AWS cli documentation change
Summary
Added new '--restricted-instance-groups' parameter with detailed configuration options for SageMaker HyperPod clusters, including IAM roles, VPC configurations, storage settings, and update policies
Security assessment
The change adds documentation for security-related configurations including IAM execution roles (ExecutionRole), VPC security groups (SecurityGroupIds), and network isolation through Subnets configuration. While these are security features, there is no evidence this addresses a specific security vulnerability - rather it documents standard security controls for new cluster functionality.
Diff
diff --git a/cli/latest/reference/sagemaker/update-cluster.md b/cli/latest/reference/sagemaker/update-cluster.md index 0c13beb28..00e5f3b6a 100644 --- a//cli/latest/reference/sagemaker/update-cluster.md +++ b//cli/latest/reference/sagemaker/update-cluster.md @@ -15 +15 @@ - * [AWS CLI 2.27.50 Command Reference](../../index.html) » + * [AWS CLI 2.27.51 Command Reference](../../index.html) » @@ -68,0 +69 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/sagema + [--restricted-instance-groups <value>] @@ -318,0 +320,203 @@ JSON Syntax: +`--restricted-instance-groups` (list) + +> The specialized instance groups for training models like Amazon Nova to be created in the SageMaker HyperPod cluster. +> +> (structure) +> +>> The specifications of a restricted instance group that you need to define. +>> +>> InstanceCount -> (integer) +>> +>>> Specifies the number of instances to add to the restricted instance group of a SageMaker HyperPod cluster. +>> +>> InstanceGroupName -> (string) +>> +>>> Specifies the name of the restricted instance group. +>> +>> InstanceType -> (string) +>> +>>> Specifies the instance type of the restricted instance group. +>> +>> ExecutionRole -> (string) +>> +>>> Specifies an IAM execution role to be assumed by the restricted instance group. +>> +>> ThreadsPerCore -> (integer) +>> +>>> The number you specified to `TreadsPerCore` in `CreateCluster` for enabling or disabling multithreading. For instance types that support multithreading, you can specify 1 for disabling multithreading and 2 for enabling multithreading. For more information, see the reference table of [CPU cores and threads per CPU core per instance type](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/cpu-options-supported-instances-values.html) in the _Amazon Elastic Compute Cloud User Guide_ . +>> +>> InstanceStorageConfigs -> (list) +>> +>>> Specifies the additional storage configurations for the instances in the SageMaker HyperPod cluster restricted instance group. +>>> +>>> (tagged union structure) +>>> +>>>> Defines the configuration for attaching additional storage to the instances in the SageMaker HyperPod cluster instance group. To learn more, see [SageMaker HyperPod release notes: June 20, 2024](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-hyperpod-release-notes.html#sagemaker-hyperpod-release-notes-20240620) . +>>>> +>>>> ### Note +>>>> +>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `EbsVolumeConfig`. +>>>> +>>>> EbsVolumeConfig -> (structure) +>>>> +>>>>> Defines the configuration for attaching additional Amazon Elastic Block Store (EBS) volumes to the instances in the SageMaker HyperPod cluster instance group. The additional EBS volume is attached to each instance within the SageMaker HyperPod cluster instance group and mounted to `/opt/sagemaker` . +>>>>> +>>>>> VolumeSizeInGB -> (integer) +>>>>> +>>>>>> The size in gigabytes (GB) of the additional EBS volume to be attached to the instances in the SageMaker HyperPod cluster instance group. The additional EBS volume is attached to each instance within the SageMaker HyperPod cluster instance group and mounted to `/opt/sagemaker` . +>> +>> OnStartDeepHealthChecks -> (list) +>> +>>> A flag indicating whether deep health checks should be performed when the cluster restricted instance group is created or updated. +>>> +>>> (string) +>> +>> TrainingPlanArn -> (string) +>> +>>> The Amazon Resource Name (ARN) of the training plan to filter clusters by. For more information about reserving GPU capacity for your SageMaker HyperPod clusters using Amazon SageMaker Training Plan, see `` [CreateTrainingPlan](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTrainingPlan.html) `` . +>> +>> OverrideVpcConfig -> (structure) +>> +>>> Specifies an Amazon Virtual Private Cloud (VPC) that your SageMaker jobs, hosted models, and compute resources have access to. You can control access to and from your resources by configuring a VPC. For more information, see [Give SageMaker Access to Resources in your Amazon VPC](https://docs.aws.amazon.com/sagemaker/latest/dg/infrastructure-give-access.html) . +>>> +>>> SecurityGroupIds -> (list) +>>> +>>>> The VPC security group IDs, in the form `sg-xxxxxxxx` . Specify the security groups for the VPC that is specified in the `Subnets` field. +>>>> +>>>> (string) +>>> +>>> Subnets -> (list) +>>> +>>>> The ID of the subnets in the VPC to which you want to connect your training job or model. For information about the availability of specific instance types, see [Supported Instance Types and Availability Zones](https://docs.aws.amazon.com/sagemaker/latest/dg/instance-types-az.html) . +>>>> +>>>> (string) +>> +>> ScheduledUpdateConfig -> (structure) +>> +>>> The configuration object of the schedule that SageMaker follows when updating the AMI. +>>> +>>> ScheduleExpression -> (string) +>>> +>>>> A cron expression that specifies the schedule that SageMaker follows when updating the AMI. +>>> +>>> DeploymentConfig -> (structure) +>>> +>>>> The configuration to use when updating the AMI versions. +>>>> +>>>> RollingUpdatePolicy -> (structure) +>>>> +>>>>> The policy that SageMaker uses when updating the AMI versions of the cluster. +>>>>> +>>>>> MaximumBatchSize -> (structure) +>>>>> +>>>>>> The maximum amount of instances in the cluster that SageMaker can update at a time. +>>>>>> +>>>>>> Type -> (string) +>>>>>> +>>>>>>> Specifies whether SageMaker should process the update by amount or percentage of instances. +>>>>>> +>>>>>> Value -> (integer) +>>>>>> +>>>>>>> Specifies the amount or percentage of instances SageMaker updates at a time. +>>>>> +>>>>> RollbackMaximumBatchSize -> (structure) +>>>>> +>>>>>> The maximum amount of instances in the cluster that SageMaker can roll back at a time. +>>>>>> +>>>>>> Type -> (string) +>>>>>> +>>>>>>> Specifies whether SageMaker should process the update by amount or percentage of instances. +>>>>>> +>>>>>> Value -> (integer) +>>>>>> +>>>>>>> Specifies the amount or percentage of instances SageMaker updates at a time. +>>>> +>>>> WaitIntervalInSeconds -> (integer) +>>>> +>>>>> The duration in seconds that SageMaker waits before updating more instances in the cluster. +>>>> +>>>> AutoRollbackConfiguration -> (list) +>>>> +>>>>> An array that contains the alarms that SageMaker monitors to know whether to roll back the AMI update. +>>>>> +>>>>> (structure) +>>>>> +>>>>>> The details of the alarm to monitor during the AMI update. +>>>>>> +>>>>>> AlarmName -> (string) +>>>>>> +>>>>>>> The name of the alarm. +>> +>> EnvironmentConfig -> (structure) +>> +>>> The configuration for the restricted instance groups (RIG) environment. +>>> +>>> FSxLustreConfig -> (structure) +>>> +>>>> Configuration settings for an Amazon FSx for Lustre file system to be used with the cluster. +>>>> +>>>> SizeInGiB -> (integer) +>>>> +>>>>> The storage capacity of the Amazon FSx for Lustre file system, specified in gibibytes (GiB). +>>>> +>>>> PerUnitStorageThroughput -> (integer) +>>>> +>>>>> The throughput capacity of the Amazon FSx for Lustre file system, measured in MB/s per TiB of storage. + +JSON Syntax: + + + [ + { + "InstanceCount": integer, + "InstanceGroupName": "string", + "InstanceType": "ml.p4d.24xlarge"|"ml.p4de.24xlarge"|"ml.p5.48xlarge"|"ml.trn1.32xlarge"|"ml.trn1n.32xlarge"|"ml.g5.xlarge"|"ml.g5.2xlarge"|"ml.g5.4xlarge"|"ml.g5.8xlarge"|"ml.g5.12xlarge"|"ml.g5.16xlarge"|"ml.g5.24xlarge"|"ml.g5.48xlarge"|"ml.c5.large"|"ml.c5.xlarge"|"ml.c5.2xlarge"|"ml.c5.4xlarge"|"ml.c5.9xlarge"|"ml.c5.12xlarge"|"ml.c5.18xlarge"|"ml.c5.24xlarge"|"ml.c5n.large"|"ml.c5n.2xlarge"|"ml.c5n.4xlarge"|"ml.c5n.9xlarge"|"ml.c5n.18xlarge"|"ml.m5.large"|"ml.m5.xlarge"|"ml.m5.2xlarge"|"ml.m5.4xlarge"|"ml.m5.8xlarge"|"ml.m5.12xlarge"|"ml.m5.16xlarge"|"ml.m5.24xlarge"|"ml.t3.medium"|"ml.t3.large"|"ml.t3.xlarge"|"ml.t3.2xlarge"|"ml.g6.xlarge"|"ml.g6.2xlarge"|"ml.g6.4xlarge"|"ml.g6.8xlarge"|"ml.g6.16xlarge"|"ml.g6.12xlarge"|"ml.g6.24xlarge"|"ml.g6.48xlarge"|"ml.gr6.4xlarge"|"ml.gr6.8xlarge"|"ml.g6e.xlarge"|"ml.g6e.2xlarge"|"ml.g6e.4xlarge"|"ml.g6e.8xlarge"|"ml.g6e.16xlarge"|"ml.g6e.12xlarge"|"ml.g6e.24xlarge"|"ml.g6e.48xlarge"|"ml.p5e.48xlarge"|"ml.p5en.48xlarge"|"ml.p6-b200.48xlarge"|"ml.trn2.48xlarge"|"ml.c6i.large"|"ml.c6i.xlarge"|"ml.c6i.2xlarge"|"ml.c6i.4xlarge"|"ml.c6i.8xlarge"|"ml.c6i.12xlarge"|"ml.c6i.16xlarge"|"ml.c6i.24xlarge"|"ml.c6i.32xlarge"|"ml.m6i.large"|"ml.m6i.xlarge"|"ml.m6i.2xlarge"|"ml.m6i.4xlarge"|"ml.m6i.8xlarge"|"ml.m6i.12xlarge"|"ml.m6i.16xlarge"|"ml.m6i.24xlarge"|"ml.m6i.32xlarge"|"ml.r6i.large"|"ml.r6i.xlarge"|"ml.r6i.2xlarge"|"ml.r6i.4xlarge"|"ml.r6i.8xlarge"|"ml.r6i.12xlarge"|"ml.r6i.16xlarge"|"ml.r6i.24xlarge"|"ml.r6i.32xlarge"|"ml.i3en.large"|"ml.i3en.xlarge"|"ml.i3en.2xlarge"|"ml.i3en.3xlarge"|"ml.i3en.6xlarge"|"ml.i3en.12xlarge"|"ml.i3en.24xlarge"|"ml.m7i.large"|"ml.m7i.xlarge"|"ml.m7i.2xlarge"|"ml.m7i.4xlarge"|"ml.m7i.8xlarge"|"ml.m7i.12xlarge"|"ml.m7i.16xlarge"|"ml.m7i.24xlarge"|"ml.m7i.48xlarge"|"ml.r7i.large"|"ml.r7i.xlarge"|"ml.r7i.2xlarge"|"ml.r7i.4xlarge"|"ml.r7i.8xlarge"|"ml.r7i.12xlarge"|"ml.r7i.16xlarge"|"ml.r7i.24xlarge"|"ml.r7i.48xlarge", + "ExecutionRole": "string", + "ThreadsPerCore": integer, + "InstanceStorageConfigs": [ + { + "EbsVolumeConfig": { + "VolumeSizeInGB": integer + } + } + ... + ], + "OnStartDeepHealthChecks": ["InstanceStress"|"InstanceConnectivity", ...], + "TrainingPlanArn": "string", + "OverrideVpcConfig": { + "SecurityGroupIds": ["string", ...], + "Subnets": ["string", ...] + }, + "ScheduledUpdateConfig": { + "ScheduleExpression": "string", + "DeploymentConfig": { + "RollingUpdatePolicy": { + "MaximumBatchSize": { + "Type": "INSTANCE_COUNT"|"CAPACITY_PERCENTAGE", + "Value": integer + }, + "RollbackMaximumBatchSize": { + "Type": "INSTANCE_COUNT"|"CAPACITY_PERCENTAGE", + "Value": integer + } + }, + "WaitIntervalInSeconds": integer, + "AutoRollbackConfiguration": [ + { + "AlarmName": "string" + } + ... + ]