AWS Policy that allows only one SSO user to access a resource

Question

We are in a process to move all of our IAM users to aws SSO we used to have this IAM policy for sagemaker :

"

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListTags",
                "sagemaker:DeleteNotebookInstance",
                "sagemaker:StopNotebookInstance",
                "sagemaker:CreatePresignedNotebookInstanceUrl",
                "sagemaker:DescribeNotebookInstance",
                "sagemaker:StartNotebookInstance",
                "sagemaker:UpdateNotebookInstance"
            ],
            "Resource": "arn:aws:sagemaker:::notebook-instance/${aws:username}*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListNotebookInstanceLifecycleConfigs",
                "sagemaker:ListNotebookInstances",
                "sagemaker:ListCodeRepositories"
            ],
            "Resource": "*"
        }
    ]
}
"

this would give access to each user to use his\hers own notebook in sagemaker now on the new SSO permission set i gave this:

"
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "glue:CreateScript",
                "secretsmanager:*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListTags",
                "sagemaker:DeleteNotebookInstance",
                "sagemaker:StopNotebookInstance",
                "sagemaker:CreatePresignedNotebookInstanceUrl",
                "sagemaker:Describe*",
                "sagemaker:StartNotebookInstance",
                "sagemaker:UpdateNotebookInstance",
                "sagemaker:CreatePresignedDomainUrl",
                "sagemaker:*"
            ],
            "Resource": "arn:aws:sagemaker:::notebook-instance/*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Owner": "${identitystore:UserId}"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "sagemaker:ListTags",
                "sagemaker:Describe*",
                "sagemaker:StartNotebookInstance"
            ],
            "Resource": "*"
        }
    ]
}
"

this is what i tried but i cant make it work please assist? i also treid using the attributes and many other things but i just cant make it work please if you have any suggestions

user_8995027 · Answer

apprently on the SSO permission set we must write the region and account number of the resource so the fix was just adding that to the resource part like this

{
"Version": "2012-10-17",
"Statement": [
    {
        "Effect": "Allow",
        "Action": [
            "glue:CreateScript",
            "secretsmanager:*"
        ],
        "Resource": "*"
    },
    {
        "Effect": "Allow",
        "Action": [
            "sagemaker:ListTags",
            "sagemaker:DeleteNotebookInstance",
            "sagemaker:StopNotebookInstance",
            "sagemaker:CreatePresignedNotebookInstanceUrl",
            "sagemaker:Describe*",
            "sagemaker:StartNotebookInstance",
            "sagemaker:UpdateNotebookInstance",
            "sagemaker:CreatePresignedDomainUrl"
        ],
        "Resource": "arn:aws:sagemaker:us-east-1:7XXXXXXXXX:notebook-instance/*",
        "Condition": {
            "StringEquals": {
                "sagemaker:ResourceTag/Owner": "${identitystore:UserId}"
            }
        }
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "sagemaker:ListNotebookInstanceLifecycleConfigs",
            "sagemaker:ListNotebookInstances",
            "sagemaker:ListCodeRepositories"
        ],
        "Resource": "*"
    }
]

}

thanks to Yash_c from repost.aws

AWS Policy that allows only one SSO user to access a resource

1 Answers