AWS sagemaker documentation change
Summary
Entire documentation content replaced with a redirect to Amazon Nova 1.0 user guide
Security assessment
This appears to be a documentation relocation rather than addressing security vulnerabilities. The change removes detailed technical content about IAM roles, KMS keys, and security configurations but doesn't indicate any specific security issue being addressed. The removal of security-related configuration details doesn't inherently demonstrate a security fix.
Diff
diff --git a/sagemaker/latest/dg/nova-distillation.md b/sagemaker/latest/dg/nova-distillation.md index 0db2c6201..218ec42e0 100644 --- a//sagemaker/latest/dg/nova-distillation.md +++ b//sagemaker/latest/dg/nova-distillation.md @@ -5,2 +4,0 @@ -Key componentsUse casesPrerequisitesSet up data augmentationStart a training jobCloudWatch logsSuccessful trainingValidate augmented data quality - @@ -9,456 +7 @@ Key componentsUse casesPrerequisitesSet up data augmentationStart a training job -This quick start guide helps you get started with Amazon Nova model distillation using supervised fine-tuning (SFT) on SageMaker AI. - -Model distillation is a method that transfers knowledge from large, advanced models to smaller, efficient ones. With Amazon Nova models, a larger "teacher" model (like Amazon Nova Pro or Amazon Nova Premier) passes its capabilities to a smaller "student" model (like Amazon Nova Lite or Amazon Nova Micro). This creates a customized model that maintains high performance while using fewer resources. - -## Key components - -The distillation process primarily involves two types of models: - -**Teacher models** serve as the knowledge source and include: - - * Amazon Nova Pro (amazon.nova-pro-v1:0) - - * Amazon Nova Premier (amazon.nova-premier-v1:0) - - - - -**Student models** receive and implement the knowledge: - - * Amazon Nova Lite (amazon.nova-lite-v1:0:300k) - - * Amazon Nova Micro (amazon.nova-micro-v1:0:128k) - - * Amazon Nova Pro (amazon.nova-pro-v1:0:300k) - Available only when using Amazon Nova Premier as teacher - - - - -## Use cases - -Mode distillation is particularly beneficial when: - - * Your application has strict latency, cost, and accuracy requirements. - - * You need a custom model for specific tasks but lack sufficient high-quality labeled training data. - - * You want to match the performance of advanced models while maintaining the efficiency of smaller models. - - - - -## Prerequisites - - * AWS account with access to Amazon Nova models and appropriate service quotas (min. 6 P5 and 1 R5 instances). - - * IAM role with permissions for SageMaker training jobs. - - * Amazon S3 bucket to store training data and outputs. - - - - -## Setting up data augmentation - -The data augmentation phase uses SageMaker training jobs to generate high-quality training data using the teacher model. This section details the setup process and requirements. - -### IAM role - -To create IAM roles and attach policies, see [Creating roles and attaching policies (console)](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_job-functions_create-policies.html). If you use AWS CLI, follow instructions in [create-role](https://docs.aws.amazon.com//cli/latest/reference/iam/create-role.html) and [attach-role-policy](https://docs.aws.amazon.com//cli/latest/reference/iam/attach-role-policy.html). For more information, see [How to use SageMaker AI execution roles](https://docs.aws.amazon.com//sagemaker/latest/dg/sagemaker-roles.html) from the _SageMaker AI Developer Guide_. - -The following are example commands for your reference. - -**Create a SageMaker AI execution role** - -The role is created with a trust relationship allowing SageMaker AI, Amazon Bedrock, to assume this role. This enables these services to act on your behalf when executing batch inference jobs. - - - aws iam create-role \ - --role-name NovaCustomizationRole \ - --assume-role-policy-document '{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Service": ["sagemaker.amazonaws.com", - "bedrock.amazonaws.com"] - }, - "Action": "sts:AssumeRole" - } - ] - }' - -**Attach necessary policies** - - - # Attach AmazonSageMakerFullAccess - aws iam attach-role-policy \ - --role-name NovaCustomizationRole \ - --policy-arn arn:aws:iam::aws:policy/AmazonSageMakerFullAccess - - # Attach AmazonBedrockFullAccess - aws iam attach-role-policy \ - --role-name NovaCustomizationRole \ - --policy-arn arn:aws:iam::aws:policy/AmazonBedrockFullAccess - - # Attach S3 access policy - aws iam attach-role-policy \ - --role-name NovaCustomizationRole \ - --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess - - # Attach AmazonEC2FullAccess - aws iam attach-role-policy \ - --role-name NovaCustomizationRole \ - --policy-arn arn:aws:iam::aws:policy/AmazonEC2FullAccess - - # Attach AmazonEC2ContainerRegistryFullAccess - aws iam attach-role-policy \ - --role-name NovaCustomizationRole \ - --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryFullAccess - - # Attach AmazonEC2ContainerRegistryFullAccess - aws iam attach-role-policy \ - --role-name NovaCustomizationRole \ - --policy-arn arn:aws:iam::aws:policy/CloudWatchLogsFullAccess - -Attach the following inline policy to customer execution role needed for Distillation Container. - - * AWS KMS permissions: Allows the role to interact with AWS Key Management Service, necessary for accessing encrypted resources or managing encryption keys. - - * `IAM:PassRole`: This permission is often required when one service needs to pass this role to another service, a common pattern in AWS service integrations. - - - - - - aws iam put-role-policy \ - --role-name NovaCustomizationRole \ - --policy-name Distillation-Additional-Permissions\ - --policy-document '{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": [ - "kms:*" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "iam:PassRole" - ], - "Resource": "*" - } - ] - } - -### Amazon VPC configuration - -To create Amazon VPC configuration for SageMaker AI training jobs using the AWS Management Console, follow instructions in [Configure Your private VPC for SageMaker training (console)](https://docs.aws.amazon.com//sagemaker/latest/dg/train-vpc.html). - -**Create a new Amazon VPC** - - - Name: Distillation-VPC - IPv4 CIDR: 10.0.0.0/16 (or your preferred range) - Availability Zones: 2 - Public Subnets: 2 - Private Subnets: 2 - NAT Gateways: 1 (in one AZ) - -**Create a security group** - - - Name: Distillation-SG - Description: Security group for data distillation jobs - Inbound Rules: Allow all traffic from self - Outbound Rules: Allow all traffic (0.0.0.0/0) - -**Create VPC endpoints for the following services** - - - com.amazonaws.[region].s3 - com.amazonaws.[region].sagemaker.api - com.amazonaws.[region].sagemaker.runtime - com.amazonaws.[region].bedrock.api - com.amazonaws.[region].bedrock.runtime - com.amazonaws.[region].sts - com.amazonaws.[region].logs - com.amazonaws.[region].ecr.api - com.amazonaws.[region].ecr.dkr - -For each endpoint: - - * Select your Distillation-VPC - - * Choose the private subnets - - * Select the Distillation-SG security group -