aws-sagemaker-update-user-profile-config
UpdateUserProfile changes the execution role for a specific Studio user profile.
match (effective permission)
{
"action": "sagemaker:UpdateUserProfile",
"resource_type": "AWS::SageMaker::UserProfile"
}
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <SageMaker UserProfile> |
| permissions | sagemaker:UpdateUserProfile |
| conditions | iam_permission |
Narrative
{principal.name} can change {profile.name}'s execution role (sagemaker:UpdateUserProfile + iam:PassRole), affecting new Studio apps for this user.
Raw rule rules/derived/aws/sagemaker.yaml
id: aws-sagemaker-update-user-profile-config
emits: CanModifyConfiguration
description: UpdateUserProfile changes the execution role for a specific Studio user profile.
match_effective_permission:
action: sagemaker:UpdateUserProfile
resource_type: AWS::SageMaker::UserProfile
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <SageMaker UserProfile>
permissions:
- sagemaker:UpdateUserProfile
conditions:
- iam_permission
false_positive_note: Changing UserSettings.ExecutionRole requires iam:PassRole on the new role. Affects
new Studio apps for this user; existing running apps unaffected.
narrative: '{principal.name} can change {profile.name}''s execution role (sagemaker:UpdateUserProfile
+ iam:PassRole), affecting new Studio apps for this user.'