AWS sagemaker medium security documentation change
Summary
Updated documentation to clarify behavior of user background sessions, renamed 'Identity Center' to 'IAM Identity Center' for consistency, restructured content flow, and added details about session expiration impacts on SageMaker jobs.
Security assessment
The changes explicitly detail how session expiration and revocation (via IAM Identity Center) impact job execution security. For example, disabling background sessions forces jobs to use interactive sessions that fail within 15 minutes if the user logs out or sessions are revoked. This directly relates to access control and session management security practices.
Diff
diff --git a/sagemaker/latest/dg/trustedidentitypropagation-user-background-sessions.md b/sagemaker/latest/dg/trustedidentitypropagation-user-background-sessions.md index e7970fe5f..57d89d576 100644 --- a//sagemaker/latest/dg/trustedidentitypropagation-user-background-sessions.md +++ b//sagemaker/latest/dg/trustedidentitypropagation-user-background-sessions.md @@ -5 +5 @@ -Configure user background sessionDefault user background session durationImpact of disabling trusted identity propagation in StudioImpact of disabling user background sessions in the Identity Center consoleRuntime considerationsSession behavior summary +Configure user background sessionDefault user background session durationImpact of disabling trusted identity propagation in StudioImpact of disabling user background sessions in the IAM Identity Center consoleRuntime considerations @@ -13 +13,6 @@ User background sessions continue even when the user is no longer active. These -Existing active user sessions are not impacted when trusted identity propagation is enabled. The default duration applies only to new user sessions or restarted sessions + * Existing active user sessions are not impacted when trusted identity propagation is enabled. The default duration applies only to new user sessions or restarted sessions. + + * User background sessions apply to any long-running SageMaker AI workflows or jobs with persistent states. This includes, but is not limited to, any SageMaker AI resources that maintain execution status or require ongoing monitoring. For example, SageMaker Training, Processing, and Pipelines execution jobs. + + + @@ -23 +28 @@ Existing active user sessions are not impacted when trusted identity propagation - * Impact of disabling user background sessions in the Identity Center console + * Impact of disabling user background sessions in the IAM Identity Center console @@ -27,2 +31,0 @@ Existing active user sessions are not impacted when trusted identity propagation - * Session behavior summary - @@ -38 +41 @@ Once trusted identity propagation for Amazon SageMaker Studio is enabled, defaul -By default, all user background sessions have a duration limit of 7 days. Administrators can [modify this duration in the IAM Identity Center Console](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-background-sessions.html). This setting applies at the Identity Center instance level, affecting all supported IAM Identity Center applications and Studio domains within that instance. +By default, all user background sessions have a duration limit of 7 days. Administrators can [modify this duration in the IAM Identity Center console](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-background-sessions.html). This setting applies at the IAM Identity Center instance level, affecting all supported IAM Identity Center applications and Studio domains within that instance. @@ -44 +47 @@ When trusted identity propagation is enabled, administrators in the SageMaker AI - * A link to the Identity Center console where administrators can change this configuration + * A link to the IAM Identity Center console where administrators can change this configuration @@ -51 +54 @@ When trusted identity propagation is enabled, administrators in the SageMaker AI -An error message will occur when a user background session has expired. You can use the link to the Identity Center console to update the duration. +An error message will occur when a user background session has expired. You can use the link to the IAM Identity Center console to update the duration. @@ -59 +62 @@ If an administrator disables trusted identity propagation, after initially enabl - * When user background sessions are disabled, any long-running SageMaker AI workflows or jobs with persistent states will switch to using interactive sessions. This includes, but is not limited to, any SageMaker AI resources that maintain execution status or require ongoing monitoring. For example, SageMaker AI Training and Processing jobs. + * When user background sessions are disabled, any long-running SageMaker AI workflows or jobs with persistent states will switch to using interactive sessions. This includes, but is not limited to, any SageMaker AI resources that maintain execution status or require ongoing monitoring. For example, Amazon SageMaker Training and Processing jobs. @@ -68,7 +71 @@ If an administrator disables trusted identity propagation, after initially enabl -## Impact of disabling user background sessions in the Identity Center console - -If an administrator enables trusted identity propagation but disables [user background sessions](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-background-sessions.html) in the IAM Identity Center console: - - * If a user stays logged in, their Training jobs created while background sessions are disabled fallback to the interactive session. - - * If the user logs off, the session expires and Training jobs depending on the interactive session will fail. +## Impact of disabling user background sessions in the IAM Identity Center console @@ -76 +73 @@ If an administrator enables trusted identity propagation but disables [user back - * Users can restart their training job from the last checkpoint. The session duration is determined by what is set for the interactive session duration in the IAM Identity Center console. +When the user background session is **disabled** for the IAM Identity Center instance, the SageMaker AI job uses user interactive sessions. When using interactive sessions, a SageMaker AI job will fail within 15 minutes when: @@ -78 +75 @@ If an administrator enables trusted identity propagation but disables [user back - * Services like Training and Pipeline fall back to using interactive sessions in their workflows. + * The user logs out @@ -80 +77 @@ If an administrator enables trusted identity propagation but disables [user back - * SageMaker AI does not reject CreateTrainingJob requests but processes them as interactive sessions. + * The interactive session is revoked by the administrator @@ -82 +78,0 @@ If an administrator enables trusted identity propagation but disables [user back - * If a user disables background sessions **after** starting a job, the job will continue to use its existing background sessions. In other words, SageMaker AI will not create any new background sessions. @@ -85,0 +82 @@ If an administrator enables trusted identity propagation but disables [user back +When the user background session is **enabled** for the IAM Identity Center instance, the SageMaker AI job uses user background sessions. When using interactive sessions, a SageMaker AI job will fail within 15 minutes when: @@ -87 +84 @@ If an administrator enables trusted identity propagation but disables [user back -The same behavior applies if background sessions are enabled at the Identity Center instance level but disabled specifically for the Studio application using [IAM Identity Center APIs](https://docs.aws.amazon.com/singlesignon/latest/APIReference/welcome.html). + * The user background session expires @@ -89 +86 @@ The same behavior applies if background sessions are enabled at the Identity Cen -## Runtime considerations + * The user background session is manually revoked by an administrator @@ -91 +87,0 @@ The same behavior applies if background sessions are enabled at the Identity Cen -When an administrator sets `MaxRuntimeInSeconds` for long-running Training or Processing jobs that is lower than the user background session duration, SageMaker AI runs the job for the minimum of either `MaxRuntimeInSeconds` or user background session duration. For more information about `MaxRuntimeInSeconds`, see [CreateTrainingJob](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTrainingJob.html#sagemaker-CreateTrainingJob-request-StoppingCondition). See [user background sessions in the IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-background-sessions.html) for information on how to set the runtime. @@ -93 +88,0 @@ When an administrator sets `MaxRuntimeInSeconds` for long-running Training or Pr -## Session behavior summary @@ -95 +89,0 @@ When an administrator sets `MaxRuntimeInSeconds` for long-running Training or Pr -When the user background session is **disabled** for the IAM Identity Center instance, the SageMaker AI job uses user interactive sessions. When using interactive sessions, a SageMaker AI job will fail within 15 minutes when: @@ -97 +91 @@ When the user background session is **disabled** for the IAM Identity Center ins - * The user logs out +The following provides example behavior with SageMaker Training jobs. When an administrator enables trusted identity propagation but disables [user background sessions](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-background-sessions.html) in the IAM Identity Center console: @@ -99 +93 @@ When the user background session is **disabled** for the IAM Identity Center ins - * The interactive session is revoked by the administrator + * If a user stays logged in, their Training jobs created while background sessions are disabled fallback to the interactive session. @@ -100,0 +95 @@ When the user background session is **disabled** for the IAM Identity Center ins + * If the user logs off, the session expires and Training jobs depending on the interactive session will fail. @@ -101,0 +97 @@ When the user background session is **disabled** for the IAM Identity Center ins + * Users can restart their Training job from the last checkpoint. The session duration is determined by what is set for the interactive session duration in the IAM Identity Center console. @@ -102,0 +99 @@ When the user background session is **disabled** for the IAM Identity Center ins + * If a user disables background sessions **after** starting a job, the job will continue to use its existing background sessions. In other words, SageMaker AI will not create any new background sessions. @@ -104 +100,0 @@ When the user background session is **disabled** for the IAM Identity Center ins -When the user background session is **enabled** for the IAM Identity Center instance, the SageMaker AI job uses user background sessions. When using interactive sessions, a SageMaker AI job will fail within 15 minutes when: @@ -106 +101,0 @@ When the user background session is **enabled** for the IAM Identity Center inst - * The user background session expires @@ -108 +102,0 @@ When the user background session is **enabled** for the IAM Identity Center inst - * The user background session is manually revoked by administrator @@ -109,0 +104 @@ When the user background session is **enabled** for the IAM Identity Center inst +The same behavior applies if background sessions are enabled at the IAM Identity Center instance level but disabled specifically for the Studio application using [IAM Identity Center APIs](https://docs.aws.amazon.com/singlesignon/latest/APIReference/welcome.html). @@ -110,0 +106 @@ When the user background session is **enabled** for the IAM Identity Center inst +## Runtime considerations @@ -111,0 +108 @@ When the user background session is **enabled** for the IAM Identity Center inst +When an administrator sets `MaxRuntimeInSeconds` for long-running Training or Processing jobs that is lower than the user background session duration, SageMaker AI runs the job for the minimum of either `MaxRuntimeInSeconds` or user background session duration. For more information about `MaxRuntimeInSeconds`, see [CreateTrainingJob](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_CreateTrainingJob.html#sagemaker-CreateTrainingJob-request-StoppingCondition). See [user background sessions in the IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/user-background-sessions.html) for information on how to set the runtime.