aws-sagemaker-presigned-domain-url

id: aws-sagemaker-presigned-domain-url
emits: CanExecuteAs
description: "CreatePresignedDomainUrl opens a Studio session as the specified user profile's execution\
  \ role \u2014 no iam:PassRole required."
match:
- - principal: null
  - HasPermission
  - app: null
- - app: null
  - ExecutesAs
  - role: null
where:
- node_type(?app) == Notebook
- ?app is a SageMaker Studio App (AWS::SageMaker::App) spawned from a UserProfile
- ?principal has EFFECTIVE sagemaker:CreatePresignedDomainUrl on the domain or user-profile ARN
emit:
  source_type: Identity
  target_type: MachineIdentity
  source: ?principal
  target: ?role
  permissions:
  - sagemaker:CreatePresignedDomainUrl
  conditions:
  - iam_permission
  - service_state
  state_logic: ACTIVE when a Studio app can be launched for the user profile. CONDITIONAL when the domain
    or Studio app must first be started. BLOCKED when SCP or boundary denies the presigned domain URL
    action.
  confidence: min(contributing_confidences) * 0.95
  derived_from:
  - '<HasPermission edge: principal -> app>'
  - '<ExecutesAs edge: app -> role>'
  false_positive_note: Like the notebook presigned URL, this bypasses iam:PassRole. The Studio session
    runs as the Studio App's ExecutionRole (bound from the UserProfile's ExecutionRole). Match consumes
    the App node (type Notebook), not UserProfile directly, as that is where ExecutesAs is emitted in
    the explicit rules. A domain with VPCOnly mode may require network access to the VPC endpoint. The
    caller must specify a valid UserProfileName; this rule fires once per app-execution-role pair.
  narrative: "{principal.name} can call sagemaker:CreatePresignedDomainUrl and open a Studio session as\
    \ {role.name} (via the Studio App for user profile {profile.name}) \u2014 no iam:PassRole needed."