AWS sagemaker documentation change
Summary
Multiple documentation updates: UI terminology change ('Click' to 'Choose'), standardized IAM policy variable syntax (${VAR} format), corrected placeholder syntax, updated YAML structure, and service account name changes
Security assessment
Changes focus on documentation clarity and consistency. IAM policy syntax updates improve accuracy but don't alter security semantics. Permission verb expansion ('list' to 'get, list') maintains least privilege principles without indicating a security fix. No vulnerabilities or new security features are introduced.
Diff
diff --git a/sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md b/sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md index 0eccdc1c5..a69f0f948 100644 --- a//sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md +++ b//sagemaker/latest/dg/sagemaker-hyperpod-model-deployment-setup.md @@ -51 +51 @@ The SageMaker AI console provides the most streamlined experience with two insta - 5. Click **Install** to begin the automated installation process. + 5. Choose **Install** to begin the automated installation process. @@ -238 +238 @@ If using a custom bucket name that doesn't start with `hyperpod-tls-`, attach th - "Federated": "arn:aws:iam::$ACCOUNT_ID:oidc-provider/oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID" + "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}" @@ -243,2 +243,2 @@ If using a custom bucket name that doesn't start with `hyperpod-tls-`, attach th - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:sub": "system:serviceaccount:hyperpod-inference-system:aws-load-balancer-controller", - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:aud": "sts.amazonaws.com" + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:sub": "system:serviceaccount:hyperpod-inference-system:aws-load-balancer-controller", + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:aud": "sts.amazonaws.com" @@ -315 +315 @@ If using a custom bucket name that doesn't start with `hyperpod-tls-`, attach th - "Federated": "arn:aws:iam::$ACCOUNT_ID:oidc-provider/oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID" + "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}" @@ -320,2 +320,2 @@ If using a custom bucket name that doesn't start with `hyperpod-tls-`, attach th - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:sub": "system:serviceaccount:hyperpod-inference-system:keda-operator", - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:aud": "sts.amazonaws.com" + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:sub": "system:serviceaccount:hyperpod-inference-system:keda-operator", + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:aud": "sts.amazonaws.com" @@ -389 +389 @@ If using a custom bucket name that doesn't start with `hyperpod-tls-`, attach th - "Federated": "arn:aws:iam::$ACCOUNT_ID:oidc-provider/oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID" + "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}" @@ -394,2 +394,2 @@ If using a custom bucket name that doesn't start with `hyperpod-tls-`, attach th - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:sub": "system:serviceaccount:*:hyperpod-inference-service-account*", - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:aud": "sts.amazonaws.com" + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:sub": "system:serviceaccount:*:hyperpod-inference-service-account*", + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:aud": "sts.amazonaws.com" @@ -446 +446 @@ Required for mounting S3 buckets as persistent volumes in inference workloads. - --service-account-role-arn $S3_CSI_ROLE_ARN + --service-account-role-arn <S3_CSI_ROLE_ARN> @@ -911 +911 @@ For Kubernetes administrative access to the Amazon EKS cluster, go to the Amazon - "Federated": "arn:aws:iam::$ACCOUNT_ID:oidc-provider/oidc.eks.$REGION.amazonaws.com/id/${OIDC_ID}" + "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}" @@ -916,2 +916,2 @@ For Kubernetes administrative access to the Amazon EKS cluster, go to the Amazon - "oidc.eks.$REGION.amazonaws.com/id/${OIDC_ID}:aud": "sts.amazonaws.com", - "oidc.eks.$REGION.amazonaws.com/id/${OIDC_ID}:sub": "system:serviceaccount:kube-system:${s3-csi-driver-sa}" + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:aud": "sts.amazonaws.com", + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:sub": "system:serviceaccount:kube-system:${s3-csi-driver-sa}" @@ -1005 +1005 @@ For Kubernetes administrative access to the Amazon EKS cluster, go to the Amazon - "Federated": "arn:aws:iam::$ACCOUNT_ID:oidc-provider/oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID" + "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}" @@ -1010,2 +1010,2 @@ For Kubernetes administrative access to the Amazon EKS cluster, go to the Amazon - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:sub": "system:serviceaccount:kube-system:keda-operator", - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:aud": "sts.amazonaws.com" + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:sub": "system:serviceaccount:kube-system:keda-operator", + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:aud": "sts.amazonaws.com" @@ -1075 +1075 @@ For Kubernetes administrative access to the Amazon EKS cluster, go to the Amazon - "Federated": "arn:aws:iam::$ACCOUNT_ID:oidc-provider/oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID" + "Federated": "arn:aws:iam::${ACCOUNT_ID}:oidc-provider/oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}" @@ -1080,2 +1080,2 @@ For Kubernetes administrative access to the Amazon EKS cluster, go to the Amazon - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:sub": "system:serviceaccount:*:hyperpod-inference-service-account*", - "oidc.eks.$REGION.amazonaws.com/id/$OIDC_ID:aud": "sts.amazonaws.com" + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:sub": "system:serviceaccount:*:hyperpod-inference-service-account*", + "oidc.eks.${REGION}.amazonaws.com/id/${OIDC_ID}:aud": "sts.amazonaws.com" @@ -1164 +1164 @@ Access the helm chart from [https://github.com/aws/sagemaker-hyperpod-cli/tree/m - kubectl annotate serviceaccount hyperpod-inference-operator-controller-manager \ + kubectl annotate serviceaccount hyperpod-inference-controller-manager \ @@ -1188,2 +1187,0 @@ Follow these steps to verify that your inference operator installation is workin - model: - modelId: "huggingface-eqa-bert-base-cased" @@ -1191,0 +1190,2 @@ Follow these steps to verify that your inference operator installation is workin + model: + modelId: "huggingface-eqa-bert-base-cased" @@ -1211 +1211 @@ Follow these steps to verify that your inference operator installation is workin - kubectl describe serviceaccount hyperpod-inference-operator-controller-manager -n hyperpod-inference-system + kubectl describe serviceaccount hyperpod-inference-controller-manager -n hyperpod-inference-system @@ -1242 +1242 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - export EKS_CLUSTER_ARN=$(aws --region $REGION sagemaker describe-cluster --cluster-name $HYPERPOD_CLUSTER_NAME \ + export EKS_CLUSTER_ARN=$(aws --region ${REGION} sagemaker describe-cluster --cluster-name ${HYPERPOD_CLUSTER_NAME} \ @@ -1262 +1262 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - "Resource": "$HYPERPOD_CLUSTER_ARN" + "Resource": "${HYPERPOD_CLUSTER_ARN}" @@ -1273 +1273 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - "Resource": "$EKS_CLUSTER_ARN" + "Resource": "${EKS_CLUSTER_ARN}" @@ -1291 +1291 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - "Resource": "arn:aws:sagemaker:$REGION:$ACCOUNT_ID:endpoint/*" + "Resource": "arn:aws:sagemaker:${REGION}:${ACCOUNT_ID}:endpoint/*" @@ -1297 +1297 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - aws iam put-role-policy --role-name DATASCIENTIST_ROLE_NAME --policy-name HyperPodDeploymentUIAccessInlinePolicy --policy-document file://hyperpod-deployment-ui-access-policy.json + aws iam put-role-policy --role-name ${DATASCIENTIST_ROLE_NAME} --policy-name HyperPodDeploymentUIAccessInlinePolicy --policy-document file://hyperpod-deployment-ui-access-policy.json @@ -1303,2 +1303,2 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - aws eks create-access-entry --cluster-name $EKS_CLUSTER_NAME \ - --principal-arn "arn:aws:iam::$ACCOUNT_ID:role/$DATASCIENTIST_ROLE_NAME" \ + aws eks create-access-entry --cluster-name ${EKS_CLUSTER_NAME} \ + --principal-arn "arn:aws:iam::${ACCOUNT_ID}:role/${DATASCIENTIST_ROLE_NAME}" \ @@ -1326 +1326 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - verbs: ["list"] + verbs: ["get", "list"] @@ -1375 +1375 @@ For more background on setting up SageMaker HyperPod access for Studio Classic u - resources: [ "inferenceendpointconfig", "inferenceendpoint", "jumpstartmodel" ] + resources: [ "inferenceendpointconfig", "inferenceendpoint", "jumpstartmodels" ]