AWS sagemaker high security documentation change
Summary
Modified IAM policy statements to use wildcard actions (*) and expanded resource permissions for S3, ECR, EC2, EKS, API Gateway, Elastic Load Balancing, and SageMaker services
Security assessment
The changes expand IAM permissions to use wildcard actions (e.g., s3:Get*, ec2:Describe*) and broader resource scopes (e.g., Resource: '*'). This violates the principle of least privilege and could lead to over-permissive policies. Specific security risks include granting s3:PutObject on all buckets and sagemaker:* permissions across all resources.
Diff
diff --git a/sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md b/sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md index e15d1ed0e..81bd1ab8e 100644 --- a//sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md +++ b//sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md @@ -122,0 +123 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "S3Access", @@ -125,4 +126,4 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "s3:ListBucket", - "s3:PutObject", - "s3:GetObject", - "s3:DeleteObject" + "s3:Get*", + "s3:List*", + "s3:Describe*", + "s3:PutObject" @@ -131,2 +132 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "arn:aws:s3:::$BUCKET_NAME", - "arn:aws:s3:::$BUCKET_NAME/*" + "*" @@ -135,0 +136 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "ECRAccess", @@ -138,7 +139 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "ecr:GetAuthorizationToken" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ + "ecr:GetAuthorizationToken", @@ -157 +152,3 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "*" + "Resource": [ + "*" + ] @@ -159,0 +157 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "EC2Access", @@ -172 +169,0 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "ec2:DescribeDhcpOptions", @@ -175,0 +173,2 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "ec2:DescribeInstances", + "ec2:DescribeInstanceTypes", @@ -177,0 +177 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "ec2:DescribeSubnets", @@ -180 +180,5 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "ec2:DescribeVpcs" + "ec2:DescribeVpcs", + "ec2:CreateVpcEndpointServiceConfiguration", + "ec2:DeleteVpcEndpointServiceConfigurations", + "ec2:DescribeVpcEndpointServiceConfigurations", + "ec2:ModifyVpcEndpointServicePermissions" @@ -182 +186,3 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "*" + "Resource": [ + "*" + ] @@ -184,0 +191 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "EKSAuthAccess", @@ -187,3 +193,0 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "eks:Describe*", - "eks:List*", - "eks:AssociateAccessPolicy", @@ -192 +196,3 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "*" + "Resource": [ + "*" + ] @@ -194,0 +201 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "EKSAccess", @@ -197,2 +204,4 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "elasticloadbalancing:Create*", - "elasticloadbalancing:Describe*" + "eks:AssociateAccessPolicy", + "eks:Describe*", + "eks:List*", + "eks:AccessKubernetesApi" @@ -200 +209,3 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "*" + "Resource": [ + "*" + ] @@ -202,0 +214 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "ApiGatewayAccess", @@ -205,17 +217,6 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "sagemaker:CreateModel", - "sagemaker:DescribeModel", - "sagemaker:DeleteModel", - "sagemaker:ListModels", - "sagemaker:CreateEndpointConfig", - "sagemaker:DescribeEndpointConfig", - "sagemaker:DeleteEndpointConfig", - "sagemaker:CreateEndpoint", - "sagemaker:DeleteEndpoint", - "sagemaker:DescribeEndpoint", - "sagemaker:UpdateEndpoint", - "sagemaker:ListTags", - "sagemaker:EnableClusterInference", - "sagemaker:DescribeClusterInference", - "sagemaker:DescribeHubContent", - "sagemaker:UpdateClusterInference", - "sagemaker:DescribeCluster" + "apigateway:POST", + "apigateway:GET", + "apigateway:PUT", + "apigateway:PATCH", + "apigateway:DELETE", + "apigateway:UpdateRestApiPolicy" @@ -223 +224,6 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "arn:aws:sagemaker:$REGION:*:*" + "Resource": [ + "arn:aws:apigateway:*::/vpclinks", + "arn:aws:apigateway:*::/vpclinks/*", + "arn:aws:apigateway:*::/restapis", + "arn:aws:apigateway:*::/restapis/*" + ] @@ -225,0 +232 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "ElasticLoadBalancingAccess", @@ -228 +235,13 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "fsx:DescribeFileSystems" + "elasticloadbalancing:CreateLoadBalancer", + "elasticloadbalancing:DescribeLoadBalancers", + "elasticloadbalancing:DescribeLoadBalancerAttributes", + "elasticloadbalancing:DescribeListeners", + "elasticloadbalancing:DescribeListenerCertificates", + "elasticloadbalancing:DescribeSSLPolicies", + "elasticloadbalancing:DescribeRules", + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:DescribeTargetGroupAttributes", + "elasticloadbalancing:DescribeTargetHealth", + "elasticloadbalancing:DescribeTags", + "elasticloadbalancing:DescribeTrustStores", + "elasticloadbalancing:DescribeListenerAttributes" @@ -230 +249,3 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "*" + "Resource": [ + "*" + ] @@ -232,0 +254 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h + "Sid": "SageMakerAccess", @@ -235,2 +257 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "acm:ImportCertificate", - "acm:DeleteCertificate" + "sagemaker:*" @@ -238 +259,3 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "arn:aws:acm:$REGION:$ACCOUNT_ID:certificate/*" + "Resource": [ + "*" + ] @@ -246 +269 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "arn:aws:iam::$ACCOUNT_ID:role/$HYPERPOD_INFERENCE_ROLE_NAME", + "Resource": "arn:aws:iam::*:role/*", @@ -254 +277 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Sid": "CloudWatchEMFPermissions", + "Sid": "AcmAccess", @@ -257,6 +280,2 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "cloudwatch:PutMetricData", - "logs:PutLogEvents", - "logs:DescribeLogStreams", - "logs:DescribeLogGroups", - "logs:CreateLogStream", - "logs:CreateLogGroup" + "acm:ImportCertificate", + "acm:DeleteCertificate" @@ -264 +283,3 @@ Complete the next critical preparation steps to ensure your Amazon EKS cluster h - "Resource": "*" + "Resource": [ + "*" + ] @@ -677 +698 @@ Access the helm chart from [https://github.com/aws/sagemaker-hyperpod-cli/tree/m - apiVersion: inference.sagemaker.aws.amazon.com/v1alpha1 + apiVersion: inference.sagemaker.aws.amazon.com/v1