aws-sagemaker-update-domain-config
UpdateDomain changes the default execution role for all new Studio apps in the domain.
match (effective permission)
{
"action": "sagemaker:UpdateDomain",
"resource_type": "AWS::SageMaker::Domain"
}
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <SageMaker Domain> |
| permissions | sagemaker:UpdateDomain |
| conditions | iam_permission |
Narrative
{principal.name} can change {domain.name}'s default execution role (sagemaker:UpdateDomain + iam:PassRole), affecting all future Studio apps spawned in that domain.
Raw rule rules/derived/aws/sagemaker.yaml
id: aws-sagemaker-update-domain-config
emits: CanModifyConfiguration
description: UpdateDomain changes the default execution role for all new Studio apps in the domain.
match_effective_permission:
action: sagemaker:UpdateDomain
resource_type: AWS::SageMaker::Domain
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <SageMaker Domain>
permissions:
- sagemaker:UpdateDomain
conditions:
- iam_permission
false_positive_note: "Changing DefaultUserSettings.ExecutionRole requires iam:PassRole on the new role.\
\ The change affects only NEW Studio apps; existing running apps retain their current role until restarted.\
\ Without PassRole, UpdateDomain can still change other domain settings (network, encryption, app\
\ settings) but not the identity \u2014 partial CanModifyConfiguration."
narrative: '{principal.name} can change {domain.name}''s default execution role (sagemaker:UpdateDomain
+ iam:PassRole), affecting all future Studio apps spawned in that domain.'