Merge pull request #1809 from udondan/update-aws-managed-policies

Author: udondan

docs/source/_static/managed-policies/AWSCodeBuildAdminAccess.json

@@ -57,6 +57,14 @@
       ],
       "Resource": "arn:aws:ecs:*:*:task/*/*"
     },
+    {
+      "Sid": "SSMOpenDataChannelAccess",
+      "Effect": "Allow",
+      "Action": [
+        "ssmmessages:OpenDataChannel"
+      ],
+      "Resource": "arn:aws:ssm:*:*:session/*"
+    },
     {
       "Sid": "CodeStarConnectionsReadWriteAccess",
       "Effect": "Allow",

docs/source/_static/managed-policies/AWSNetworkFirewallReadOnlyAccess.json

@@ -8,17 +8,27 @@
         "network-firewall:ListFirewallPolicies",
         "network-firewall:ListFirewalls",
         "network-firewall:ListFlowOperations",
+        "network-firewall:ListProxies",
+        "network-firewall:ListProxyConfigurations",
+        "network-firewall:ListProxyRuleGroups",
         "network-firewall:ListRuleGroups",
         "network-firewall:ListTagsForResource",
         "network-firewall:ListTLSInspectionConfigurations",
+        "network-firewall:ListVpcEndpointAssociations",
         "network-firewall:DescribeFirewall",
+        "network-firewall:DescribeFirewallMetadata",
         "network-firewall:DescribeFirewallPolicy",
         "network-firewall:DescribeFlowOperation",
         "network-firewall:DescribeLoggingConfiguration",
+        "network-firewall:DescribeProxy",
+        "network-firewall:DescribeProxyConfiguration",
+        "network-firewall:DescribeProxyRule",
+        "network-firewall:DescribeProxyRuleGroup",
         "network-firewall:DescribeResourcePolicy",
         "network-firewall:DescribeRuleGroup",
         "network-firewall:DescribeRuleGroupMetadata",
         "network-firewall:DescribeTLSInspectionConfiguration",
+        "network-firewall:DescribeVpcEndpointAssociation",
         "network-firewall:GetAnalysisReportResults",
         "network-firewall:ListFlowOperationResults"
       ],

docs/source/_static/managed-policies/AmazonSageMakerHyperPodGatedModelAccess.json

@@ -0,0 +1,21 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "CreatePresignedUrlAccess",
+      "Effect": "Allow",
+      "Action": [
+        "sagemaker:CreateHubContentPresignedUrls"
+      ],
+      "Resource": [
+        "arn:aws:sagemaker:*:*:hub/SageMakerPublicHub",
+        "arn:aws:sagemaker:*:*:hub-content/SageMakerPublicHub/*/*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
+    }
+  ]
+}

docs/source/_static/managed-policies/index.json

@@ -2134,6 +2134,11 @@ export class AwsManagedPolicy extends AwsManagedPolicyStatic {
         return aws_iam.ManagedPolicy.fromAwsManagedPolicyName(AwsManagedPolicyStatic.AmazonSageMakerGroundTruthExecution);
     }
 
+    /** This Amazon Managed Policy provides the necessary permissions for SageMaker HyperPod to access gated models in SageMaker Jumpstart. It allows creating presigned URLs for hub content in the SageMaker Public Hub. */
+    public AmazonSageMakerHyperPodGatedModelAccess(): aws_iam.IManagedPolicy {
+        return aws_iam.ManagedPolicy.fromAwsManagedPolicyName(AwsManagedPolicyStatic.AmazonSageMakerHyperPodGatedModelAccess);
+    }
+
     /** This policy provides administrative privileges required for setting up SageMaker HyperPod observability. It enables access to Amazon Managed Prometheus, Amazon Managed Grafana and EKS Addons. The policy also includes broad access to Grafana HTTP APIs through ServiceAccountTokens across all Amazon Managed Grafana workspaces in your account. */
     public AmazonSageMakerHyperPodObservabilityAdminAccess(): aws_iam.IManagedPolicy {
         return aws_iam.ManagedPolicy.fromAwsManagedPolicyName(AwsManagedPolicyStatic.AmazonSageMakerHyperPodObservabilityAdminAccess);

lib/generated/aws-managed-policies/cdk-iam-floyd.ts

@@ -850,6 +850,8 @@ export class AwsManagedPolicy {
     public static AmazonSageMakerGeospatialFullAccess = 'service-role/AmazonSageMakerGeospatialFullAccess';
     /** Provides access to AWS services that are required to run SageMaker GroundTruth Labeling job */
     public static AmazonSageMakerGroundTruthExecution = 'AmazonSageMakerGroundTruthExecution';
+    /** This Amazon Managed Policy provides the necessary permissions for SageMaker HyperPod to access gated models in SageMaker Jumpstart. It allows creating presigned URLs for hub content in the SageMaker Public Hub. */
+    public static AmazonSageMakerHyperPodGatedModelAccess = 'AmazonSageMakerHyperPodGatedModelAccess';
     /** This policy provides administrative privileges required for setting up SageMaker HyperPod observability. It enables access to Amazon Managed Prometheus, Amazon Managed Grafana and EKS Addons. The policy also includes broad access to Grafana HTTP APIs through ServiceAccountTokens across all Amazon Managed Grafana workspaces in your account. */
     public static AmazonSageMakerHyperPodObservabilityAdminAccess = 'AmazonSageMakerHyperPodObservabilityAdminAccess';
     /** This policy grants permissions to Amazon SageMaker HyperPod to related AWS services such as Amazon EKS, Amazon CloudWatch etc. */