AWS sagemaker high security documentation change
Summary
Added encryption requirements and examples for KMS keys with custom AMIs
Security assessment
The changes emphasize proper KMS key configuration for encrypted AMIs and cluster volumes, directly addressing data protection security controls and encryption best practices. Missing these configurations could lead to unauthorized data access.
Diff
diff --git a/sagemaker/latest/dg/hyperpod-custom-ami-cluster-management.md b/sagemaker/latest/dg/hyperpod-custom-ami-cluster-management.md index 55c9d5406..d18c67f1a 100644 --- a//sagemaker/latest/dg/hyperpod-custom-ami-cluster-management.md +++ b//sagemaker/latest/dg/hyperpod-custom-ami-cluster-management.md @@ -73,0 +74,4 @@ The following policy is a scoped down policy to ensure only AMIs tagged with `Al +###### Important + +If you plan to use an encrypted custom AMI, then make sure that your KMS key meets the permissions described in [Customer managed AWS KMS key encryption for SageMaker HyperPod](./smcluster-cmk.html). Additionally, ensure that your custom AMI's KMS key is also used to encrypt your cluster's Amazon EBS root volume. + @@ -78 +82,6 @@ You can specify your custom AMI in the `ImageId` field for the `CreateCluster` o -The following example shows how to create a cluster with a custom AMI: +The following examples show how to create a cluster with a custom AMI, both with and without an AWS KMS customer managed key for encrypting the cluster volumes. + +Standard example + + +The following example shows how to create a cluster with a custom AMI. @@ -108,0 +118,40 @@ The following example shows how to create a cluster with a custom AMI: +Customer managed key example + + +The following example shows how to create a cluster with a custom AMI while specifying your own AWS KMS customer managed key for encrypting the cluster's Amazon EBS volumes. If your custom AMI is encrypted with a customer managed key, ensure that you specify the same key for the root volume encryption. + + + aws sagemaker create-cluster \ + --cluster-name <exampleClusterName> \ + --orchestrator 'Eks={ClusterArn='<eks_cluster_arn>'}' \ + --node-provisioning-mode Continuous \ + --instance-groups '{ + "InstanceGroupName": "<exampleGroupName>", + "InstanceType": "ml.c5.2xlarge", + "InstanceCount": 2, + "LifeCycleConfig": { + "SourceS3Uri": "<s3://amzn-s3-demo-bucket>", + "OnCreate": "on_create_noop.sh" + }, + "ImageId": "<your_custom_ami>", + "ExecutionRole": "<arn:aws:iam:us-east-1:444455556666:role/Admin>", + "ThreadsPerCore": 1, + "InstanceStorageConfigs": [ + { + "EbsVolumeConfig": { + "RootVolume": True, + "VolumeKmsKeyId": "arn:aws:kms:us-east-1:111122223333:key/key-id" + } + }, + { + "EbsVolumeConfig": { + "VolumeSizeInGB": 100, + "VolumeKmsKeyId": "arn:aws:kms:us-east-1:111122223333:key/key-id" + } + } + ] + }' --vpc-config '{ + "SecurityGroupIds": ["<security_group>"], + "Subnets": ["<subnet>"] + }' + @@ -123 +172,6 @@ The following example shows how to update a cluster's platform software with a c -The following example shows how to scale up an instance group for a cluster using a custom AMI: +The following examples show how to scale up an instance group for a cluster using a custom AMI, both with and without using an AWS KMS customer managed key for encryption. + +Standard example + + +The following example shows how to scale up an instance group with a custom AMI. @@ -139,0 +194,34 @@ The following example shows how to scale up an instance group for a cluster usin +Customer managed key example + + +The following example shows how to update and scale up your cluster with a custom AMI while specifying your own AWS KMS customer managed key for encrypting the cluster's Amazon EBS volumes. If your custom AMI is encrypted with a customer managed key, ensure that you specify the same key for the root volume encryption. + + + aws sagemaker update-cluster \ + --cluster-name <exampleClusterName> --instance-groups '[{ + "InstanceGroupName": "<exampleGroupName>", + "InstanceType": "ml.c5.2xlarge", + "InstanceCount": 2, + "LifeCycleConfig": { + "SourceS3Uri": "<s3://amzn-s3-demo-bucket>", + "OnCreate": "on_create_noop.sh" + }, + "ExecutionRole": "<arn:aws:iam::444455556666:role/Admin>", + "ThreadsPerCore": 1, + "ImageId": "<your_custom_ami>", + "InstanceStorageConfigs": [ + { + "EbsVolumeConfig": { + "RootVolume": True, + "VolumeKmsKeyId": "arn:aws:kms:us-east-1:111122223333:key/key-id" + } + }, + { + "EbsVolumeConfig": { + "VolumeSizeInGB": 100, + "VolumeKmsKeyId": "arn:aws:kms:us-east-1:111122223333:key/key-id" + } + } + ] + }]' +