Merge pull request #2200 from udondan/update-aws-managed-policies

Author: udondan

docs/source/_static/managed-policies/AWSBackupServiceRolePolicyForS3Backup.json

@@ -80,6 +80,19 @@
       "Action": "s3:ListAllMyBuckets",
       "Resource": "*"
     },
+    {
+      "Sid": "S3BucketTagReadPermissions",
+      "Effect": "Allow",
+      "Action": [
+        "s3:ListTagsForResource"
+      ],
+      "Resource": "arn:aws:s3:::*",
+      "Condition": {
+        "StringEquals": {
+          "aws:PrincipalAccount": "${aws:ResourceAccount}"
+        }
+      }
+    },
     {
       "Sid": "RecoveryPointTaggingPermissions",
       "Effect": "Allow",

docs/source/_static/managed-policies/AWSSupportPlansFullAccess.json

@@ -8,9 +8,32 @@
         "supportplans:GetSupportPlanUpdateStatus",
         "supportplans:ListSupportPlanModifiers",
         "supportplans:StartSupportPlanUpdate",
-        "supportplans:CreateSupportPlanSchedule"
+        "supportplans:CreateSupportPlanSchedule",
+        "supportplans:AcceptSupportAgreement",
+        "supportplans:CancelSupportAgreement",
+        "supportplans:CreateSupportAgreement",
+        "supportplans:GetSupportAgreement",
+        "supportplans:ListSupportAgreements",
+        "supportplans:ListSupportAgreementRevisions",
+        "supportplans:RejectSupportAgreement",
+        "supportplans:UpdateSupportAgreement"
       ],
       "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": "iam:CreateServiceLinkedRole",
+      "Resource": "arn:aws:iam::*:role/aws-service-role/supportplans.amazonaws.com/AWSServiceRoleForSupportPlans",
+      "Condition": {
+        "StringEquals": {
+          "iam:AWSServiceName": "supportplans.amazonaws.com"
+        }
+      }
+    },
+    {
+      "Effect": "Allow",
+      "Action": "iam:GetRole",
+      "Resource": "arn:aws:iam::*:role/aws-service-role/supportplans.amazonaws.com/AWSServiceRoleForSupportPlans"
     }
   ]
 }

docs/source/_static/managed-policies/AWSSupportPlansReadOnlyAccess.json

@@ -6,7 +6,10 @@
       "Action": [
         "supportplans:GetSupportPlan",
         "supportplans:GetSupportPlanUpdateStatus",
-        "supportplans:ListSupportPlanModifiers"
+        "supportplans:ListSupportPlanModifiers",
+        "supportplans:GetSupportAgreement",
+        "supportplans:ListSupportAgreements",
+        "supportplans:ListSupportAgreementRevisions"
       ],
       "Resource": "*"
     }

docs/source/_static/managed-policies/SageMakerStudioProjectProvisioningRolePolicy.json

@@ -6,7 +6,8 @@
       "Effect": "Allow",
       "Action": [
         "cloudformation:CreateStack",
-        "cloudformation:TagResource"
+        "cloudformation:TagResource",
+        "cloudformation:UntagResource"
       ],
       "Resource": [
         "arn:aws:cloudformation:*:*:stack/DataZone*"
@@ -1948,15 +1949,14 @@
       }
     },
     {
-      "Sid": "SMAppDelete",
+      "Sid": "SMApp",
       "Effect": "Allow",
-      "Action": "sagemaker:DeleteApp",
-      "Resource": [
-        "arn:aws:sagemaker:*:*:app/*/*/codeeditor/*",
-        "arn:aws:sagemaker:*:*:app/*/*/CodeEditor/*",
-        "arn:aws:sagemaker:*:*:app/*/*/jupyterlab/*",
-        "arn:aws:sagemaker:*:*:app/*/*/JupyterLab/*"
+      "Action": [
+        "sagemaker:CreateApp",
+        "sagemaker:AddTags",
+        "sagemaker:DeleteApp"
       ],
+      "Resource": "arn:aws:sagemaker:*:*:app/*",
       "Condition": {
         "Null": {
           "aws:ResourceTag/AmazonDataZoneProject": "false"