AWS sagemaker-unified-studio documentation change
Summary
Added comprehensive Amazon VPC troubleshooting section including subnet configuration scenarios, instructions for converting public subnets to private, adding NAT gateways, and configuring VPC endpoints. Also added important note about Amazon Athena for Apache Spark not supporting VPC and provided controls to disable it.
Security assessment
This change enhances security documentation by providing detailed guidance on network isolation configurations, but does not address a specific security vulnerability or incident. It adds security best practices documentation for VPC configuration, subnet management, and service control policies to enforce network isolation. The change improves security posture documentation but is not a direct response to a security issue.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/network-isolation.md b/sagemaker-unified-studio/latest/adminguide/network-isolation.md index b2bac4f53..cd97599fa 100644 --- a//sagemaker-unified-studio/latest/adminguide/network-isolation.md +++ b//sagemaker-unified-studio/latest/adminguide/network-isolation.md @@ -7 +7 @@ -PrerequisitesRestrict Amazon SageMaker Unified Studio network traffic to within the AWS networkPublic internet access +PrerequisitesRestrict Amazon SageMaker Unified Studio network traffic to within the AWS networkPublic internet accessAmazon VPC troubleshooting @@ -49 +49,32 @@ This level of network isolation means: -###### Note +###### Important + +Amazon Athena for Apache Spark does not currently support Amazon VPC. If you require Amazon VPC connectivity for your Spark workloads, use Amazon EMR or AWS Glue instead. + +###### Disable Amazon Athena Spark in Amazon VPC-enabled domains + +If your organization requires all compute traffic to stay within the Amazon VPC, you can disable Amazon Athena Spark by using the following controls. + + * **Account or organization-level SCP** — Apply a service control policy (SCP) that denies `athena:StartSession` and `athena:UpdateSession`. + +The following IAM policy denies these actions for all Amazon Athena workgroups. + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "DenyAthenaSparkStartSession", + "Effect": "Deny", + "Action": [ + "athena:StartSession", + "athena:UpdateSession" + ], + "Resource": [ + "arn:aws:athena:*:*:workgroup/*" + ] + } + ] + } + +The wildcard ARN `arn:aws:athena:*:*:workgroup/*` applies to all Regions and accounts. You can scope the policy to specific Regions, accounts, or workgroups by replacing the wildcards. + + * **Tooling blueprint configuration** — Disable the Amazon Athena flag in tooling blueprints to prevent Amazon Athena (SQL) and Amazon Athena Spark from being provisioned in new projects. @@ -51 +82,6 @@ This level of network isolation means: -If Amazon VPC endpoints are missing or misconfigured, network calls to Amazon SageMaker Unified Studio and other AWS services will be routed over the public Internet when that network path is available. + * **Project-level policy updates** — Remove Amazon Athena Spark permissions from individual project IAM policies to restrict access at the project level. + + + + +If Amazon VPC endpoints are missing or misconfigured, network calls to Amazon SageMaker Unified Studio and other AWS services route over the public internet when that network path is available. @@ -230,0 +267,205 @@ Amazon SageMaker Unified Studio domains that use IAM login for the Portal web cl +## Amazon VPC troubleshooting + +This section helps you diagnose and resolve common Amazon VPC configuration issues that affect notebook connectivity in Amazon SageMaker Unified Studio. Use the following table to identify your subnet configuration and determine the appropriate recovery action. + +Scenario (Subnet 1 type, Subnet 2 type) | Expected behavior | Recovery action +---|---|--- +Private with NAT + Private with NAT | Works as expected | No action needed +Private no NAT + Private no NAT | Only local Python kernel works | Add NAT (Add a NAT gateway to a private subnet) or add Amazon VPC endpoints (Add Amazon VPC endpoints) +Public + Public | Only local Python kernel works | Convert to private (Convert a public subnet to a private subnet) or add Amazon VPC endpoints (Add Amazon VPC endpoints) +Private with NAT + Public | Works as expected | No action needed +Private no NAT + Public | Only local Python kernel works | Convert to private (Convert a public subnet to a private subnet), add NAT (Add a NAT gateway to a private subnet), or add Amazon VPC endpoints (Add Amazon VPC endpoints) + +### Convert a public subnet to a private subnet + +A public subnet has a route to an internet gateway (IGW), which allows resources in the subnet to communicate directly with the internet. To convert a public subnet to a private subnet, remove the IGW route and disable auto-assign public IP. + +###### Note + +Existing instances in the subnet retain their public IP addresses after you make this change. Any services that rely on inbound internet access stop working. To maintain outbound access for package installations and AWS API calls, set up a NAT gateway or Amazon VPC endpoints before converting the subnet. + +###### To convert a public subnet to a private subnet + + 1. Open the Amazon Virtual Private Cloud console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). + + 2. In the navigation pane, choose **Route tables**. + + 3. Select the route table associated with your public subnet. + + 4. Choose the **Routes** tab. + + 5. Choose **Edit routes**. + + 6. Choose **Remove** for the route with destination `0.0.0.0/0` that targets an internet gateway (`igw-xxx`). + + 7. Choose **Save changes**. + + + + +###### To disable auto-assign public IP + + 1. In the navigation pane, choose **Subnets**. + + 2. Select your subnet. + + 3. Choose **Actions** , **Edit subnet settings**. + + 4. Clear the **Enable auto-assign public IPv4 address** checkbox. + + 5. Choose **Save**. + + + + +(Optional) If instances in the subnet need outbound internet access, add a NAT gateway route. For instructions, see Add a NAT gateway to a private subnet. + +###### To verify the conversion + + 1. In the navigation pane, choose **Subnets**. + + 2. Select your subnet and choose the **Route table** tab. + + 3. Confirm that no route with destination `0.0.0.0/0` targets an internet gateway. + + + + +### Add a NAT gateway to a private subnet + +A NAT gateway allows instances in a private subnet to connect to the internet for outbound traffic while preventing unsolicited inbound connections. You must have a public subnet with an internet gateway route before you create a NAT gateway. + +###### To create a NAT gateway + + 1. Open the Amazon Virtual Private Cloud console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). + + 2. In the navigation pane, choose **NAT gateways**. + + 3. Choose **Create NAT gateway**. + + 4. For **Subnet** , select a public subnet that has a route to an internet gateway. + + 5. For **Connectivity type** , select **Public**. + + 6. Choose **Allocate Elastic IP** to assign a new Elastic IP address to the NAT gateway. + + 7. Choose **Create NAT gateway**. + + + + +###### To update the private subnet route table + + 1. In the navigation pane, choose **Route tables**. + + 2. Select the route table associated with your private subnet. + + 3. Choose the **Routes** tab. + + 4. Choose **Edit routes**. + + 5. Choose **Add route**. For **Destination** , enter `0.0.0.0/0`. For **Target** , select the NAT gateway that you created. + + 6. Choose **Save changes**. + + + + +###### To verify the NAT gateway + + 1. In the navigation pane, choose **NAT gateways**. + + 2. Confirm that the NAT gateway status is **Available**. + + 3. In the navigation pane, choose **Route tables** and select the private subnet route table. + + 4. Confirm that the `0.0.0.0/0` route targets the NAT gateway. + + + + +### Add Amazon VPC endpoints + +Amazon VPC endpoints allow resources in your private subnets to communicate with AWS services without requiring internet access. There are two types of Amazon VPC endpoints: + + * **Gateway endpoints** – For Amazon Simple Storage Service and Amazon DynamoDB. Gateway endpoints are free of charge. + + * **Interface endpoints** – For other AWS services such as AWS Security Token Service, Amazon CloudWatch, Amazon ECR, and AWS Systems Manager. Interface endpoints cost approximately $0.01 per hour per Availability Zone, plus data processing charges. + + + + +The following are common endpoints to add for Amazon SageMaker Unified Studio notebook connectivity: + + * Amazon Simple Storage Service (gateway) + + * Amazon DynamoDB (gateway) + + * AWS Security Token Service (interface) + + * Amazon ECR – `ecr.api` and `ecr.dkr` (interface) + + * Amazon CloudWatch Logs (interface) + + * AWS Systems Manager (interface) + + + + +###### To create a gateway endpoint +