AWS nova medium security documentation change
Summary
Added Prerequisites section with subscription requirements and IAM permissions, plus additional setup steps for Restricted Instance Group
Security assessment
The change mandates specific IAM role permissions (ListAttachedRolePolicy, ListRoleTags) and requires adding a Restricted Instance Group (RIG) to SageMaker HyperPod clusters. RIGs typically enforce security boundaries and resource isolation, indicating enhanced security controls. The explicit permission requirements suggest security-conscious access management.
Diff
diff --git a/nova/latest/nova2-userguide/nova-forge.md b/nova/latest/nova2-userguide/nova-forge.md index aab74edd4..dfb26e0b7 100644 --- a//nova/latest/nova2-userguide/nova-forge.md +++ b//nova/latest/nova2-userguide/nova-forge.md @@ -4,0 +5,2 @@ +Prerequisites + @@ -21 +23,34 @@ Nova Forge provides the following key capabilities: - * Use the built-in responsible AI toolkit to implement custom safety guardrails + * Use the Responsible AI Toolkit to align models to Amazon Nova's responsible AI guidelines during the training process and implement runtime controls to moderate model responses during inference. + + + + +## Prerequisites + +###### Topics + + * Subscribe to Nova Forge + + * Other prerequisites + + + + +### Subscribe to Nova Forge + +To request access to the Amazon Nova Forge service, add the following tag to your console IAM role: key forge-subscription with value true. After you've added this tag to your role, please go to SageMaker AI Console > Model training and customization and click on Nova Forge. On this page, you'll find details about the service, pricing information and the capabilities. You can request subscription and then manage your subscription from this page. + + 1. The role should have permission to call api `ListAttachedRolePolicy`, and the response should include either `AdministratorAccess` or `AmazonSageMakerFullAccess` policy. + + 2. The sign-in role should have permission to call api `ListRoleTags`, and the response tags should include `tag.key=forge-subscription`. + + + + +### Other prerequisites + +Also ensure the following prerequisites are complete: + + 1. [General prerequisites](https://docs.aws.amazon.com//nova/latest/nova2-userguide/nova-model.html#nova-model-general-prerequisites) + + 2. Additional steps for users: Add Restricted Instance Group (RIG) to your SageMaker HyperPod cluster (to complete follow steps [here](https://docs.aws.amazon.com//sagemaker/latest/dg/nova-hp-cluster.html))