AWS sagemaker medium security documentation change

Service: sagemaker · 2026-06-28 · Security-related medium

File: sagemaker/latest/dg/model-access-training-data-abac.md

Summary

Updated ABAC implementation example: Replaced Estimator with ModelTrainer, modified input/output configuration, and changed tag chaining implementation

Security assessment

The changes update documentation for Attribute-Based Access Control (ABAC) security feature. Specifically shows how to implement session tag chaining ('sagemaker:EnableSessionTagChaining') which propagates IAM tags for fine-grained access control to training data and model artifacts.

Diff

diff --git a/sagemaker/latest/dg/model-access-training-data-abac.md b/sagemaker/latest/dg/model-access-training-data-abac.md
index 20957b8d6..bcd0a2f82 100644
--- a//sagemaker/latest/dg/model-access-training-data-abac.md
+++ b//sagemaker/latest/dg/model-access-training-data-abac.md
@@ -78 +77,0 @@ In addition to multi-tenancy data storage, you can also use the ABAC workflow to
-    import sagemaker
@@ -80,2 +79,5 @@ In addition to multi-tenancy data storage, you can also use the ABAC workflow to
-    from sagemaker.estimator import Estimator
-    from sagemaker.inputs import TrainingInput
+    from sagemaker.train import ModelTrainer
+    from sagemaker.train.configs import InputData, CheckpointConfig
+    from sagemaker.core.helper.session_helper import Session
+    from sagemaker.core.shapes import OutputDataConfig
+    from sagemaker.train.configs import Compute
@@ -110 +112 @@ In addition to multi-tenancy data storage, you can also use the ABAC workflow to
-    sagemaker_session = sagemaker.Session(sagemaker_client=sagemaker_client)
+    sagemaker_session = Session(sagemaker_client=sagemaker_client)
@@ -149 +151 @@ JSON
-  3. Define an estimator to create a training job using the SageMaker Python SDK. Set `enable_session_tag_chaining` to `True` to allow your SageMaker AI training execution role to retrieve the tags from your job creation role.
+  3. Define a ModelTrainer to create a training job using the SageMaker Python SDK. Set `enable_session_tag_chaining` to `True` to allow your SageMaker AI training execution role to retrieve the tags from your job creation role.
@@ -152,4 +154,3 @@ JSON
-    trainingInput = TrainingInput(
-        s3_data='s3://<your-input-bucket>/example-tenant',
-        distribution='ShardedByS3Key',
-        s3_data_type='S3Prefix'
+    trainingInput = InputData(
+        channel_name='training',
+        data_source='s3://<your-input-bucket>/example-tenant'
@@ -161,3 +162,3 @@ JSON
-    # Define your esimator with session tag chaining enabled
-    estimator = Estimator(
-        image_uri="<your-training-image-uri>",
+    # Define your model trainer with session tag chaining enabled
+    model_trainer = ModelTrainer(
+        training_image="<your-training-image-uri>",
@@ -165 +166 @@ JSON
-        instance_count=1,
+        compute=Compute(
@@ -167,2 +168,3 @@ JSON
-        volume_size=20,
-        max_run=3600,
+            instance_count=1,
+            volume_size_in_gb=20
+        ),
@@ -170,2 +172,2 @@ JSON
-        output_path="s3://<your-output-bucket>/example-tenant",
-        enable_session_tag_chaining=True
+        output_data_config=OutputDataConfig(s3_output_path="s3://<your-output-bucket>/example-tenant"),
+        tags=[{"Key": "sagemaker:EnableSessionTagChaining", "Value": "true"}]
@@ -174 +176 @@ JSON
-    estimator.fit(inputs=trainingInput, job_name="abac-demo")
+    model_trainer.train(input_data_config=[trainingInput])