AWS next-generation-sagemaker medium security documentation change
Summary
Updated documentation with clarified Lake Formation permissions management, added explanations about access control centralization, and improved procedural steps for security configurations.
Security assessment
The changes explicitly emphasize revoking IAMAllowedPrincipals permissions and centralizing access control through Lake Formation, which directly addresses security best practices for least-privilege access. The addition of 'This makes it so Lake Formation is the central point for managing fine-grained access control' highlights security implications of permission management.
Diff
diff --git a/next-generation-sagemaker/latest/userguide/getting-started-sagemaker-gdc-s3.md b/next-generation-sagemaker/latest/userguide/getting-started-sagemaker-gdc-s3.md index 59f1726e4..52f5a7b4e 100644 --- a//next-generation-sagemaker/latest/userguide/getting-started-sagemaker-gdc-s3.md +++ b//next-generation-sagemaker/latest/userguide/getting-started-sagemaker-gdc-s3.md @@ -53 +53 @@ The following prerequisities are required for this getting started procedure. - * Create a project with an **All capabilities** project profile. This project profile sets up your project with access to S3 and Athena resources. For more information, see [Step 2 - Create a new project](./setting-up.html#create-new-project). + * Create a project with an **All capabilities** project profile. This project profile sets up your project with access to S3 and Athena resources. There is more information about how to create a new project in the topic [Setting up Amazon SageMaker AI](https://docs.aws.amazon.com/next-generation-sagemaker/latest/userguide/setting-up.html#create-new-project). @@ -55 +55 @@ The following prerequisities are required for this getting started procedure. - * A project role was created automatically when the project was created in SageMaker Unified Studio. You will make a note of the project role as detailed in the prerequisities below. + * A project role is created automatically when the project is created in SageMaker Unified Studio. You will make a note of the project role as detailed in the prerequisities below. @@ -57 +57 @@ The following prerequisities are required for this getting started procedure. - * You can either use an existing AWS Glue database or create a new one. The Glue database must be Lake Formation-managed. + * You can either use an existing AWS Glue database or create a new one. The Glue database must be Lake Formation managed. @@ -59 +59 @@ The following prerequisities are required for this getting started procedure. - * You can either use an existing AWS Glue table or create a new one. The Glue table must be Lake Formation-managed. + * You can either use an existing AWS Glue table or create a new one. The Glue table must be Lake Formation managed. @@ -61 +61 @@ The following prerequisities are required for this getting started procedure. - * Set up the Data lake administrator and revoke the specified permissions as detailed in the following steps. + * You also set up the Data lake administrator and revoke specified permissions. @@ -65,0 +66,2 @@ The following prerequisities are required for this getting started procedure. +Subsequent sections go into more detail regarding configuring each of these prerequisites. + @@ -68 +70 @@ The following prerequisities are required for this getting started procedure. -You must set up a user or role as the Lake Formation Data Lake administrator for your catalog data. Your administrator must grant access to data lake resources. +You must set up a user or role as the Lake Formation Data Lake administrator for your catalog data. This administrator grants access to data-lake resources. @@ -72 +74 @@ You must set up a user or role as the Lake Formation Data Lake administrator for - 2. In [Create a data lake administrator](https://docs.aws.amazon.com/lake-formation/latest/dg/getting-started-setup.html#create-data-lake-admin) in the _AWS Lake Formation Developer Guide_ , follow the instructions to add the inline policy granting permission to create the service-linked role. + 2. After you add the IAM permission, follow the steps in [Create a data lake administrator](https://docs.aws.amazon.com/lake-formation/latest/dg/initial-lf-config.html#create-data-lake-admin) to add the inline policy granting permission to create the service-linked role. @@ -79 +81 @@ You must set up a user or role as the Lake Formation Data Lake administrator for -After updating the policies in the previous step for the user or role you want to make the Data lake administrator, use the Lake Formation console to add that user or role to the list under Data lake administrators for your data. Use the following steps to use the console to add the Data lake administrator. +After updating the policies in the previous step for the user or role you want to make the Data lake administrator, use the Lake Formation console to add that user or role to the list under Data lake administrators. Use the following steps to add the Data lake administrator on the console. @@ -96 +98 @@ After updating the policies in the previous step for the user or role you want t -###### To revoke the `IAMAllowedPrincipals` group permission +###### Revoke the `IAMAllowedPrincipals` group permission @@ -102 +104 @@ You must revoke the `IAMAllowedPrincipals` group permission on both database and -For the purposes of this topic, revoke the group permission as provided. You can also use hybrid permissions in Lake Formation. For more information about hybrid permissions, see [Hybrid access mode](https://docs.aws.amazon.com/lake-formation/latest/dg/hybrid-access-mode.html) in the _AWS Lake Formation Developer Guide_. +For the purposes of this topic, revoke the group permission as provided. This makes it so Lake Formation is the central point for managing fine-grained access control to your data lake resources. You can also use hybrid permissions in Lake Formation. For more information about hybrid permissions, see [Hybrid access mode](https://docs.aws.amazon.com/lake-formation/latest/dg/hybrid-access-mode.html) in the _AWS Lake Formation Developer Guide_. @@ -121 +123 @@ Complete the steps in this section to set up your resources and permissions for -In the following sections of this topic, you will configure permissions using the project role in IAM that was created when you created your SageMaker Unified Studio project. You will attach a resource-based bucket policy and configure permissions in the lakehouse. Use the following steps to make a note of the IAM project role for your SageMaker Unified Studio project. +In the following sections of this topic, you will configure permissions using the project role in IAM that was created when you created your SageMaker Unified Studio project. The project role is an IAM role that is created and associated with a new project. This role grants the necessary permissions for users working on the project to use AWS resources, such as Amazon S3, for instance. You will attach a resource-based bucket policy and configure permissions in the lakehouse. Use the following steps to make a note of the IAM project role for your SageMaker Unified Studio project. You will use the role in a procedure that follows when you configure and grant Lake Formation permissions. @@ -179,0 +182,2 @@ You will grant database access to the IAM role that is associated with your Amaz +Granting these permissions provides the means to query the Lake Formation data in later steps. + @@ -182 +186 @@ You will grant database access to the IAM role that is associated with your Amaz -You will grant table access to the IAM role that is associated with your Amazon SageMaker Unified Studio project. This role is called the project role, and it was created in IAM upon project creation. To grant the permission on the tables to the project role, complete the following steps. +You will grant table access to the IAM role that is associated with your Amazon SageMaker Unified Studio project. This role is called the project role, and it was created in IAM upon project creation. To grant permission on the tables to the project role, complete the following steps. @@ -256 +260 @@ In your project, create an AWS Glue table using sample data. To create a Glue ta - 6. For **Table type** , **External/S3** will be selected by default as the type of source. + 6. For **Table type** , **External/S3** is selected by default as the type of source. @@ -262 +266 @@ In your project, create an AWS Glue table using sample data. To create a Glue ta - 8. For **Database** , choose the database that you created in the Use or create a Glue database section from the drop-down menu. + 8. For **Database** , choose the database that you created in the **Use or create a Glue database** section from the drop-down menu. @@ -291 +295 @@ To verify that you can access the existing AWS Glue table from the Amazon SageMa - 4. Next to the new table, choose the options menu (three dots), and choose **Query with Athena**. + 4. Next to the new table, choose the options menu (three dots), and choose **Query with Athena**. You can also choose to preview the data. @@ -335 +339 @@ Configure your IAM role with a policy for S3 bucket permissions to allow the Sag - 4. Choose **JSON** , and then paste the following policy statement into the Policy editor. The following is an example bucket policy. Replace ACCOUNT_ID with the account ID where the domain resides, <s3_bucket> with the name of the S3 bucket that you intend to query in SageMaker Unified Studio, and <datazone_usr_role_xxxxxxxxxxxxxx_yyyyyyyyyyyyyy> with the project role in SageMaker Unified Studio. For the purposes of this topic, replace the amzn-s3-demo-bucket value with the bucket name for the sample data (`s3://aws-bigdata-blog/generated_synthetic_reviews/*`). + 4. Choose **JSON** , and then paste the following policy statement into the Policy editor. The following is an example bucket policy. Replace ACCOUNT_ID with the account ID where the domain resides, <s3_bucket> with the name of the S3 bucket that you intend to query in SageMaker Unified Studio, and <datazone_usr_role_xxxxxxxxxxxxxx_yyyyyyyyyyyyyy> with the project role in SageMaker Unified Studio. For the purposes of this topic, replace the `amzn-s3-demo-bucket` value with the bucket name for the sample data (`s3://aws-bigdata-blog/generated_synthetic_reviews/*`).