AWS sagemaker medium security documentation change
Summary
Updated prerequisites and installation process for HyperPod training operator, including IAM role configuration, EKS Pod Identity Agent setup, and console/CLI installation methods
Security assessment
Added explicit requirements for IAM role trust policies with sts:AssumeRole/eks-auth permissions and managed policy attachments. Includes security-focused pod identity association setup and cert-manager installation (TLS certificate management). These changes enforce least-privilege access controls for cluster operations.
Diff
diff --git a/sagemaker/latest/dg/sagemaker-eks-operator-install.md b/sagemaker/latest/dg/sagemaker-eks-operator-install.md index f528793ac..542b44acb 100644 --- a//sagemaker/latest/dg/sagemaker-eks-operator-install.md +++ b//sagemaker/latest/dg/sagemaker-eks-operator-install.md @@ -5 +5 @@ -PrerequisitesAmazon EKS Pod Identity AgentTraining operatorHyperPod elastic agentTask governanceKueue +PrerequisitesInstallationHyperPod elastic agentTask governanceKueue @@ -15 +15 @@ Before you use the HyperPod training operator, you must have completed the follo - * [Created a HyperPod cluster with Amazon EKS support](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-hyperpod-eks-prerequisites.html) + * [ Created a HyperPod cluster with Amazon EKS orchestration](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-hyperpod-eks-operate-console-ui-create-cluster.html). @@ -17 +17 @@ Before you use the HyperPod training operator, you must have completed the follo - * [Set up your HyperPod cluster with a custom Amazon VPC](https://docs.aws.amazon.com/sagemaker/latest/dg/sagemaker-hyperpod-prerequisites.html#sagemaker-hyperpod-prerequisites-optional-vpc) + * Installed the latest AMI on your HyperPod cluster. For more information, see [SageMaker HyperPod AMI releases for Amazon EKS](./sagemaker-hyperpod-release-ami-eks.html). @@ -19 +19 @@ Before you use the HyperPod training operator, you must have completed the follo - * Installed the latest AMI on your HyperPod cluster. For more information, see [SageMaker HyperPod AMI releases for Amazon EKS](./sagemaker-hyperpod-release-ami-eks.html) + * [Installed cert-manager](https://cert-manager.io/docs/installation/). @@ -21 +21 @@ Before you use the HyperPod training operator, you must have completed the follo - * [Installed cert-manager](https://cert-manager.io/docs/installation/) + * [ Set up the EKS Pod Identity Agent using the console](https://docs.aws.amazon.com/eks/latest/userguide/pod-id-agent-setup.html). If you want to use the AWS CLI, use the following command: @@ -22,0 +23,4 @@ Before you use the HyperPod training operator, you must have completed the follo + aws eks create-addon \ + --cluster-name my-eks-cluster \ + --addon-name eks-pod-identity-agent \ + --region AWS Region @@ -26 +29,0 @@ Before you use the HyperPod training operator, you must have completed the follo -Installing the HyperPod training operator requires you to first install other components. See the following sections on how to do so. @@ -28 +31 @@ Installing the HyperPod training operator requires you to first install other co -## Step 1: Set up Amazon EKS Pod Identity Agent +## Installing the training operator @@ -30 +33 @@ Installing the HyperPod training operator requires you to first install other co - 1. Make sure that the IAM execution role for your HyperPod cluster has the [ eks-auth:AssumeRoleForPodIdentity](https://docs.aws.amazon.com/eks/latest/APIReference/API_auth_AssumeRoleForPodIdentity.html) permission or [create a new IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) with the following permissions to use with the training operator. +You can now install the HyperPod training operator through the SageMaker AI console, the Amazon EKS console, or with the AWS CLI The console methods offer simplified experiences that help you install the operator. The AWS CLI offers a programmatic approach that lets you customize more of your installation. @@ -32,16 +35,18 @@ Installing the HyperPod training operator requires you to first install other co - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowEksAuthToAssumeRoleForPodIdentity", - "Effect": "Allow", - "Principal": { - "Service": "pods.eks.amazonaws.com" - }, - "Action": [ - "sts:AssumeRole", - "sts:TagSession" - ] - } - ] - } +Between the two console experiences, SageMaker AI provides a one-click installation creates the IAM execution role, creates the pod identity association, and installs the operator. The Amazon EKS console installation is similar, but this method doesn't automatically create the IAM execution role. During this process, you can choose to create a new IAM execution role with information that the console pre-populates. By default, these created roles only have access to the current cluster that you're installing the operator in. Unless you edit the role's permissions to include other clusters, if you remove and reinstall the operator, you must create a new role. + +SageMaker AI console (recommended) + + + 1. Open the Amazon SageMaker AI console at [https://console.aws.amazon.com/sagemaker/](https://console.aws.amazon.com/sagemaker/). + + 2. Go to your cluster's details page. + + 3. On the **Dashboard** tab, locate the add-on named **Amazon SageMaker HyperPod training operator** , and choose **install**. During the installation process, SageMaker AI creates an IAM execution role with permissions similar to the [ AmazonSageMakerHyperPodTrainingOperatorAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerHyperPodTrainingOperatorAccess.html) managed policy and creates a pod identity association between your Amazon EKS cluster and your new execution role. + + + + +Amazon EKS console + + +###### Note @@ -49 +54 @@ Installing the HyperPod training operator requires you to first install other co - 2. Attach the following IAM policy to your newly created role. Make sure that you specify your HyperPod cluster ARN. +If you install the add-on through the Amazon EKS cluster, first make sure that you've tagged your HyperPod cluster with the key-value pair `SageMaker:true`. Otherwise, the installation will fail. @@ -51 +56 @@ Installing the HyperPod training operator requires you to first install other co -JSON + 1. Open the Amazon EKS console at [https://console.aws.amazon.com/eks/home#/clusters](https://console.aws.amazon.com/eks/home#/clusters). @@ -52,0 +58 @@ JSON + 2. Go to your EKS cluster, choose **Add-ons** , then choose **Get more Add-ons**. @@ -54 +60 @@ JSON -**** + 3. Choose Amazon SageMaker HyperPod training operator, then choose **Next**. @@ -55,0 +62,15 @@ JSON + 4. Under **Version** , the console defaults to the latest version, which we recommend that you use. + + 5. Under **Add-on access** , choose a pod identity IAM role to use with the training operator add-on. If you don't already have a role, choose **Create recommended role** to create one. + + 6. During this role creation process, the IAM console pre-populates all of the necessary information, such as the use case, the [ AmazonSageMakerHyperPodTrainingOperatorAccess](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerHyperPodTrainingOperatorAccess.html) managed policy and other required permissions, the role name, and the description. As you go through the steps, review the information, and choose **Create role**. + + 7. In the EKS console, review your add-on's settings, and then choose **Create**. + + + + +CLI + + + 1. Make sure that the IAM execution role for your HyperPod cluster has a trust relationship that allows EKS Pod Identity to assume the role or or [create a new IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create.html) with the following trust policy. Alternatively, you could use the Amazon EKS console to install the add-on, which creates a recommended role. @@ -60,0 +82 @@ JSON + "Sid": "AllowEksAuthToAssumeRoleForPodIdentity", @@ -61,0 +84,3 @@ JSON + "Principal": { + "Service": "pods.eks.amazonaws.com" + }, @@ -63,3 +88,4 @@ JSON - "sagemaker:DescribeClusterNode" - ], - "Resource": "arn:aws:sagemaker:us-east-1:111122223333:cluster/cluster_name" + "sts:AssumeRole", + "sts:TagSession", + "eks-auth:AssumeRoleForPodIdentity" + ] @@ -69,0 +96 @@ JSON + 2. Attach the [ AmazonSageMakerHyperPodTrainingOperatorAccess managed policy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AmazonSageMakerHyperPodTrainingOperatorAccess.html) to your created role. @@ -71,8 +98 @@ JSON - 3. [ Set up the EKS Pod Identity Agent using the console](https://docs.aws.amazon.com/eks/latest/userguide/pod-id-agent-setup.html). If you want to use the AWS CLI, use the following command. - - aws eks create-addon \ - --cluster-name my-eks-cluster \ - --addon-name eks-pod-identity-agent \ - --region AWS Region - - 4. [ Then create a pod identity association between your EKS cluster, your IAM role, and your new IAM role](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). + 3. [ Then create a pod identity association between your EKS cluster, your IAM role, and your new IAM role](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html). @@ -82 +102 @@ JSON - --role-arn ARN of your role \ + --role-arn ARN of your execution role \ @@ -87 +107 @@ JSON - 5. After you finish the process, you can use the ListPodIdentityAssociations operation to see the association you created. The following is a sample response of what it might look like. + 4. After you finish the process, you can use the ListPodIdentityAssociations operation to see the association you created. The following is a sample response of what it might look like. @@ -100,9 +120 @@ JSON - - - -## Step 2: Install the HyperPod training operator - -You can now install the HyperPod training operator through the Amazon EKS console or with the [CreateAddOn](https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateAddon.html) API operation. If you’re using the console, search for the add-on named **Amazon SageMaker HyperPod training operator**. - -Below is an example of how you can install the operator with the API and CLI. The `--addon-version` parameter is optional. If you don’t provide one, the default is the latest version. To get the possible versions, use the [ DescribeAddonVersions](https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddonVersions.html) operation. - + 5. To install the training operator, use the `create-addon` operation. The `--addon-version` parameter is optional. If you don’t provide one, the default is the latest version. To get the possible versions, use the [ DescribeAddonVersions](https://docs.aws.amazon.com/eks/latest/APIReference/API_DescribeAddonVersions.html) operation. @@ -125 +140 @@ hpTrainingControllerManager.nodeSelector | Node selector for the controller pods -## Step 3: Install the HyperPod elastic agent +## HyperPod elastic agent