AWS sagemaker medium security documentation change
Summary
Added 'Tasks' section with details about task management, RBAC configuration requirements, and job submission guidelines. Updated section headers and troubleshooting link wording.
Security assessment
The change adds documentation about configuring Kubernetes RBAC permissions for data scientist users and access entry requirements for IAM roles to view tasks. This directly addresses access control and authorization mechanisms, which are security-related. The explicit mention of RBAC configuration and IAM role access management indicates security-focused documentation updates.
Diff
diff --git a/sagemaker/latest/dg/sagemaker-hyperpod-eks-operate-console-ui-governance-setup-task-governance.md b/sagemaker/latest/dg/sagemaker-hyperpod-eks-operate-console-ui-governance-setup-task-governance.md index af9d11ef2..6b307922c 100644 --- a//sagemaker/latest/dg/sagemaker-hyperpod-eks-operate-console-ui-governance-setup-task-governance.md +++ b//sagemaker/latest/dg/sagemaker-hyperpod-eks-operate-console-ui-governance-setup-task-governance.md @@ -5 +5 @@ -Kueue SettingsHyperPod Task governance prerequisitesHyperPod task governance setup +Kueue SettingsHyperPod Task governance prerequisitesHyperPod task governance setupTasks @@ -7 +7 @@ Kueue SettingsHyperPod Task governance prerequisitesHyperPod task governance set -# Task governance setup +# Task governance @@ -11 +11 @@ This section includes information on how to set up the Amazon SageMaker HyperPod -If you are having issues setting up, please see [Troubleshoot](./sagemaker-hyperpod-eks-operate-console-ui-governance-troubleshoot.html) for known troubleshooting solutions. +If you are having issues setting up, please see [Troubleshooting](./sagemaker-hyperpod-eks-operate-console-ui-governance-troubleshoot.html) for known troubleshooting solutions. @@ -13 +13 @@ If you are having issues setting up, please see [Troubleshoot](./sagemaker-hyper -###### Topics +###### In this topic: @@ -20,0 +21,2 @@ If you are having issues setting up, please see [Troubleshoot](./sagemaker-hyper + * Tasks + @@ -90 +92 @@ For more information about each configuration entry, see [Configuration](https:/ - * If you have not already done so, see [IAM users for cluster admin](./sagemaker-hyperpod-prerequisites-iam.html#sagemaker-hyperpod-prerequisites-iam-cluster-admin) for the example minimum permission policy for HyperPod cluster administrators. This includes permissions run the SageMaker HyperPod core APIs and manage SageMaker HyperPod clusters within your AWS account, performing the tasks in [SageMaker HyperPod operation](./sagemaker-hyperpod-operate-slurm.html). + * If you have not already done so, see [IAM users for cluster admin](./sagemaker-hyperpod-prerequisites-iam.html#sagemaker-hyperpod-prerequisites-iam-cluster-admin) for the example minimum permission policy for HyperPod cluster administrators. This includes permissions run the SageMaker HyperPod core APIs and manage SageMaker HyperPod clusters within your AWS account, performing the tasks in [SageMaker HyperPod Slurm cluster operations](./sagemaker-hyperpod-operate-slurm.html). @@ -150,0 +153,21 @@ You can view the **Policies** tab in the HyperPod SageMaker AI console if the in +## Tasks + +The following provides information on Amazon SageMaker HyperPod EKS cluster tasks. Tasks are operations or jobs that are sent to the cluster. These can be machine learning operations, like training, running experiments, or inference. The viewable task details list include status, run time, and how much compute is being used per task. + +In the [Amazon SageMaker AI console](https://console.aws.amazon.com/sagemaker/), under **HyperPod Clusters** , you can navigate to the HyperPod console and view your list of HyperPod clusters in your Region. Choose your cluster and navigate to the **Tasks** tab. + +For the **Tasks** tab to be viewable from anyone besides the administrator, the administrator needs to [add an access entry to the EKS cluster for the IAM role](https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html). + +###### Note + +To view your HyperPod EKS cluster tasks in the dashboard: + + * Configure Kubernetes Role-Based Access Control (RBAC) for data scientist users in the designated HyperPod namespace to authorize task execution on Amazon EKS-orchestrated clusters. Namespaces follow the format `hyperpod-ns-`team-name``. To establish RBAC permissions, refer to the [team role creation instructions](https://github.com/aws/private-sagemaker-hyperpod-cli-staging/tree/main/helm_chart#5-create-team-role). + + * Ensure that your job is submitted with the appropriate namespace and priority class labels. For a comprehensive example, see [Submit a job to SageMaker AI-managed queue and namespace](./sagemaker-hyperpod-eks-operate-console-ui-governance-cli.html#hp-eks-cli-start-job). + + + + +For EKS clusters, kubeflow (PyTorch, MPI, TensorFlow) tasks are shown. By default, PyTorch tasks are shown. You can filter for PyTorch, MPI, TensorFlow tasks by choosing the dropdown menu or using the search field. The information that is shown for each task includes the task name, status, namespace, priority class, and creation time. + @@ -157,2 +179,0 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Dashboard setup - @@ -160,0 +182,2 @@ Dashboard +Policies +