AWS sagemaker documentation change
Summary
Added detailed IAM permissions required for HyperPod cluster creation including policies for SageMaker, CloudFormation, EC2, CloudWatch, S3, EKS, SSM, KMS, Lambda, IAM, and FSx operations
Security assessment
The change documents required IAM permissions for secure cluster creation but does not indicate a response to a specific vulnerability. It adds security-relevant documentation about necessary permissions boundaries and service interactions, helping users implement least-privilege access.
Diff
diff --git a/sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md b/sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md index 958c1ee74..dcc173b98 100644 --- a//sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md +++ b//sagemaker/latest/dg/sagemaker-hyperpod-prerequisites-iam.md @@ -5 +5 @@ -IAM users for cluster adminIAM users for scientistsIAM role for SageMaker HyperPod +IAM permissions for cluster creationIAM users for cluster adminIAM users for scientistsIAM role for SageMaker HyperPod @@ -62,0 +63,2 @@ Depending on which orchestrator you choose, permissions needed for the cluster a + * IAM permissions for cluster creation + @@ -71,0 +74,452 @@ Depending on which orchestrator you choose, permissions needed for the cluster a +## IAM permissions for cluster creation + +Creating HyperPod clusters requires the IAM permissions outlined in the following policy example. If your AWS account has [`AdministratorAccess`](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AdministratorAccess.html) permissions, these permissions are granted by default. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "sagemaker:CreateCluster", + "sagemaker:DeleteCluster", + "sagemaker:UpdateCluster" + ], + "Resource": "arn:aws:sagemaker:*:*:cluster/*" + }, + { + "Effect": "Allow", + "Action": [ + "sagemaker:AddTags" + ], + "Resource": "arn:aws:sagemaker:*:*:cluster/*" + }, + { + "Effect": "Allow", + "Action": [ + "sagemaker:ListTags", + "sagemaker:ListClusters", + "sagemaker:ListClusterNodes", + "sagemaker:ListComputeQuotas", + "sagemaker:ListTrainingPlans", + "sagemaker:DescribeCluster", + "sagemaker:DescribeClusterNode" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "cloudformation:CreateStack", + "cloudformation:UpdateStack", + "cloudformation:DeleteStack", + "cloudformation:ContinueUpdateRollback", + "cloudformation:SetStackPolicy", + "cloudformation:ValidateTemplate", + "cloudformation:DescribeStacks", + "cloudformation:DescribeStackEvents", + "cloudformation:Get*", + "cloudformation:List*" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": "iam:PassRole", + "Resource": "arn:aws:iam::*:role/sagemaker-*", + "Condition": { + "StringEquals": { + "iam:PassedToService": [ + "sagemaker.amazonaws.com", + "eks.amazonaws.com", + "lambda.amazonaws.com" + ] + } + } + }, + { + "Effect": "Allow", + "Action": [ + "iam:PassRole", + "iam:GetRole" + ], + "Resource": "arn:aws:iam::*:role/*" + }, + { + "Sid": "AmazonVPCFullAccess", + "Effect": "Allow", + "Action": [ + "ec2:AcceptVpcPeeringConnection", + "ec2:AcceptVpcEndpointConnections", + "ec2:AllocateAddress", + "ec2:AssignIpv6Addresses", + "ec2:AssignPrivateIpAddresses", + "ec2:AssociateAddress", + "ec2:AssociateDhcpOptions", + "ec2:AssociateRouteTable", + "ec2:AssociateSecurityGroupVpc", + "ec2:AssociateSubnetCidrBlock", + "ec2:AssociateVpcCidrBlock", + "ec2:AttachClassicLinkVpc", + "ec2:AttachInternetGateway", + "ec2:AttachNetworkInterface", + "ec2:AttachVpnGateway", + "ec2:AuthorizeSecurityGroupEgress", + "ec2:AuthorizeSecurityGroupIngress", + "ec2:CreateCarrierGateway", + "ec2:CreateCustomerGateway", + "ec2:CreateDefaultSubnet", + "ec2:CreateDefaultVpc", + "ec2:CreateDhcpOptions", + "ec2:CreateEgressOnlyInternetGateway", + "ec2:CreateFlowLogs", + "ec2:CreateInternetGateway", + "ec2:CreateLocalGatewayRouteTableVpcAssociation", + "ec2:CreateNatGateway", + "ec2:CreateNetworkAcl", + "ec2:CreateNetworkAclEntry", + "ec2:CreateNetworkInterface", + "ec2:CreateNetworkInterfacePermission", + "ec2:CreateRoute", + "ec2:CreateRouteTable", + "ec2:CreateSecurityGroup", + "ec2:CreateSubnet", + "ec2:CreateTags", + "ec2:CreateVpc", + "ec2:CreateVpcEndpoint", + "ec2:CreateVpcEndpointConnectionNotification", + "ec2:CreateVpcEndpointServiceConfiguration", + "ec2:CreateVpcPeeringConnection", + "ec2:CreateVpnConnection", + "ec2:CreateVpnConnectionRoute", + "ec2:CreateVpnGateway", + "ec2:DeleteCarrierGateway", + "ec2:DeleteCustomerGateway", + "ec2:DeleteDhcpOptions", + "ec2:DeleteEgressOnlyInternetGateway", + "ec2:DeleteFlowLogs", + "ec2:DeleteInternetGateway", + "ec2:DeleteLocalGatewayRouteTableVpcAssociation", + "ec2:DeleteNatGateway", + "ec2:DeleteNetworkAcl", + "ec2:DeleteNetworkAclEntry", + "ec2:DeleteNetworkInterface", + "ec2:DeleteNetworkInterfacePermission", + "ec2:DeleteRoute", + "ec2:DeleteRouteTable", + "ec2:DeleteSecurityGroup", + "ec2:DeleteSubnet", + "ec2:DeleteTags", + "ec2:DeleteVpc", + "ec2:DeleteVpcEndpoints", + "ec2:DeleteVpcEndpointConnectionNotifications", + "ec2:DeleteVpcEndpointServiceConfigurations", + "ec2:DeleteVpcPeeringConnection", + "ec2:DeleteVpnConnection", + "ec2:DeleteVpnConnectionRoute", + "ec2:DeleteVpnGateway", + "ec2:DescribeAccountAttributes", + "ec2:DescribeAddresses", + "ec2:DescribeAvailabilityZones", + "ec2:DescribeCarrierGateways", + "ec2:DescribeClassicLinkInstances", + "ec2:DescribeCustomerGateways", + "ec2:DescribeDhcpOptions", + "ec2:DescribeEgressOnlyInternetGateways", + "ec2:DescribeFlowLogs", + "ec2:DescribeInstances", + "ec2:DescribeInternetGateways", + "ec2:DescribeIpv6Pools", + "ec2:DescribeLocalGatewayRouteTables", + "ec2:DescribeLocalGatewayRouteTableVpcAssociations", + "ec2:DescribeKeyPairs", + "ec2:DescribeMovingAddresses", + "ec2:DescribeNatGateways", + "ec2:DescribeNetworkAcls", + "ec2:DescribeNetworkInterfaceAttribute", + "ec2:DescribeNetworkInterfacePermissions", + "ec2:DescribeNetworkInterfaces", + "ec2:DescribePrefixLists", + "ec2:DescribeRouteTables", + "ec2:DescribeSecurityGroupReferences", + "ec2:DescribeSecurityGroupRules", + "ec2:DescribeSecurityGroups", + "ec2:DescribeSecurityGroupVpcAssociations", + "ec2:DescribeStaleSecurityGroups", + "ec2:DescribeSubnets", + "ec2:DescribeTags", + "ec2:DescribeVpcAttribute", + "ec2:DescribeVpcClassicLink", + "ec2:DescribeVpcClassicLinkDnsSupport", + "ec2:DescribeVpcEndpointConnectionNotifications", + "ec2:DescribeVpcEndpointConnections", + "ec2:DescribeVpcEndpoints", + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:DescribeVpcEndpointServicePermissions", + "ec2:DescribeVpcEndpointServices", + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeVpcs",