AWS cli medium security documentation change
Summary
Added '--included-data' parameter to enable metadata-only retrieval of model packages without requiring KMS decrypt permissions for embedded model cards.
Security assessment
This change directly addresses security by providing an option to bypass KMS decryption requirements through data sanitization. It specifies exact fields preserved in metadata-only mode to minimize sensitive data exposure, with explicit documentation of permission implications. The evidence is the detailed explanation of field redaction and permission requirements.
Diff
diff --git a/cli/latest/reference/sagemaker/describe-model-package.md b/cli/latest/reference/sagemaker/describe-model-package.md index 8c9e2deec..9485ede2b 100644 --- a//cli/latest/reference/sagemaker/describe-model-package.md +++ b//cli/latest/reference/sagemaker/describe-model-package.md @@ -15 +15 @@ - * [AWS CLI 2.34.61 Command Reference](../../index.html) » + * [AWS CLI 2.34.63 Command Reference](../../index.html) » @@ -63 +63 @@ Returns a description of the specified model package, which is used to create Sa -If you provided a KMS Key ID when you created your model package, you will see the [KMS Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html) API call in your CloudTrail logs when you use this API. +If you provided a KMS Key ID when you created your model package, you will see the [KMS Decrypt](https://docs.aws.amazon.com/kms/latest/APIReference/API_Decrypt.html) API call in your CloudTrail logs when you use this API. To call this operation without requiring `kms:Decrypt` permission on the customer-managed key, set `IncludedData` to `MetadataOnly` ; the response is returned with the embedded `ModelCard.ModelCardContent` field sanitized. @@ -73,0 +74 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/sagema + [--included-data <value>] @@ -112,0 +114,18 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/sagema +`--included-data` (string) + +> Specifies the level of model package data to include in the response. Use this parameter to call `DescribeModelPackage` on a model package that has an associated model card without requiring `kms:Decrypt` permission on the customer-managed KMS key associated with the embedded model card. +> +> * `AllData` : Returns the full model package response, including the unredacted `ModelCard.ModelCardContent` . This option requires `kms:Decrypt` permission on the customer-managed key, if one is associated with the embedded model card. This is the default. +> * `MetadataOnly` : Returns the full model package response, but with the embedded `ModelCard.ModelCardContent` sanitized to include only a small set of unencrypted metadata fields. This option does not require `kms:Decrypt` permission. All other top-level response fields, including `InferenceSpecification` , `ModelMetrics` , `DriftCheckBaselines` , and `SecurityConfig` , are returned unchanged. For the list of fields preserved within `ModelCardContent` , see [ModelCard](https://docs.aws.amazon.com/sagemaker/latest/APIReference/API_DescribeModelPackage.html#sagemaker-DescribeModelPackage-response-ModelCard) . +> + +> +> If you don’t specify a value, SageMaker returns `AllData` . +> +> Possible values: +> +> * `AllData` +> * `MetadataOnly` +> + + @@ -3848,0 +3868,12 @@ ModelCard -> (structure) +> When you set `IncludedData` to `MetadataOnly` in the request, `ModelCardStatus` is preserved and `ModelCardContent` is sanitized to include only the following JSON paths, when present in the model card: +> +> * `model_overview.model_id` +> * `model_overview.model_name` +> * `intended_uses.risk_rating` +> * `model_package_details.model_package_group_name` +> * `model_package_details.model_package_arn` +> + +> +> Because the `ModelPackageModelCard` schema does not include `model_package_details` and limits `model_overview` to `model_creator` and `model_artifact` , the sanitized `ModelCardContent` for a model package typically contains only `intended_uses.risk_rating` if it was provided when the model card was created. To retrieve the complete `ModelCardContent` , set `IncludedData` to `AllData` or omit the parameter. +> @@ -3941 +3972 @@ ManagedStorageType -> (string) - * [AWS CLI 2.34.61 Command Reference](../../index.html) » + * [AWS CLI 2.34.63 Command Reference](../../index.html) »