udondan · udondan · Feb 27, 2025 · Feb 27, 2025
diff --git a/docs/source/_static/managed-policies/AmazonEKSServiceRolePolicy.json b/docs/source/_static/managed-policies/AmazonEKSServiceRolePolicy.json
@@ -254,6 +254,21 @@
         }
       }
     },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:DeleteLaunchTemplate",
+        "ec2:TerminateInstances"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "ec2:ManagedResourceOperator": [
+            "eks.amazonaws.com"
+          ]
+        }
+      }
+    },
     {
       "Effect": "Allow",
       "Action": [

diff --git a/docs/source/_static/managed-policies/SageMakerStudioEMRInstanceRolePolicy.json b/docs/source/_static/managed-policies/SageMakerStudioEMRInstanceRolePolicy.json
@@ -0,0 +1,134 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AccessCertificateLocationS3Permission",
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/certificate_location/*",
+      "Condition": {
+        "StringNotEquals": {
+          "aws:PrincipalTag/DomainBucketName": "",
+          "aws:PrincipalTag/AmazonDataZoneDomain": ""
+        },
+        "Null": {
+          "aws:PrincipalTag/AmazonDataZoneProject": "false"
+        },
+        "StringEquals": {
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
+    },
+    {
+      "Sid": "AccessPatchingRPMsS3Permission",
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": [
+        "arn:aws:s3:::default-env-blueprint-*/*",
+        "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint*"
+      ],
+      "Condition": {
+        "ArnLike": {
+          "s3:DataAccessPointArn": "arn:aws:s3:*:*:accesspoint/env-blueprint-accesspoint"
+        },
+        "StringNotEquals": {
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
+    },
+    {
+      "Sid": "AccessBootstrapActionScriptS3Permission",
+      "Effect": "Allow",
+      "Action": "s3:GetObject",
+      "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AmazonDataZoneScopeName}/sys/emr/bootstrap-script/*",
+      "Condition": {
+        "StringNotEquals": {
+          "aws:PrincipalTag/DomainBucketName": "",
+          "aws:PrincipalTag/AmazonDataZoneDomain": "",
+          "aws:PrincipalTag/AmazonDataZoneProject": "",
+          "aws:PrincipalTag/AmazonDataZoneScopeName": ""
+        },
+        "Null": {
+          "aws:PrincipalTag/AmazonDataZoneProject": "false"
+        },
+        "StringEquals": {
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
+    },
+    {
+      "Sid": "EMRClusterLogUploadS3Permission",
+      "Effect": "Allow",
+      "Action": "s3:PutObject",
+      "Resource": "arn:aws:s3:::${aws:PrincipalTag/DomainBucketName}/${aws:PrincipalTag/AmazonDataZoneDomain}/${aws:PrincipalTag/AmazonDataZoneProject}/${aws:PrincipalTag/AmazonDataZoneScopeName}/sys/emr/*",
+      "Condition": {
+        "StringNotEquals": {
+          "aws:PrincipalTag/DomainBucketName": "",
+          "aws:PrincipalTag/AmazonDataZoneDomain": "",
+          "aws:PrincipalTag/AmazonDataZoneProject": "",
+          "aws:PrincipalTag/AmazonDataZoneScopeName": ""
+        },
+        "Null": {
+          "aws:PrincipalTag/AmazonDataZoneProject": "false"
+        },
+        "StringEquals": {
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
+    },
+    {
+      "Sid": "EMRRuntimeRoleAssumePermissions",
+      "Effect": "Allow",
+      "Action": [
+        "sts:AssumeRole",
+        "sts:TagSession"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "ForAllValues:StringEquals": {
+          "aws:TagKeys": [
+            "LakeFormationAuthorizedCaller"
+          ]
+        },
+        "StringEquals": {
+          "iam:ResourceTag/AmazonDataZoneProject": "${aws:PrincipalTag/AmazonDataZoneProject}"
+        }
+      }
+    },
+    {
+      "Sid": "EMRKMSPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "kms:CreateGrant",
+        "kms:Decrypt",
+        "kms:Encrypt",
+        "kms:GenerateDataKeyWithoutPlaintext"
+      ],
+      "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}",
+      "Condition": {
+        "StringLike": {
+          "kms:ViaService": [
+            "ec2.*.amazonaws.com"
+          ]
+        },
+        "StringEquals": {
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        },
+        "Null": {
+          "kms:EncryptionContextKeys": "false"
+        }
+      }
+    },
+    {
+      "Sid": "AllowGenerateDataKeyForEbsEncryption",
+      "Effect": "Allow",
+      "Action": "kms:GenerateDataKey",
+      "Resource": "arn:aws:kms:*:*:key/${aws:PrincipalTag/KmsKeyId}",
+      "Condition": {
+        "StringEquals": {
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
+    }
+  ]
+}
diff --git a/docs/source/_static/managed-policies/SageMakerStudioEMRServiceRolePolicy.json b/docs/source/_static/managed-policies/SageMakerStudioEMRServiceRolePolicy.json
@@ -22,6 +22,23 @@
         }
       }
     },
+    {
+      "Sid": "CreateInNetworkForSharedSubnet",
+      "Effect": "Allow",
+      "Action": [
+        "ec2:CreateNetworkInterface",
+        "ec2:RunInstances",
+        "ec2:CreateFleet"
+      ],
+      "Resource": [
+        "*"
+      ],
+      "Condition": {
+        "ArnLike": {
+          "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}"
+        }
+      }
+    },
     {
       "Sid": "EMRKMSPermissions",
       "Effect": "Allow",

diff --git a/docs/source/_static/managed-policies/SageMakerStudioProjectProvisioningRolePolicy.json b/docs/source/_static/managed-policies/SageMakerStudioProjectProvisioningRolePolicy.json
@@ -377,6 +377,7 @@
             "AmazonDataZone*",
             "AmazonBedrockManaged",
             "RedshiftDb*",
+            "EnableAmazonBedrockPermissions",
             "EnableAmazonBedrockIDEPermissions",
             "EnableGlueWorkloadsPermissions",
             "EnableSageMakerMLWorkloadsPermissions",
@@ -474,6 +475,24 @@
         }
       }
     },
+    {
+      "Sid": "IAMRoleUntagging",
+      "Effect": "Allow",
+      "Action": "iam:UntagRole",
+      "Resource": "arn:aws:iam::*:role/datazone_usr_role_*",
+      "Condition": {
+        "StringEquals": {
+          "aws:CalledViaFirst": "cloudformation.amazonaws.com",
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        },
+        "Null": {
+          "aws:ResourceTag/AmazonDataZoneProject": "false"
+        },
+        "ForAllValues:StringLike": {
+          "aws:TagKeys": "EnableAmazonBedrockIDEPermissions"
+        }
+      }
+    },
     {
       "Sid": "IamManageRoles",
       "Effect": "Allow",

diff --git a/docs/source/_static/managed-policies/SageMakerStudioProjectRoleMachineLearningPolicy.json b/docs/source/_static/managed-policies/SageMakerStudioProjectRoleMachineLearningPolicy.json
@@ -5,11 +5,6 @@
       "Sid": "AllowManageSageMakerEniOnVpc",
       "Effect": "Allow",
       "Action": [
-        "ec2:CreateNetworkInterface",
-        "ec2:DeleteNetworkInterface",
-        "ec2:AttachNetworkInterface",
-        "ec2:CreateNetworkInterfacePermission",
-        "ec2:DeleteNetworkInterfacePermission",
         "ec2:CreateVpcEndpoint"
       ],
       "Resource": [
@@ -23,8 +18,7 @@
           "aws:CalledViaLast": [
             "sagemaker.amazonaws.com",
             "airflow.amazonaws.com"
-          ],
-          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+          ]
         },
         "ArnLike": {
           "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}"
@@ -35,6 +29,9 @@
       "Sid": "AllowManageSageMakerTrainingEniOnVpc",
       "Effect": "Allow",
       "Action": [
+        "ec2:CreateNetworkInterface",
+        "ec2:DeleteNetworkInterface",
+        "ec2:AttachNetworkInterface",
         "ec2:CreateNetworkInterfacePermission",
         "ec2:DeleteNetworkInterfacePermission"
       ],
@@ -45,9 +42,6 @@
         "arn:aws:ec2:*:*:security-group/*"
       ],
       "Condition": {
-        "StringEquals": {
-          "aws:ResourceAccount": "${aws:PrincipalAccount}"
-        },
         "ArnLike": {
           "ec2:Vpc": "arn:aws:ec2:*:*:vpc/${aws:PrincipalTag/VpcId}"
         }
@@ -383,7 +377,6 @@
       "Sid": "SageMakerListPermissions",
       "Effect": "Allow",
       "Action": [
-        "sagemaker:Search",
         "sagemaker:GetSearchSuggestions",
         "sagemaker:ListTrainingJobs",
         "sagemaker:ListTransformJobs",
@@ -410,6 +403,20 @@
         }
       }
     },
+    {
+      "Sid": "SageMakerSearchPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "sagemaker:Search"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "aws:PrincipalTag/EnableSageMakerMLWorkloadsPermissions": "true",
+          "sagemaker:SearchVisibilityCondition/Tags.AmazonDataZoneProject/EqualsIfExists": "${aws:PrincipalTag/AmazonDataZoneProject}"
+        }
+      }
+    },
     {
       "Sid": "SageMakerListPermissionsTagRestricted",
       "Effect": "Allow",

diff --git a/docs/source/_static/managed-policies/index.json b/docs/source/_static/managed-policies/index.json
diff --git a/lib/generated/aws-managed-policies/cdk-iam-floyd.ts b/lib/generated/aws-managed-policies/cdk-iam-floyd.ts
@@ -6474,6 +6474,11 @@ export class AwsManagedPolicy extends AwsManagedPolicyStatic {
         return aws_iam.ManagedPolicy.fromAwsManagedPolicyName(AwsManagedPolicyStatic.SageMakerStudioDomainServiceRolePolicy);
     }
 
+    /** Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR. */
+    public SageMakerStudioEMRInstanceRolePolicy(): aws_iam.IManagedPolicy {
+        return aws_iam.ManagedPolicy.fromAwsManagedPolicyName(AwsManagedPolicyStatic.SageMakerStudioEMRInstanceRolePolicy);
+    }
+
     /** Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR. */
     public SageMakerStudioEMRServiceRolePolicy(): aws_iam.IManagedPolicy {
         return aws_iam.ManagedPolicy.fromAwsManagedPolicyName(AwsManagedPolicyStatic.SageMakerStudioEMRServiceRolePolicy);

diff --git a/lib/generated/aws-managed-policies/iam-floyd.ts b/lib/generated/aws-managed-policies/iam-floyd.ts
@@ -2587,6 +2587,8 @@ export class AwsManagedPolicy {
     /** Service role for domain level actions in the portal that are performed by Amazon SageMaker Studio. */
     public static SageMakerStudioDomainServiceRolePolicy = 'service-role/SageMakerStudioDomainServiceRolePolicy';
     /** Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR. */
+    public static SageMakerStudioEMRInstanceRolePolicy = 'service-role/SageMakerStudioEMRInstanceRolePolicy';
+    /** Amazon SageMaker Studio creates IAM roles for projects users to perform data analytics, artificial intelligence, and machine learning actions, and uses this policy when creating these roles to define the permissions related to EMR. */
     public static SageMakerStudioEMRServiceRolePolicy = 'service-role/SageMakerStudioEMRServiceRolePolicy';
     /** This policy provides full access to Amazon SageMaker Unified Studio via the Amazon SageMaker management console. */
     public static SageMakerStudioFullAccess = 'SageMakerStudioFullAccess';