AWS sagemaker documentation change
Summary
Updated prerequisites for observability add-on: added region requirements, EKS Pod Identity Agent dependency, node size guidance, and removed specific IAM policy sections
Security assessment
The changes add security-related documentation about IAM Identity Center setup and EKS Pod Identity Agent requirements for secure credential management. However, the removed IAM policies and added node size requirements appear to be operational improvements rather than direct responses to security vulnerabilities. The EKS Pod Identity Agent requirement improves security posture by enforcing proper credential handling but doesn't address a specific disclosed issue.
Diff
diff --git a/sagemaker/latest/dg/hyperpod-observability-addon-setup.md b/sagemaker/latest/dg/hyperpod-observability-addon-setup.md index bbf80c4fb..3a9bf9273 100644 --- a//sagemaker/latest/dg/hyperpod-observability-addon-setup.md +++ b//sagemaker/latest/dg/hyperpod-observability-addon-setup.md @@ -11 +11,7 @@ To have metrics for your Amazon SageMaker HyperPod (SageMaker HyperPod) cluster - * Enable AWS IAM Identity Center (IAM Identity Center) to use Amazon Managed Grafana. If IAM Identity Center isn’t already enabled in your account, see [Getting started with IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/getting-started.html). Additionally, create at least one user in the IAM Identity Center. + * To use Amazon Managed Grafana, enable AWS IAM Identity Center (IAM Identity Center) in an AWS Region where Amazon Managed Grafana is available. For instructions, see [Getting started with IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/getting-started.html) in the _AWS IAM Identity Center User Guide_. For a list of AWS Regions where Amazon Managed Grafana is available, see [Supported Regions](https://docs.aws.amazon.com/grafana/latest/userguide/what-is-Amazon-Managed-Service-Grafana.html#AMG-supported-Regions) in the _Amazon Managed Grafana User Guide_. + + * Create at least one user in IAM Identity Center. + + * Ensure that the [Amazon EKS Pod Identity Agent](https://docs.aws.amazon.com/eks/latest/userguide/workloads-add-ons-available-eks.html#add-ons-pod-id) add-on is installed in your Amazon EKS cluster. The Amazon EKS Pod Identity Agent add-on makes it possible for the SageMaker HyperPod observability add-on to get the credentials to interact with Amazon Managed Service for Prometheus and CloudWatch Logs. To check whether your Amazon EKS cluster has the add-on, go to the Amazon EKS console, and check your cluster's **Add-ons** tab. For information about how to install the add-on if it's not installed, see [Create add-on (AWS Management Console)](https://docs.aws.amazon.com/eks/latest/userguide/creating-an-add-on.html#_create_add_on_console) in the _Amazon EKS User Guide_. + + * Ensure that you have at least one node in your SageMaker HyperPod cluster before installing SageMaker HyperPod observability add-on. The smallest Amazon EC2 instance type that works in this case is `4xlarge`. This minimum node size requirement ensures that the node can accommodate all the pods that the SageMaker HyperPod observability add-on creates alongside any other already running pods on the cluster. @@ -41,38 +46,0 @@ To have metrics for your Amazon SageMaker HyperPod (SageMaker HyperPod) cluster - }, - { - "Sid": "IAMGrafanaPassRoleAccess", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": "arn:aws:iam::*:role/service-role/AmazonSageMakerHyperPodObservabilityGrafanaAccess*", - "Condition": { - "StringLike": { - "iam:PassedToService": [ - "grafana.amazonaws.com" - ] - } - } - }, - { - "Sid": "IAMEKSPassRoleAccess", - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": "arn:aws:iam::*:role/service-role/AmazonSageMakerHyperPodObservabilityAddonAccess*", - "Condition": { - "StringLike": { - "iam:PassedToService": [ - "pods.eks.amazonaws.com" - ] - } - } - }, - { - "Sid": "IAMGetRoleAccess", - "Effect": "Allow", - "Action": "iam:GetRole", - "Resource": [ - "arn:aws:iam::*:role/service-role/AmazonSageMakerHyperPodObservabilityAddonAccess*" - ] @@ -105,17 +72,0 @@ To have metrics for your Amazon SageMaker HyperPod (SageMaker HyperPod) cluster - * Additional permissions needed to remove and update pod identity association for the add-on: - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "EKSPodIdentity", - "Effect": "Allow", - "Action": [ - "eks:DeletePodIdentityAssociation", - "eks:UpdatePodIdentityAssociation" - ], - "Resource": "*" - } - ] - } -