AWS policy: SageMakerStudioDomainServiceRolePolicy

This is the default policy for the SageMakerUnifiedStudioDomainServiceRole service role. This policy is used by Amazon SageMaker Unified Studio to access the SSM parameters in the user’s account. Those parameters are set by the administrator in the Amazon SageMaker Unified Studio project profiles. This policy also has permissions to AWS KMS for encrypted SSM parameters. The KMS key must be tagged with EnableKeyForAmazonDataZone to allow decrypting the SSM parameters.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "SSMGetParameterStatement",
			"Effect": "Allow",
			"Action": [
				"ssm:GetParameter"
			],
			"Resource": [
				"arn:aws:ssm:*:*:parameter/amazon/datazone/profiles/*"
			]
		},
		{
			"Sid": "UseKMSKeyPermissionsStatement",
			"Effect": "Allow",
			"Action": [
				"kms:Decrypt"
			],
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"aws:ResourceTag/EnableKeyForAmazonDataZone": "true"
				},
				"Null": {
					"aws:ResourceTag/EnableKeyForAmazonDataZone": "false"
				},
				"StringLike": {
					"kms:ViaService": "ssm.*.amazonaws.com",
					"kms:EncryptionContext:PARAMETER_ARN": "arn:aws:ssm:*:*:parameter/amazon/datazone/profiles*"
				}
			}
		}
	]
}