Document history for the Amazon SageMaker Unified Studio Administrator Guide - Amazon SageMaker Unified Studio

Document history for the Amazon SageMaker Unified Studio Administrator Guide

The following table describes the documentation releases for Amazon SageMaker Unified Studio.

ChangeDescriptionDate

Policy updates

Policy updates to SageMakerStudioUserIAMDefaultExecutionPolicy, SageMakerStudioAdminIAMPermissiveExecutionPolicy, and SageMakerStudioUserIAMPermissiveExecutionPolicy - adding additional permissions required to create service linked roles. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 29, 2025

Policy update - SageMakerStudioAdminIAMDefaultExecutionPolicy

Policy updates to SageMakerStudioAdminIAMDefaultExecutionPolicy - adding permissions iam:CreateServiceLinkedRole and s3:DeleteBucketPolicy for resource management. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 29, 2025

Support for account pools in Amazon SageMaker Unified Studio

You can configure your domain to create and manage account pools for your custom project profile. For more information, see Account pools in Amazon SageMaker Unified Studio and Custom project profile.

August 21, 2025

Policy update - SageMakerStudioDomainExecutionRolePolicy

Policy updates to SageMakerStudioDomainExecutionRolePolicy - adding support for the new API actions - AssociateGovernedTerms and DisassociateGovernedTerms for the asset classification using restricted glossary terms feature in the catalog where users can associate or disassociate restricted glossary terms to an asset. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 20, 2025

New policy - SageMakerStudioUserIAMPermissiveExecutionPolicy

New policy - This is an execution policy for using IAM roles with Amazon SageMaker Unified Studio. This policy grants access to users to access resources, including broad access to data resources. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 20, 2025

New policy - SageMakerStudioUserIAMDefaultExecutionPolicy

New policy - This is the execution policy for using IAM roles with Amazon SageMaker Unified Studio. This policy grants access to users to resources. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 20, 2025

New policy - SageMakerStudioUserIAMConsolePolicy

New policy - This policy provides individual setup privileges for Amazon SageMaker Unified Studio using the AWS Management Console and SDK. It grants permissions for launching Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 20, 2025

New policy - SageMakerStudioAdminIAMPermissiveExecutionPolicy

New policy - This is an administrative execution policy for using IAM roles with Amazon SageMaker Unified Studio. This policy grants administrative access to provision, manage, and access resources, including broad access to data resources. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 20, 2025

New policy - SageMakerStudioAdminIAMDefaultExecutionPolicy

New policy - This is the administrative execution policy for using IAM roles with Amazon SageMaker Unified Studio. This policy grants administrative access to provision, manage, and access resources (excluding data resources) in your account. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 20, 2025

New policy - SageMakerStudioAdminIAMConsolePolicy

New policy - This policy provides administrative and individual setup privileges for Amazon SageMaker Unified Studio using the AWS Management Console and SDK. It grants permissions for launching Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 20, 2025

Policy updates - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding permissions to untag Amazon Athena, AWS CodeCommit, logs, scheduler, and Amazon EC2 resources. Also adding permissions to update Amazon Athena workgroups and delete the IAM role policy for Amazon SageMaker Unified Studio projects. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 15, 2025

Policy updates - SageMakerStudioDomainExecutionRolePolicy

Policy updates to the SageMakerStudioDomainExecutionRolePolicy - adding support for the following APIs: GetAccountPool, ListAccountPools, ListAccountsInAccountPool. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

August 11, 2025

Policy updates - SageMakerStudioFullAccess

Policy updates to the SageMakerStudioFullAccess - generalizing the scope for SecretsManager create and tag permissions for new domains that will have the format of dzd- instead of dzd_... Also adding permissions to allow users to use custom blueprint templates from Amazon S3 as well as upload their own template files to Amazon S3. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 23, 2025

Policy updates - SageMakerStudioEMRServiceRolePolicy

Policy updates to SageMakerStudioEMRServiceRolePolicy - removing unwanted KMS permissions for EMR cluster AtRestEncryption in the Amazon SageMaker Unified Studio EmrOnEc2 blueprint and adding permissions for EMR clsuter to encrypt customer data using customer managed KMS for logs pushed to Amazon S3 bucket in Amazon SageMaker Unified Studio when using EmrOnEc2 blueprint with customer managed encryption. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 23, 2025

Policy updates - SageMakerStudioProjectUserRolePolicy

Policy update - adding permissions to allow deletion of AWS Glue databases in Amazon Datalake, adding sqlworkbench service principals for the redshift-serverless:GetCredentials action, adding permissions to fetch jobs based on tags and resources, adding permissions to update Amazon CloudWatch metrics from job runs and read/write job logs, and adding permissions to support Amazon S3 access grants. Also adding permissions to allow cross-account project access for encrypted domains and adding support for ProjectRole and DescribeResource actions in order to check for the Amazon S3 tables' Lake Formation registration. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 15, 2025

Policy updates - SageMakerStudioProjectRoleMachineLearningPolicy

Policy updates to the SageMakerStudioProjectRoleMachineLearningPolicy - adding permissions to support cross-account Amazon S3 asset subscription fulfillment using Amazon S3 access grants. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 15, 2025

Policy updates - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding permissions to create and manage Amazon S3 table buckets and also adding permissions to automate S3 table analytics integration flow within Amazon SageMaker Unified Studio. Also adding permissions to read templates from users' S3 buckets and permissions to validate the template using AWS Cloud Formation. Also adding permissions to get and create an S3 access grant instance in the project account to support managing subscriptions for S3 asset types. Also adding neptune-graph:* and s3vectors:* permissions to support Knowledge Base vector store management of two new vector store services in Amazon SageMaker Unified Studio: S3Vectors vector buckets and Neptune Analytics graphs. Also adding permissions to allow cross-account project access for encrypted domains. And adding support for the data onboarding in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 15, 2025

Policy updates - SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy

Policy updates to the SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy - adding neptune-graph:* and s3vectors:* permissions to support vector read/write on vector stores for two new vector store services: S3Vectors vector buckets and Neptune Analytics graphs. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 15, 2025

New policy - SageMakerStudioAdminProjectUserRolePolicy

New policy - this IAM policy grants an IAM role full access to the AWS Glue Data Catalog (metadata) and Amazon S3 (actual data) for the data lake operations, with access scoped by region, account, and role tags. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 15, 2025

Automated onboarding of Amazon SageMaker Lakehouse

Adding support for automated onboarding of Amazon SageMaker Lakehouse. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 15, 2025

Amazon QuickSight integration

Enabling Amazon QuickSight integration in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

July 15, 2025

Policy updates - SageMakerStudioProjectUserRolePolicy

Policy updates to SageMakerStudioProjectUserRolePolicy - adding permissions to access Amazon Athena default catalog resource. Amazon SageMaker Unified Studio updates to AWS managed policies.

June 25, 2025

Policy updates - SageMakerStudioDomainExecutionRolePolicy

Policy updates to the SageMakerStudioDomainExecutionRolePolicy - adding support for the Amazon Q GetIdentityMetadata API action in order to obtain user's Q subscription information to set an appropriate subscription tier badge. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

June 18, 2025

Policy updates - SageMakerStudioProjectUserRolePolicy

Policy updates to the SageMakerStudioProjectUserRolePolicy - adding permissions to list Amazon Bedrock foundation models. Removing permissions to terminate EMR Cluster, change security group rules, Amazon Athena default catalog permissions, and list S3 buckets permissions at bucket level. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

June 13, 2025

Policy updates - SageMakerStudioProjectUserRolePolicy

Policy updates to the SageMakerStudioProjectUserRolePolicy - bring back previously removed permission to ListBucket to fix issues in AWS Glue sessions and connections. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

June 13, 2025

Policy updates - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding the untag role permission to fix project update failure. Also adding permissions to integrate with Amazon QuickSight. Also optimizing to reduce the policy size. And adding permissions to enable automatic sync of repositories. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

June 4, 2025

Policy update - SageMakerStudioProjectUserRolePolicy

Policy updates to the SageMakerStudioProjectUserRolePolicy - removing RedshiftDbUser format restriction. Adding KMS permissions required by dependent services for Federated Data Connection. Adding permissions to support Amazon QuickSight integration.For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

June 4, 2025

Policy updates - AmazonDataZoneBedrockModelConsumptionPolicy

Policy updates to the AmazonDataZoneBedrockModelConsumptionPolicy - adding permissions to call the ListFoundationModels action. This permission is added to help get model metadata more programmatically when the user is selecting which models to invoke.For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

May 28, 2025

Policy update - SageMakerStudioFullAccess

Policy updates to the SageMakerStudioFullAccess - adding permissions to support attaching or updating AWS managed permissions in AWS RAM resource shares in the Amazon SageMaker console. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

May 22, 2025

Policy update - AmazonDataZoneBedrockModelConsumptionPolicy

Policy updates to the AmazonDataZoneBedrockModelConsumptionPolicy - adding support for the conversation history feature powered by Amazon Bedrock session management in generative AI playgrounds. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

May 13, 2025

Policy update - SageMakerStudioProjectRoleMachineLearningPolicy

Policy updates to the SageMakerStudioProjectRoleMachineLearningPolicy - as CodeEditor (VS Code) is introduced into Amazon SageMaker Unified Studio, users need the ability to create/delete CodeEditor space applications in Amazon SageMaker. Currently, only Amazon SageMaker space apps are allowed to be created with the JupyterLab app type. This change extends the current capability of creating/deleting JupyterLab space applications to CodeEditor (VS Code). For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

May 1, 2025

Policy update - SageMakerStudioProjectUserRolePolicy

Policy updates to the SageMakerStudioProjectUserRolePolicy - adding permissions for integration with Amazon Bedrock Data Automation. Adding permissions to show Amazon Bedrock agent versions and their details to users. Adding permission to support Trusted Identity Propagation in QEv2. Ensuring project isolation for Amazon Bedrock Inline Agents. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

April 28, 2025

Policy update - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding IAM permissions for the AmazonSageMakerQueryExecution role to support query execution role creation during enabling of the Tooling blueprint. Adding the DeleteSchedule permission so that when projects are deleted, the Schedule Group can be deleted. EventBridge runs DeleteSchedule automatically on Schedule Groups when it attempts to delete them, regardless of whether the Schedule Group actually has schedules in it. This permission allows for that deleteSchedule call to be made during project deletion. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

April 28, 2025

Policy update - SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy

Policy updates to the SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy - adding support for structured data sources in Amazon Bedrock knowledge bases for generative AI app development projects. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

April 16, 2025

Policy update - SageMakerStudioProjectUserRolePolicy

Policy updates to the SageMakerStudioProjectUserRolePolicy - preventing sharing provisioned Amazon Redshift-Serverless across all projects. Adding EventBridge Scheduler permissions for users to create schedules in the project schedule group. Adding permissions to handle Amazon SageMaker Studio migration to Amazon SageMaker Unified Studio. Adding support for the Amazon SageMaker App type CodeEditor. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

April 9, 2025

Policy update - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding lakeformation:DescribeResource to improve deregistering of federated connections. Adding EventBridge Scheduler permissions to manage a schedule group for each project. Adding permission to manage Amazon Bedrock resources directly from the Amazon DataZone service. Add support for the Amazon SageMaker App type CodeEditor. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

April 9, 2025

Policy update - SageMakerStudioBedrockFlowServiceRolePolicy

Policy updates to the SageMakerStudioBedrockFlowServiceRolePolicy - adding support for using Amazon Bedrock agent nodes in Amazon Bedrock flows for generative AI app development projects. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

April 9, 2025

Policy update - SageMakerStudioDomainExecutionRolePolicy

Policy updates to the SageMakerStudioDomainExecutionRolePolicy - adding support for the GetUpdateEligibility API required by Amazon SageMaker Unified Studio to fetch update comments and determine project's eligibility for the workflow of updating projects. Also adding support for the existing Amazon DataZone Rule APIs required by Amazon SageMaker Unified Studio to mange and enforce rules. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

March 25, 2025

Policy update - SageMakerStudioProjectUserRolePolicy

Policy updates to the SageMakerStudioProjectUserRolePolicy - preventing default AWS Glue database from being listed as it causes issues with Spark SQL. Also adding permission to use new project-wide Amazon Bedrock service role for improved scalability.For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

March 21, 2025

Policy update - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding permission to describe stack event for better error reporting. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

March 21, 2025

Policy update - SageMakerStudioBedrockFlowServiceRolePolicy

Policy updates to the SageMakerStudioBedrockFlowServiceRolePolicy - adding KMS permissions to decrypt Amazon Bedrock guardrails attached to the Amazon Bedrock flows. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

March 10, 2025

Policy update - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding permission to change trust policy during project update to address confused deputy problem. Also adding permission to attach PartnerApps policy to the user role. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

March 5, 2025

Policy update - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the - renaming Amazon Bedrock tag and adding permission to removeSageMakerStudioProjectProvisioningRolePolicy deprecated tag on roles. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

March 4, 2025

Policy update - SageMakerStudioProjectUserRolePolicy

Policy updates to the SageMakerStudioProjectUserRolePolicy - changes to support shared VPC by removing ResourceAccount condition on actions dependent on VPC/subnets. Moving permissions from inline to this AWS managed policy for Amazon EMR, EMR-Serverless, and federated connections. Adding support for buckets with public access blocked with permission s3:GetBucketPublicAccessBlock. Adding permission to support data lineage in Amazon DataZone. Supporting Amazon LakeFormation ABAC by adding session tag the access role. Supporting users operating on private ECR. Also adding support for managing AWS Glue subscriptions by the user. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 28, 2025

Policy update - SageMakerStudioProjectRoleMachineLearningPolicy

Policy updates to the SageMakerStudioProjectRoleMachineLearningPolicy - adding support for the MLFlow Tracking Server for Shared VPC, applying visibility condition to Amazon SageMaker Search API. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 28, 2025

Policy update - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the - renaming Amazon Bedrock tag and adding permission to removeSageMakerStudioProjectProvisioningRolePolicy deprecated tag on roles. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 28, 2025

Policy update - SageMakerStudioEMRServiceRolePolicy

Policy updates to the SageMakerStudioEMRServiceRolePolicy - adding permissions to allow Amazon EMR to create network interfaces against Shared VPC.For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 28, 2025

New policies - SageMakerStudioEMRInstanceRolePolicy

Amazon SageMaker Unified Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 28, 2025

New policy - SageMakerStudioBedrockKnowledgeBaseServiceRolePolicy

This policy allows Amazon Bedrock Knowledge Bases to access Amazon Bedrock models and data sources in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 25, 2025

New policy - SageMakerStudioBedrockKnowledgeBaseCustomResourcePolicy

This policy provides access to configure vector stores and Amazon Bedrock knowledge bases in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 25, 2025

New policy - SageMakerStudioBedrockFunctionExecutionRolePolicy

This policy allows AWS Lambda to access an Amazon Bedrock function component's configuration in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 25, 2025

Policy update - SageMakerStudioProjectProvisioningRolePolicy

Policy updates to the SageMakerStudioProjectProvisioningRolePolicy - adding permissions for batch grants in AWS LakeFormation to give grants to IDC users. Adding various Update* permissions to allow managing project resources. Removing ResourceAccount condition on resources depending on VPC to allow usage of shared VPC. Using new Amazon Bedrock managed policy name. Adding permissions to clean up Amazon EMR project level resources during project deletion. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 24, 2025

Policy update - SageMakerStudioProjectRoleMachineLearningPolicy

Policy updates to the SageMakerStudioProjectRoleMachineLearningPolicy - adding permission for DescribeAutoMLJobV2, moving multiple Amazon SageMaker List operations to tag based authorization, adding CMK permissions for JupyterLab, add Amazon SageMaker ListModelPackages and CreateModel permissions for cross-account use case. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 14, 2025

New policy - SageMakerStudioBedrockPromptUserRolePolicy

This policy provides access to an Amazon Bedrock prompt and its configuration in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 14, 2025

New policy - SageMakerStudioBedrockFlowServiceRolePolicy

This policy allows Amazon Bedrock Flows to access Amazon Bedrock models and other resources attached to a flow in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 14, 2025

New policy - SageMakerStudioBedrockEvaluationJobServiceRolePolicy

This policy allows Amazon Bedrock to access Amazon Bedrock models and datasets for evaluation jobs in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 14, 2025

New policy - SageMakerStudioBedrockChatAgentUserRolePolicy

This policy provides access to an Amazon Bedrock chat agent app's configuration and Amazon Bedrock agent in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 14, 2025

New policy - SageMakerStudioBedrockAgentServiceRolePolicy

This policy allows Amazon Bedrock Agents to access Amazon Bedrock models and other resources attached to an agent in Amazon SageMaker Unified Studio. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

February 14, 2025

Policy updates to SageMakerStudioProjectProvisioningRolePolicy

Policy updates to SageMakerStudioProjectProvisioningRolePolicy - adding permissions to manage IAM roles with only AWS managed policies attached to them and no permissions boundary. Also adding permissions to update the AWS Lambda function for Amazon Athena federated connections.For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

January 31, 2025

New policy SageMakerStudioQueryExecutionRolePolicy

New policy SageMakerStudioQueryExecutionRolePolicy - this is the default policy for the SageMakerQueryExecutionRole role. This policy provides permissions to run query executions on federated connections. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

January 31, 2025

New policy SageMakerStudioEMRServiceRolePolicy

New policy SageMakerStudioEMRServiceRolePolicy - Amazon SageMaker Unified Studio creates IAM roles for project users to perform data analytics, artificial intelligence, and machine learning actions and uses this policy when creating these roles to define the permissions related to Amazon EMR. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

January 31, 2025

Policy update to SageMakerStudioFullAccess

Policy updates to SageMakerStudioFullAccess - updating the CodeConnections tagging permissions to support tagging for CodeConnections host resources in the Amazon SageMaker console. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

January 24, 2025

Policy update to SageMakerStudioDomainExecutionRolePolicy

Policy updates to SageMakerStudioDomainExecutionRolePolicy - adding support for the AWS CodeConnections APIs in order to make the Copy button available for self-managed Git providers. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

January 24, 2025

Policy updates to SageMakerStudioProjectProvisioningRolePolicy, SageMakerStudioProjectUserRolePolicy, and SageMakerStudioProjectUserRolePermissionsBoundary

Policy updates to SageMakerStudioProjectProvisioningRolePolicy (adding permissions to support CMK in CodeCommit, AWS Glue Catalog, and Amazon Redshift Serverless), SageMakerStudioProjectUserRolePolicy (adding permissions to support CMK in CodeCommit, and AWS Glue Catalog), and SageMakerStudioProjectUserRolePermissionsBoundary (adding permissions to support CMK in CodeCommit, AWS Glue Catalog, Amazon Redshift Serverless, and EMR on EC2.) For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 18, 2024

New policy - SageMakerStudioProjectUserRolePolicy

Adding a new managed policy - SageMakerStudioProjectUserRolePolicy. Amazon SageMaker Unified Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions. This is the main policy for the SageMakerUnifiedStudioProjectRole role. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - SageMakerStudioProjectUserRolePermissionsBoundary

Adding a new managed policy - SageMakerStudioProjectUserRolePermissionsBoundary. Amazon SageMaker Unified Studio creates IAM roles for Projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the boundary of their permissions. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - SageMakerStudioProjectRoleMachineLearningPolicy

Adding a new managed policy - SageMakerStudioProjectRoleMachineLearningPolicy. Amazon SageMaker Unified Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to Amazon SageMaker. This is the SageMaker policy for the SageMakerUnifiedStudioProjectRole role. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - SageMakerStudioProjectProvisioningRolePolicy

Adding a new managed policy - SageMakerStudioProjectProvisioningRolePolicy. Amazon SageMaker Unified Studio uses this policy to provision and manage resources in your account.For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - SageMakerStudioFullAccess

Adding a new managed policy - SageMakerStudioFullAccess. This policy provides full access to Amazon SageMaker Unified Studio via the Amazon SageMaker management console. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - SageMakerStudioDomainServiceRolePolicy

Adding a new managed policy - SageMakerStudioDomainServiceRolePolicy. This is the default policy for the SageMakerUnifiedStudioDomainServiceRole service role. This policy is used by Amazon SageMaker Unified Studio to access the SSM parameters in the user’s account. Those parameters are set by the administrator in the Amazon SageMaker Unified Studio project profiles. This policy also has permissions to AWS KMS for encrypted SSM parameters. The KMS key must be tagged with EnableKeyForAmazonDataZone to allow decrypting the SSM parameters. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - SageMakerStudioDomainExecutionRolePolicy

Adding a new managed policy - SageMakerStudioDomainExecutionRolePolicy - default policy for the SageMakerUnifiedStudioDomainExecutionRole service role. This role is used by Amazon SageMaker Unified Studio to catalog, discover, govern, share, and analyze data in the Amazon SageMaker Unified Studio domain. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - AmazonDataZoneBedrockModelManagementPolicy

Adding a new managed policy - AmazonDataZoneBedrockModelManagementPolicy - that provides permissions to manage Amazon Bedrock model access, including creating, tagging and deleting application inference profiles. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

New policy - AmazonDataZoneBedrockModelConsumptionPolicy

Adding a new managed policy - AmazonDataZoneBedrockModelConsumptionPolicy - that provides permissions to consume Amazon Bedrock models, including invoking Amazon Bedrock application inference profile created for particular Amazon DataZone domain. For more information, see Amazon SageMaker Unified Studio updates to AWS managed policies.

December 2, 2024

Initial release

Initial release of the Amazon SageMaker Unified Studio Administrator Guide

December 2, 2024