AWS sagemaker documentation change
Summary
Expanded IAM permissions for HyperPod clusters: added EC2 and ECR actions to cluster instance role policy.
Security assessment
Documents additional IAM permissions required for cluster operations, which relates to security configuration but does not address a specific vulnerability.
Diff
diff --git a/sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md b/sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md index 828841f87..50fed7e08 100644 --- a//sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md +++ b//sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md @@ -74 +74 @@ Depending on which orchestrator you choose, permissions needed for the cluster a -Cluster administrators (admins) operate and configure SageMaker HyperPod clusters, performing the tasks in [SageMaker HyperPod operation](./sagemaker-hyperpod-operate.html). The following policy example includes the minimum set of permissions for cluster administrators to run the SageMaker HyperPod core APIs and manage SageMaker HyperPod clusters within your AWS account. +Cluster administrators (admins) operate and configure SageMaker HyperPod clusters, performing the tasks in [SageMaker HyperPod operation](./sagemaker-hyperpod-operate-slurm.html). The following policy example includes the minimum set of permissions for cluster administrators to run the SageMaker HyperPod core APIs and manage SageMaker HyperPod clusters within your AWS account. @@ -298 +298 @@ The following list breaks down which permissions are needed to enable SageMaker - * The following `ec2` permission is required to enable the [SageMaker HyperPod auto-resume functionality](./sagemaker-hyperpod-resiliency.html#sagemaker-hyperpod-resiliency-auto-resume). + * The following `ec2` permission is required to enable the [SageMaker HyperPod auto-resume functionality](./sagemaker-hyperpod-resiliency-slurm.html#sagemaker-hyperpod-resiliency-slurm-auto-resume). @@ -343,0 +344 @@ In addition to the managed policies, attach the following permission policy to t + "ec2:AttachNetworkInterface", @@ -347,0 +349,2 @@ In addition to the managed policies, attach the following permission policy to t + "ec2:DescribeInstances", + "ec2:DescribeInstanceTypes", @@ -348,0 +352 @@ In addition to the managed policies, attach the following permission policy to t + "ec2:DescribeTags", @@ -355,0 +360 @@ In addition to the managed policies, attach the following permission policy to t + "ecr:BatchCheckLayerAvailability",