AWS marketplace medium security documentation change
Summary
Updated IAM role requirements and permissions documentation for publishing SageMaker products, including explicit JSON policy examples and restructured role creation steps
Security assessment
The changes explicitly define required IAM permissions and trust relationships with AWS Marketplace service principal, which directly relates to access control security configurations. Added JSON policy examples help implement least privilege principles.
Diff
diff --git a/marketplace/latest/userguide/ml-publishing-prereq.md b/marketplace/latest/userguide/ml-publishing-prereq.md index 80a0664c1..d8d537903 100644 --- a//marketplace/latest/userguide/ml-publishing-prereq.md +++ b//marketplace/latest/userguide/ml-publishing-prereq.md @@ -24 +24 @@ Before you can publish your model package or algorithm in AWS Marketplace, you m -To publish an Amazon SageMaker AI product, you must provide the AWS Identity and Access Management role ARN that will be used to run the product. Additionally, the IAM user or role you are signed in as requires the following permissions: +To publish an Amazon SageMaker AI product, you must specify a valid IAM role ARN that has a trust relationship with the AWS Marketplace service principal. Additionally, the IAM user or role you are signed in as requires the necessary permissions. @@ -26 +26 @@ To publish an Amazon SageMaker AI product, you must provide the AWS Identity and - 1. Required IAM actions: +###### Setting sign-in permissions @@ -28 +28 @@ To publish an Amazon SageMaker AI product, you must provide the AWS Identity and - * **sagemaker:DescribeModelPackage** – For listing a model package + * Add the following permissions to the IAM role: @@ -30 +30 @@ To publish an Amazon SageMaker AI product, you must provide the AWS Identity and - * **sagemaker:DescribeAlgorithm** – For listing an algorithm + 1. **sagemaker:DescribeModelPackage** — For listing a model package @@ -32 +32 @@ To publish an Amazon SageMaker AI product, you must provide the AWS Identity and - 2. Required IAM role ARN: + 2. **sagemaker:DescribeAlgorithm** — For listing an algorithm @@ -34,8 +34,13 @@ To publish an Amazon SageMaker AI product, you must provide the AWS Identity and - * You must specify a valid IAM role ARN that has a trust relationship with the AWS Marketplace service principal. - - * The role should follow the format: `arn:aws:iam::<account-id>:role/<role-name>` - - - - -For the AWS Marketplace permissions needed, or for managing your seller account, see [Policies and permissions for AWS Marketplace sellers](https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html). + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "sagemaker:DescribeModelPackage", + "sagemaker:DescribeAlgorithm" + ], + "Resource": "*" + } + ] + } @@ -43 +47,0 @@ For the AWS Marketplace permissions needed, or for managing your seller account, -###### To create the AWS Marketplace IAM role: @@ -45 +48,0 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). @@ -47 +49,0 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 2. In the left navigation bar, choose **Roles**. @@ -49 +51 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 3. Choose **Create role**. +###### Setting the IAM role AddVersion/Create product @@ -51 +53 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 4. Select **Custom trust policy**. + 1. Follow the steps to create a role with a custom trust policy. For more information, see [Creating an IAM role using a custom trust policy (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html). @@ -53 +55 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 5. Enter the following statement: + 2. Enter the following for the custom trust policy statement: @@ -69,3 +71 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 6. Choose **Next**. - - 7. Add the Image Builder get-component policy you created previously. The get-component policy is required. Add the relevant policies for S3, Secrets Manager, and Parameter Store if your component uses these AWS services. + 3. Enter the following permissions policy: @@ -73 +73,13 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 8. Choose **Next**. + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "sagemaker:DescribeModelPackage", + "sagemaker:DescribeAlgorithm" + ], + "Resource": "*" + } + ] + } @@ -75 +87 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 9. Enter a role name, such as `MPSageMakerRole`. + 4. Provide the role ARN when requested. The role should follow the format: `arn:aws:iam::`<account-id>`:role/`<role-name>``. @@ -77 +88,0 @@ For the AWS Marketplace permissions needed, or for managing your seller account, - 10. Choose **Create role**. @@ -80,0 +92 @@ For the AWS Marketplace permissions needed, or for managing your seller account, +For the AWS Marketplace permissions needed, or for managing your seller account, see [Policies and permissions for AWS Marketplace sellers](https://docs.aws.amazon.com/marketplace/latest/userguide/detailed-management-portal-permissions.html). @@ -86 +98 @@ Before creating a machine learning product listing, ensure that you have the fol - * **Amazon Resource Name (ARN)** – Provide the ARN of the model package or algorithm resource in the AWS Region that you are publishing from (see [Supported AWS Regions for publishing](./ml-service-restrictions-and-limits.html#ml-supported-aws-regions-for-publishing)). + * **Amazon Resource Name (ARN)** — Provide the ARN of the model package or algorithm resource in the AWS Region that you are publishing from (see [Supported AWS Regions for publishing](./ml-service-restrictions-and-limits.html#ml-supported-aws-regions-for-publishing)). @@ -92 +104 @@ Before creating a machine learning product listing, ensure that you have the fol - * [Requirements for usage information](./ml-listing-requirements-and-best-practices.html#ml-requirements-for-usage-information) – Provide details about inputs, outputs, and code examples. + * [Requirements for usage information](./ml-listing-requirements-and-best-practices.html#ml-requirements-for-usage-information) — Provide details about inputs, outputs, and code examples. @@ -94 +106 @@ Before creating a machine learning product listing, ensure that you have the fol - * [Requirements for inputs and outputs](./ml-listing-requirements-and-best-practices.html#ml-requirements-for-inputs-and-outputs) – Provide either files or text. + * [Requirements for inputs and outputs](./ml-listing-requirements-and-best-practices.html#ml-requirements-for-inputs-and-outputs) — Provide either files or text. @@ -96 +108 @@ Before creating a machine learning product listing, ensure that you have the fol - * [Requirements for Jupyter notebook](./ml-listing-requirements-and-best-practices.html#ml-requirements-for-jupyter-notebook) – Demonstrate complete product usage. + * [Requirements for Jupyter notebook](./ml-listing-requirements-and-best-practices.html#ml-requirements-for-jupyter-notebook) — Demonstrate complete product usage.