
"arn:aws:iam::*:role/service-role/AmazonSageMakerAdminIAMExecutionRole*",
"arn:aws:iam::*:role/service-role/AmazonSageMakerUserIAMExecutionRole*",
"arn:aws:iam::*:role/AmazonSageMakerAdminIAMExecutionRole*",
"arn:aws:iam::*:role/AmazonSageMakerUserIAMExecutionRole*",
"arn:aws:iam::*:role/datazone_usr_role_*"
]
},
{
"Sid" : "PassRoleForProvisioning",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"iam:PassedToService" : [
"pods.eks.amazonaws.com",
"sagemaker.amazonaws.com",
"lakeformation.amazonaws.com",
"athena.amazonaws.com",
"glue.amazonaws.com",
"datazone.amazonaws.com",
"airflow-serverless.amazonaws.com",
"elasticmapreduce.amazonaws.com",
"ec2.amazonaws.com",
"redshift-serverless.amazonaws.com"
]
}
}
},
{
"Sid" : "PassRole",
"Effect" : "Allow",
"Action" : "iam:PassRole",
"Resource" : [
"arn:aws:iam::*:role/service-role/AmazonSageMaker*",
"arn:aws:iam::*:role/${aws:PrincipalTag/AmazonDataZonePassedRolePath}"
],
"Condition" : {
"StringEquals" : {
"iam:PassedToService" : [
"bedrock.amazonaws.com",
"bedrock-agentcore.amazonaws.com",
"agent-registry.amazonaws.com",
"datazone.amazonaws.com",
"redshift-serverless.amazonaws.com",
"redshift.amazonaws.com",
"scheduler.amazonaws.com",
"emr-serverless.amazonaws.com",
"elasticmapreduce.amazonaws.com",
"airflow-serverless.amazonaws.com",
"pods.eks.amazonaws.com",
"access-grants.s3.amazonaws.com"
]
}
}
},
{
"Sid" : "CreateRole",
"Effect" : "Allow",
"Action" : [
"iam:CreateRole"
],
"Resource" : [
"arn:aws:iam::*:role/service-role/AmazonSageMaker*",
"arn:aws:iam::*:role/datazone_emr_service_role_*",
"arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*",
"arn:aws:iam::*:role/datazone_emr_containers_system_namespace_role_*"
]
},
{
"Sid" : "AttachAndDetachPolicy",
"Effect" : "Allow",
"Action" : [
"iam:AttachRolePolicy",
"iam:DetachRolePolicy"
],
"Resource" : [
"arn:aws:iam::*:role/service-role/AmazonSageMaker*",
"arn:aws:iam::*:role/datazone_emr_service_role_*",
"arn:aws:iam::*:role/datazone_emr_ec2_instance_role_*",
"arn:aws:iam::*:role/datazone_emr_containers_system_namespace_role_*"
],
"Condition" : {
"ArnEquals" : {
"iam:PolicyARN" : [
"arn:aws:iam::aws:policy/SageMakerStudioUserIAMDefaultExecutionPolicy",
"arn:aws:iam::aws:policy/SageMakerStudioUserIAMPermissiveExecutionPolicy",
"arn:aws:iam::aws:policy/service-role/AmazonS3TablesLakeFormationServiceRole",
"arn:aws:iam::aws:policy/service-role/SageMakerStudioDataAppsAccessRolePolicy",
"arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRInstanceRolePolicy",
"arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicy_v2",
"arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRServiceRolePolicy",
"arn:aws:iam::aws:policy/service-role/AmazonEMRServicePolicyForSessions",
"arn:aws:iam::aws:policy/service-role/SageMakerStudioEMRContainersSystemNamespaceRolePolicy"
]
}
}
},
{
"Sid" : "InstanceProfile",
"Effect" : "Allow",
"Action" : [
"iam:GetInstanceProfile",
"iam:CreateInstanceProfile",
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile",
"iam:DeleteInstanceProfile"
],
"Resource" : "arn:aws:iam::*:instance-profile/datazone_emr_ec2_instance_profile_*"
},
{
"Sid" : "SourceIdentity",
"Effect" : "Allow",
"Action" : "sts:SetSourceIdentity",
"Resource" : "*",
"Condition" : {
"StringLike" : {
"sts:SourceIdentity" : "${aws:PrincipalTag/datazone:userId}"
}
}
},
{
"Sid" : "AllowSetContextOnSelf",
"Effect" : "Allow",
"Action" : [
"sts:SetContext"
],
"Resource" : "arn:aws:sts::*:self"
},
{
"Sid" : "SSM",
"Effect" : "Allow",
"Action" : [
"ssm:DeleteParameter",
"ssm:GetParameter*",
"ssm:PutParameter"
],
"Resource" : [
"arn:aws:ssm:*:*:parameter/amazon/datazone/q*",
"arn:aws:ssm:*:*:parameter/amazon/datazone/genAI/*",
"arn:aws:ssm:*::parameter/aws/service/sagemaker-distribution/*"
]
},
{
"Sid" : "LFAccess",
"Effect" : "Allow",
"Action" : [
"lakeformation:BatchGrantPermissions",
"lakeformation:BatchRevokePermissions",
"lakeformation:DeregisterResource",
"lakeformation:DescribeResource",
"lakeformation:GetDataAccess",
"lakeformation:GetDataLakeSettings",
"lakeformation:GrantPermissions",
"lakeformation:ListPermissions",
"lakeformation:ListResources",
"lakeformation:PutDataLakeSettings",
"lakeformation:RegisterResource",
"lakeformation:RevokePermissions",
"lakeformation:ListLakeFormationOptIns",
"lakeformation:CreateLakeFormationOptIn",
"lakeformation:DeleteLakeFormationOptIn",
"lakeformation:*DataCellsFilter"
],
"Resource" : "*"
},
{
"Sid" : "FederatedConn",
"Effect" : "Allow",
"Action" : [
"dynamodb:List*",
"dynamodb:Describe*",
"dynamodb:Scan",
"dynamodb:PartiQLSelect",
"dynamodb:Query",
"secretsmanager:ListSecrets",
"resource-groups:GetGroupQuery",
"resource-groups:ListGroupResources"
],
"Resource" : "*"
},
{
"Sid" : "ManagePrivateSecret",
"Effect" : "Allow",
"Action" : [
"secretsmanager:CreateSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:DescribeSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:TagResource",
"secretsmanager:UpdateSecret",
"secretsmanager:PutResourcePolicy",
"secretsmanager:PutSecretValue"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AmazonDataZoneProject" : "false"
}
}
},
{
"Sid" : "ManageSharedSecret",
"Effect" : "Allow",
"Action" : [
"secretsmanager:CreateSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:DescribeSecret",
"secretsmanager:GetSecretValue",
"secretsmanager:TagResource",
"secretsmanager:UpdateSecret",
"secretsmanager:PutSecretValue"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"aws:ResourceTag/AmazonDataZoneProject" : "true"
},
"StringEquals" : {
"aws:ResourceTag/for-use-with-all-datazone-projects" : "true"
}
}
},
{
"Sid" : "RedshiftSecret",
"Effect" : "Allow",
"Action" : [
"secretsmanager:CreateSecret",
"secretsmanager:RotateSecret",
"secretsmanager:DescribeSecret",
"secretsmanager:UpdateSecret",
"secretsmanager:DeleteSecret",
"secretsmanager:TagResource"
],
"Resource" : "arn:aws:secretsmanager:*:*:secret:redshift!*"
},
{
"Sid" : "ACApiKeySecret",
"Effect" : "Allow",
"Action" : [
"secretsmanager:CreateSecret",
"secretsmanager:PutSecretValue",
"secretsmanager:DeleteSecret",
"secretsmanager:GetSecretValue"
],
"Resource" : "arn:aws:secretsmanager:*:*:secret:bedrock-agentcore-identity!*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : "bedrock-agentcore.amazonaws.com"
}
}
},
{
"Sid" : "Ecr",
"Effect" : "Allow",
"Action" : [
"ecr:BatchCheckLayerAvailability",
"ecr:BatchGetImage",
"ecr:DescribeImages",
"ecr:GetAuthorizationToken",
"ecr:GetDownloadUrlForLayer"
],
"Resource" : "*"
},
{
"Sid" : "CodeConnections",
"Effect" : "Allow",
"Action" : [
"codeconnections:*",
"codestar-connections:*"
],
"Resource" : "*"
},
{
"Sid" : "KmsListAndDescribe",
"Effect" : "Allow",
"Action" : [
"kms:DescribeKey",
"kms:ListAliases",
"kms:ListGrants"
],
"Resource" : "*"
},
{
"Sid" : "DataZoneKms",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey",
"kms:Encrypt",
"kms:GenerateDataKeyWithoutPlaintext",
"kms:ReEncryptTo",
"kms:ReEncryptFrom"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"kms:EncryptionContextKeys" : "aws:datazone:domainId"
},
"StringLike" : {
"kms:ViaService" : "datazone.*.amazonaws.com"
}
}
},
{
"Sid" : "S3Kms",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContext:aws:s3:arn" : "false"
},
"StringLike" : {
"kms:ViaService" : "s3.*.amazonaws.com"
}
}
},
{
"Sid" : "SchedulerKms",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContext:aws:scheduler:schedule:arn" : "false"
}
}
},
{
"Sid" : "SecretsKms",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContext:SecretARN" : "false"
},
"StringLike" : {
"kms:ViaService" : "secretsmanager.*.amazonaws.com"
}
}
},
{
"Sid" : "SageMakerKms",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:GenerateDataKeyWithoutPlaintext",
"kms:ReEncryptTo",
"kms:ReEncryptFrom"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContextKeys" : "false"
},
"StringLike" : {
"kms:ViaService" : "sagemaker.*.amazonaws.com"
}
}
},
{
"Sid" : "SageMakerCreateGrant",
"Effect" : "Allow",
"Action" : [
"kms:CreateGrant"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"kms:ViaService" : "sagemaker.*.amazonaws.com"
}
}
},
{
"Sid" : "DataZoneCreateGrant",
"Effect" : "Allow",
"Action" : [
"kms:CreateGrant"
],
"Resource" : "*",
"Condition" : {
"ForAllValues:StringEquals" : {
"kms:GrantOperations" : [
"Encrypt",
"Decrypt",
"ReEncryptFrom",
"ReEncryptTo",
"GenerateDataKeyWithoutPlaintext",
"GenerateDataKey",
"DescribeKey",
"RetireGrant",
"CreateGrant"
]
},
"StringLike" : {
"kms:ViaService" : "datazone.*.amazonaws.com"
}
}
},
{
"Sid" : "GlueKms",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContextKeys" : "false"
},
"StringLike" : {
"kms:ViaService" : "glue.*.amazonaws.com"
}
}
},
{
"Sid" : "BedrockKms",
"Effect" : "Allow",
"Action" : [
"kms:CreateGrant",
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContextKeys" : "false"
},
"StringLike" : {
"kms:ViaService" : "bedrock.*.amazonaws.com"
}
}
},
{
"Sid" : "WorkflowsCreateGrant",
"Effect" : "Allow",
"Action" : [
"kms:CreateGrant"
],
"Resource" : "arn:*:kms:*:*:key/*",
"Condition" : {
"ForAllValues:StringEquals" : {
"kms:GrantOperations" : [
"Decrypt",
"Encrypt",
"GenerateDataKey",
"GenerateDataKeyWithoutPlaintext",
"RetireGrant"
]
},
"ForAnyValue:StringEquals" : {
"kms:EncryptionContextKeys" : "aws:airflow-serverless:workflow-arn"
},
"StringLike" : {
"kms:ViaService" : "airflow-serverless.*.amazonaws.com"
}
}
},
{
"Sid" : "WorkflowsKms",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:GenerateDataKeyWithoutPlaintext"
],
"Resource" : "arn:*:kms:*:*:key/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"kms:EncryptionContextKeys" : "aws:airflow-serverless:workflow-arn"
}
}
},
{
"Sid" : "CreateSG",
"Effect" : "Allow",
"Action" : [
"ec2:CreateSecurityGroup"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*",
"arn:aws:ec2:*:*:vpc/*"
]
},
{
"Sid" : "SGManage",
"Effect" : "Allow",
"Action" : [
"ec2:DeleteSecurityGroup",
"ec2:RevokeSecurityGroupEgress",
"ec2:RevokeSecurityGroupIngress"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*"
]
},
{
"Sid" : "SGAuth",
"Effect" : "Allow",
"Action" : [
"ec2:AuthorizeSecurityGroupEgress",
"ec2:AuthorizeSecurityGroupIngress"
],
"Resource" : [
"arn:aws:ec2:*:*:security-group/*"
],
"Condition" : {
"Null" : {
"aws:ResourceTag/AmazonDataZoneProject" : "false"
}
}
},
{
"Sid" : "Ec2DescribeOnly",
"Effect" : "Allow",
"Action" : "ec2:Describe*",
"Resource" : "*"
},
{
"Sid" : "SGCreateAndDeleteTags",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : "arn:aws:ec2:*:*:security-group/*",
"Condition" : {
"ForAllValues:StringLike" : {
"aws:TagKeys" : [
"AmazonDataZone*",
"for-use-with-amazon-emr-managed-policies",
"aws:cloudformation:*"
]
}
}
},
{
"Sid" : "VpcAccess",
"Effect" : "Allow",
"Action" : [
"ec2:CreateNetworkInterface",
"ec2:DeleteNetworkInterface",
"ec2:CreateNetworkInterfacePermission",
"ec2:DeleteNetworkInterfacePermission",
"ec2:CreateVpcEndpoint"
],
"Resource" : "*"
},
{
"Sid" : "EC2TagAccessForVpc",
"Effect" : "Allow",
"Action" : [
"ec2:CreateTags",
"ec2:DeleteTags"
],
"Resource" : [
"arn:aws:ec2:*:*:network-interface/*"
]
},
{
"Sid" : "SSOApplicationPermissions",
"Effect" : "Allow",
"Action" : [
"identitystore:DescribeUser",
"identitystore:DescribeGroup",
"sso:CreateApplication",
"sso:DeleteApplication",
"sso:DescribeInstance",
"sso:DescribeApplication",
"sso:PutApplicationGrant",
"sso:PutApplicationAssignmentConfiguration",
"sso:PutApplicationAuthenticationMethod",
"sso:PutApplicationAccessScope",
"sso:UpdateApplication",
"sso:CreateApplicationAssignment",
"sso:DeleteApplicationAssignment",
"sso-directory:DescribeUser",
"sso-directory:DescribeGroup",
"identitystore:GetUserId",
"identitystore:GetGroupId"
],
"Resource" : "*",
"Condition" : {
"Bool" : {
"aws:ViaAWSService" : "true"
}
}
},
{
"Sid" : "SSOReadOnlyPermissions",
"Effect" : "Allow",
"Action" : [
"sso:ListInstances",
"organizations:DescribeOrganization"
],
"Resource" : "*"
},
{
"Sid" : "SSOKMSPermissions",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContext:aws:sso:instance-arn" : "false"
},
"StringLike" : {
"kms:ViaService" : "sso.*.amazonaws.com"
}
}
},
{
"Sid" : "IdentityStoreKMSPermissions",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt"
],
"Resource" : "*",
"Condition" : {
"Null" : {
"kms:EncryptionContext:aws:identitystore:identitystore-arn" : "false"
},
"StringLike" : {
"kms:ViaService" : "identitystore.*.amazonaws.com"
}
}
},
{
"Sid" : "RAMPermissions",
"Effect" : "Allow",
"Action" : [
"ram:Get*",
"ram:List*",
"ram:AcceptResourceShareInvitation",
"ram:CreateResourceShare",
"ram:TagResource"
],
"Resource" : "*"
},
{
"Sid" : "RAMResourceSharePermissions",
"Effect" : "Allow",
"Action" : [
"ram:AssociateResourceShare",
"ram:DisassociateResourceShare",
"ram:DeleteResourceShare"
],
"Resource" : "*",
"Condition" : {
"StringLike" : {
"ram:ResourceShareName" : [
"DataZone*"
]
}
}
},
{
"Sid" : "RAMAssociateResourceSharePermission",
"Effect" : "Allow",
"Action" : "ram:AssociateResourceSharePermission",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"ram:PermissionArn" : [
"arn:aws:ram::aws:permission/AWSRAMDefaultPermissionAmazonDataZoneDomain",
"arn:aws:ram::aws:permission/AWSRAMPermissionAmazonDataZoneDomainFullAccessWithPortalAccess",
"arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceAccess",
"arn:aws:ram::aws:permission/AWSRAMPermissionsAmazonDatazoneDomainExtendedServiceWithPortalAccess"
]
}
}
},
{
"Sid" : "TagLookup",
"Effect" : "Allow",
"Action" : [
"tag:GetResources"
],
"Resource" : "*"
}
]
}
```
## Learn more
+ [Create a permission set using AWS managed policies in IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [Adding and removing IAM identity permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [Understand versioning for IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Get started with AWS managed policies and move toward least-privilege permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)