AWS cli medium security documentation change
Summary
Added new '--included-data' parameter to control data retrieval permissions, with options for full content or metadata-only access to avoid requiring KMS decrypt permissions.
Security assessment
The change explicitly addresses security by introducing granular control over KMS decryption permissions. It adds warnings and configuration options to prevent unnecessary decryption operations, reducing attack surface by limiting sensitive data exposure. The specific evidence is the addition of permission requirements documentation and sanitization of content fields.
Diff
diff --git a/cli/latest/reference/sagemaker/describe-model-card.md b/cli/latest/reference/sagemaker/describe-model-card.md index b28623af8..e95f5a695 100644 --- a//cli/latest/reference/sagemaker/describe-model-card.md +++ b//cli/latest/reference/sagemaker/describe-model-card.md @@ -15 +15 @@ - * [AWS CLI 2.34.61 Command Reference](../../index.html) » + * [AWS CLI 2.34.63 Command Reference](../../index.html) » @@ -60,0 +61,4 @@ Describes the content, creation time, and security configuration of an Amazon Sa +### Warning + +To retrieve only metadata about a model card without requiring `kms:Decrypt` permission on the associated customer-managed Amazon Web Services KMS key, set `IncludedData` to `MetadataOnly` . The default is `AllData` , which returns the full model card `Content` and requires `kms:Decrypt` permission when a customer-managed key is configured. + @@ -68,0 +73 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/sagema + [--included-data <value>] @@ -109,0 +115,18 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/sagema +`--included-data` (string) + +> Specifies the level of model card data to include in the response. Use this parameter to call `DescribeModelCard` without requiring `kms:Decrypt` permission on the customer-managed Amazon Web Services KMS key. +> +> * `AllData` : Returns the full model card `Content` . This option requires `kms:Decrypt` permission on the customer-managed key, if one is associated with the model card. This is the default. +> * `MetadataOnly` : Returns the model card with sanitized `Content` that includes only a small set of unencrypted metadata fields. This option does not require `kms:Decrypt` permission. For the list of fields preserved in the response, see `Content` . +> + +> +> If you don’t specify a value, SageMaker returns `AllData` . +> +> Possible values: +> +> * `AllData` +> * `MetadataOnly` +> + + @@ -253 +276,13 @@ Content -> (string) -> The content of the model card. +> The content of the model card. Content is provided as a string in the [model card JSON schema](https://docs.aws.amazon.com/sagemaker/latest/dg/model-cards.html#model-cards-json-schema) . +> +> When you set `IncludedData` to `MetadataOnly` in the request, SageMaker returns a sanitized version of `Content` that includes only the following JSON paths, when present in the model card: +> +> * `model_overview.model_id` +> * `model_overview.model_name` +> * `intended_uses.risk_rating` +> * `model_package_details.model_package_group_name` +> * `model_package_details.model_package_arn` +> + +> +> All other fields are removed from `Content` when `IncludedData` is `MetadataOnly` , including model description, training details, evaluation details, business details, and additional information. To retrieve the complete `Content` , set `IncludedData` to `AllData` or omit the parameter. @@ -405 +440 @@ ModelCardProcessingStatus -> (string) - * [AWS CLI 2.34.61 Command Reference](../../index.html) » + * [AWS CLI 2.34.63 Command Reference](../../index.html) »