AWS sagemaker documentation change
Summary
Restructured documentation with step-by-step guidance, added ABAC/VPC/filtering links, and detailed remote access activation process
Security assessment
Adds documentation about security features like IAM permission configurations, authentication methods (IAM/IdC), and access control mechanisms. While security-related, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/sagemaker/latest/dg/remote-access-remote-setup.md b/sagemaker/latest/dg/remote-access-remote-setup.md index c5f316da4..580196e85 100644 --- a//sagemaker/latest/dg/remote-access-remote-setup.md +++ b//sagemaker/latest/dg/remote-access-remote-setup.md @@ -5 +5 @@ -Configure security and permissions +Step 1: Configure security and permissionsStep 2: Enable remote access for your space @@ -20 +20,27 @@ Different connection methods require different IAM permissions. Configure the ap -## Configure security and permissions +###### Topics + + * Step 1: Configure security and permissions + + * Step 2: Enable remote access for your space + + * [Advanced access control](./remote-access-remote-setup-abac.html) + + * [Set up Studio to run with subnets without internet access within a VPC](./remote-access-remote-setup-vpc-subnets-without-internet-access.html) + + * [Set up automated Studio space filtering when using the AWS Toolkit](./remote-access-remote-setup-filter.html) + + + + +## Step 1: Configure security and permissions + +###### Topics + + * Method 1: Deep link permissions + + * Method 2: AWS Toolkit permissions + + * Method 3: SSH terminal permissions + + + @@ -24 +50 @@ Different connection methods require different IAM permissions. Configure the ap -For users connecting via deep links from the SageMaker AI UI, use the following permission and attach it to your SageMaker AI [space execution role](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html#sagemaker-roles-get-execution-role-space) or [domain execution role](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html#sagemaker-roles-get-execution-role). If the space execution role is not configured, the domain execution role is used by default. +For users connecting via deep links from the SageMaker UI, use the following permission and attach it to your SageMaker AI [space execution role](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html#sagemaker-roles-get-execution-role-space) or [domain execution role](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-roles.html#sagemaker-roles-get-execution-role). If the space execution role is not configured, the domain execution role is used by default. @@ -50 +76 @@ For users connecting through the AWS Toolkit for Visual Studio Code extension, a - * For IAM authentication, attach this policy to the IAM user or role. + * For IAM authentication, attach this policy to the IAM user or role @@ -52 +78 @@ For users connecting through the AWS Toolkit for Visual Studio Code extension, a - * For IdC authentication, attach this policy to the [Permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html) managed by the IdC. + * For IdC authentication, attach this policy to the [Permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html) managed by the IdC @@ -121 +145 @@ After setup, users can run `ssh my_studio_space_abc` to start up the space. For -###### Topics +## Step 2: Enable remote access for your space @@ -123 +147 @@ After setup, users can run `ssh my_studio_space_abc` to start up the space. For - * [Advanced access control](./remote-access-remote-setup-abac.html) +After you set up the permissions, you must toggle on **Remote Access** and start your space in Studio before the user can connect using their local VS Code. This setup only needs to be done once. @@ -125 +149 @@ After setup, users can run `ssh my_studio_space_abc` to start up the space. For - * [Set up Studio to run with subnets without internet access within a VPC](./remote-access-remote-setup-vpc-subnets-without-internet-access.html) +###### Note @@ -127 +151,13 @@ After setup, users can run `ssh my_studio_space_abc` to start up the space. For - * [Set up automated Studio space filtering when using the AWS Toolkit](./remote-access-remote-setup-filter.html) +If your users are connecting using Method 2: AWS Toolkit permissions, you do not necessarily need this step. AWS Toolkit for Visual Studio users can enable remote access from the Toolkit. + +###### Activate remote access for your Studio space + + 1. [Launch Amazon SageMaker Studio](https://docs.aws.amazon.com/sagemaker/latest/dg/studio-updated-launch.html#studio-updated-launch-console). + + 2. Open the Studio UI. + + 3. Navigate to your space. + + 4. In the space details, toggle on **Remote Access**. + + 5. Choose **Run space**.