AWS sagemaker medium security documentation change
Summary
Added documentation for CloudTrail logging of SageMaker job APIs (ChatCompletions, CompleteRollout, Sample, SampleWithResponseStream), updated non-logged parameters list, added job resource configuration example, and included sample CloudTrail events for new operations.
Security assessment
The change explicitly hides request/response bodies in CloudTrail logs ('HIDDEN_DUE_TO_SECURITY_REASONS') for Sample and SampleWithResponseStream operations, preventing sensitive data exposure. This addresses potential security risks of logging AI job inputs/outputs. The update also extends security best practices to new SageMaker job APIs.
Diff
diff --git a/sagemaker/latest/dg/logging-using-cloudtrail.md b/sagemaker/latest/dg/logging-using-cloudtrail.md index 1c7159ea5..303570a0f 100644 --- a//sagemaker/latest/dg/logging-using-cloudtrail.md +++ b//sagemaker/latest/dg/logging-using-cloudtrail.md @@ -64,0 +65,8 @@ Resource type (console) | resources.type value | Data APIs logged to CloudTrail +**SageMaker jobs** | `AWS::SageMaker::Job` | + + * [ChatCompletions](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_ChatCompletions.html) + * [CompleteRollout](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_CompleteRollout.html) + * [Sample](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_Sample.html) + * [SampleWithResponseStream](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_runtime_SampleWithResponseStream.html) + + @@ -68 +76 @@ Resource type (console) | resources.type value | Data APIs logged to CloudTrail -The `InvokeEndpoint` and `InvokeEndpointAsync` API calls don't log the request parameters. +The `InvokeEndpoint`, `InvokeEndpointAsync`, `Sample`, and `SampleWithResponseStream` API calls don't log the request parameters. @@ -72 +80 @@ You can configure advanced event selectors to filter on the `eventName`, `readOn -The following example shows you how to log data events for an Amazon SageMaker endpoint. In this example, you use the [put-event-selectors](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/put-event-selectors.html) AWS CLI command to add advanced event selectors that capture data events from your endpoint. You should have an existing CloudTrail trail. Before running the command, you can also save the advanced event selectors JSON object in a file like the following: +The following example shows you how to log data events for an Amazon SageMaker endpoint and an Amazon SageMaker job. In this example, you use the [put-event-selectors](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/put-event-selectors.html) AWS CLI command to add advanced event selectors that capture data events from your endpoint. You should have an existing CloudTrail trail. Before running the command, you can also save the advanced event selectors JSON object in a file like the following: @@ -90,0 +99,16 @@ The following example shows you how to log data events for an Amazon SageMaker e + }, + { + "FieldSelectors": [ + { + "Field": "eventCategory", + "Equals": ["Data"] + }, + { + "Field": "resources.ARN", + "Equals": ["arn:aws:sagemaker:us-east-1:111122223333:job/your-job-arn"] + }, + { + "Field": "resources.type", + "Equals": ["AWS::SageMaker::Job"] + } + ] @@ -183,0 +208,129 @@ The following example shows a CloudTrail event that demonstrates the `CreateMode +The following examples show CloudTrail data events for SageMaker AI jobs. Note that `ChatCompletions` calls are transformed into `Sample` and `SampleWithResponseStream` calls in the CloudTrail logs. + +The following example shows a CloudTrail event that demonstrates the `CompleteRollout` operation. + + + { + "eventVersion": "1.11", + "userIdentity": { + "type":"IAMUser", + "principalId":"AIXDAYQEXAMPLEUMLYNGL", + "arn":"arn:aws:iam::123456789012:user/intern", + "accountId":"123456789012", + "accessKeyId":"ASXIAGXEXAMPLEQULKNXV", + "userName":"intern" + }, + "eventTime": "2024-01-15T02:07:50Z", + "eventSource": "sagemaker.amazonaws.com", + "eventName": "CompleteRollout", + "awsRegion": "us-west-2", + "sourceIPAddress":"127.0.0.1", + "userAgent":"USER_AGENT", + "requestParameters": { + "jobArn": "arn:aws:sagemaker:us-west-2:123456789012:job/my-job-name", + "trajectoryId": "my-trajectory-id", + "status": "ready" + }, + "responseElements": null, + "requestID": "d9278f6e-EXAMPLE", + "eventID": "6cbd2cde-EXAMPLE", + "readOnly": false, + "resources": [ + { + "accountId": "123456789012", + "type": "AWS::SageMaker::Job", + "ARN": "arn:aws:sagemaker:us-west-2:123456789012:job/AgentRFT/my-job-name" + } + ], + "eventType": "AwsApiCall", + "managementEvent": false, + "recipientAccountId": "444455556666", + "eventCategory": "Data" + } + +The following example shows a CloudTrail event that demonstrates the `Sample` operation. This event is also logged when `ChatCompletions` is called with a non-streaming response. + + + { + "eventVersion": "1.11", + "userIdentity": { + "type":"IAMUser", + "principalId":"AIXDAYQEXAMPLEUMLYNGL", + "arn":"arn:aws:iam::123456789012:user/intern", + "accountId":"123456789012", + "accessKeyId":"ASXIAGXEXAMPLEQULKNXV", + "userName":"intern" + }, + "eventTime": "2024-01-15T02:07:35Z", + "eventSource": "sagemaker.amazonaws.com", + "eventName": "Sample", + "awsRegion": "us-west-2", + "sourceIPAddress":"127.0.0.1", + "userAgent": "USER_AGENT", + "requestParameters": { + "body": "HIDDEN_DUE_TO_SECURITY_REASONS", + "jobArn": "arn:aws:sagemaker:us-west-2:123456789012:job/AgentRFT/my-job-name", + "trajectoryId": "my-trajectory-id" + }, + "responseElements": { + "body": "HIDDEN_DUE_TO_SECURITY_REASONS" + }, + "requestID": "ab32a279-EXAMPLE", + "eventID": "56cd262e-EXAMPLE", + "readOnly": false, + "resources": [ + { + "accountId": "123456789012", + "type": "AWS::SageMaker::Job", + "ARN": "arn:aws:sagemaker:us-west-2:123456789012:job/AgentRFT/my-job-name" + } + ], + "eventType": "AwsApiCall", + "managementEvent": false, + "recipientAccountId": "444455556666", + "eventCategory": "Data" + } + +The following example shows a CloudTrail event that demonstrates the `SampleWithResponseStream` operation. This event is also logged when `ChatCompletions` is called with a streaming response. + + + { + "eventVersion": "1.11", + "userIdentity": { + "type":"IAMUser", + "principalId":"AIXDAYQEXAMPLEUMLYNGL", + "arn":"arn:aws:iam::123456789012:user/intern", + "accountId":"123456789012", + "accessKeyId":"ASXIAGXEXAMPLEQULKNXV", + "userName":"intern" + }, + "eventTime": "2024-01-15T02:07:47Z", + "eventSource": "sagemaker.amazonaws.com", + "eventName": "SampleWithResponseStream", + "awsRegion": "us-west-2", + "sourceIPAddress":"127.0.0.1", + "userAgent": "USER_AGENT", + "requestParameters": { + "trajectoryId": "my-trajectory-id", + "jobArn": "arn:aws:sagemaker:us-west-2:123456789012:job/AgentRFT/my-job-name", + "body": "HIDDEN_DUE_TO_SECURITY_REASONS" + }, + "responseElements": { + "body": "HIDDEN_DUE_TO_SECURITY_REASONS" + }, + "requestID": "02c72dac-EXAMPLE", + "eventID": "8dcc5ebb-EXAMPLE", + "readOnly": false, + "resources": [ + { + "accountId": "123456789012", + "type": "AWS::SageMaker::Job", + "ARN": "arn:aws:sagemaker:us-west-2:123456789012:job/AgentRFT/my-job-name" + } + ], + "eventType": "AwsApiCall", + "managementEvent": false, + "recipientAccountId": "444455556666", + "eventCategory": "Data" + } +