Updates AWS managed policies #1167
Conversation
WalkthroughThe pull request updates AWS managed policies across several JSON files. The AmazonEKSServiceRolePolicy now permits selected EC2 actions with a condition limiting them to EKS-managed resources. Two SageMaker Studio EMR policies are updated: one introduces a new policy file with multiple S3 and KMS statements, while the other adds a condition-based statement for EC2 network interface and instance creation regarding a VPC tag. Additionally, two SageMaker Studio Project policies modify IAM role tagging and permission allocation, including new search capabilities and untagging rules. Finally, index.json is replaced with an updated policy list. Changes
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
docs/source/_static/managed-policies/SageMakerStudioProjectProvisioningRolePolicy.json (1)
479-495: Condition Value Format in Untagging StatementThe new statement with
Sid: "IAMRoleUntagging"permits untagging IAM roles matching"arn:aws:iam::*:role/datazone_usr_role_*". One point to note is the condition block using"ForAllValues:StringLike":- "ForAllValues:StringLike": { - "aws:TagKeys": "EnableAmazonBedrockIDEPermissions" - } + "ForAllValues:StringLike": { + "aws:TagKeys": [ + "EnableAmazonBedrockIDEPermissions" + ] + }Using a string value directly is allowed if only one tag key is ever expected; however, an array may be clearer if you plan to support additional keys in the future. Please verify that this meets your design intent.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (2)
lib/generated/aws-managed-policies/cdk-iam-floyd.tsis excluded by!**/generated/**lib/generated/aws-managed-policies/iam-floyd.tsis excluded by!**/generated/**
📒 Files selected for processing (6)
docs/source/_static/managed-policies/AmazonEKSServiceRolePolicy.json(1 hunks)docs/source/_static/managed-policies/SageMakerStudioEMRInstanceRolePolicy.json(1 hunks)docs/source/_static/managed-policies/SageMakerStudioEMRServiceRolePolicy.json(1 hunks)docs/source/_static/managed-policies/SageMakerStudioProjectProvisioningRolePolicy.json(2 hunks)docs/source/_static/managed-policies/SageMakerStudioProjectRoleMachineLearningPolicy.json(3 hunks)docs/source/_static/managed-policies/index.json(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- docs/source/_static/managed-policies/index.json
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Test cdk-iam-floyd
- GitHub Check: Automerge CI
🔇 Additional comments (5)
docs/source/_static/managed-policies/AmazonEKSServiceRolePolicy.json (1)
257-271: New EC2 Action Statement for EKS ResourcesA new statement is added that allows the actions
"ec2:DeleteLaunchTemplate"and"ec2:TerminateInstances"on all resources with a condition that restricts execution to when"ec2:ManagedResourceOperator"equals"eks.amazonaws.com". This aligns with the goal of ensuring that only resources managed by EKS are affected.Please verify that using an array for the condition value is intentional and that it remains consistent with other similar policy definitions.
docs/source/_static/managed-policies/SageMakerStudioEMRServiceRolePolicy.json (1)
25-41: New Statement: CreateInNetworkForSharedSubnetA new statement (with
Sid: "CreateInNetworkForSharedSubnet") has been introduced to allow the actions"ec2:CreateNetworkInterface","ec2:RunInstances", and"ec2:CreateFleet"on all resources. It applies a condition usingArnLiketo scope permitted actions to a specific VPC (determined via${aws:PrincipalTag/VpcId}). Please confirm that the use ofArnLikeis consistent with your VPC naming conventions and that this permission does not inadvertently broaden the allowed scope.docs/source/_static/managed-policies/SageMakerStudioEMRInstanceRolePolicy.json (1)
1-133: New Policy File: SageMakerStudioEMRInstanceRolePolicyThis new policy file defines the permissions required for the SageMaker Studio EMR Instance Role. It includes detailed statements for:
• Accessing certificate locations in S3 with conditions enforcing non‐empty principal tags.
• Permissions for retrieving environment blueprints and bootstrap action scripts from S3.
• Log upload permissions and KMS operations for EBS encryption.Each statement uses conditions to limit access based on
${aws:PrincipalTag/...}values and ensures that the actions are only allowed when the${aws:PrincipalAccount}matches the resource account.Overall, the file is comprehensive. Please verify that all conditions (especially around principal tags) exactly match your security design.
docs/source/_static/managed-policies/SageMakerStudioProjectRoleMachineLearningPolicy.json (2)
32-36: Refined Allocation of EC2 Network Interface ActionsWithin the
Sid: "AllowManageSageMakerTrainingEniOnVpc"block, the actions
"ec2:CreateNetworkInterface","ec2:DeleteNetworkInterface", and"ec2:AttachNetworkInterface"
are now included. These actions were shifted from another statement to better separate training-related ENI operations. Ensure that this separation correctly reflects the intended permission boundaries between training ENIs versus other network interfaces.
406-419: New SageMaker Search PermissionsA new permissions block (
Sid: "SageMakerSearchPermissions") adds the action"sagemaker:Search"on all resources under the condition that the principal’s tag"EnableSageMakerMLWorkloadsPermissions"is set to"true". Additionally, a condition on
"sagemaker:SearchVisibilityCondition/Tags.AmazonDataZoneProject/EqualsIfExists"
is applied to further restrict search visibility based on the"AmazonDataZoneProject"tag value.Please confirm that the chosen condition keys and their expected behavior exactly match your intended use case for enabling search functionality within SageMaker.
Updates AWS managed policies
Summary by CodeRabbit
New Features
Refactor
Chores