AWS sagemaker medium security documentation change
Summary
Updated code examples to use ModelTrainer instead of Estimator, simplified KMS permissions by removing unnecessary actions like GenerateDataKey, and removed obsolete notebook instance KMS permissions.
Security assessment
Removed excessive KMS permissions (GenerateDataKey, DescribeKey) which reduces attack surface by adhering to least privilege. This addresses potential over-permissioning security risks by only requiring essential kms:Encrypt permission.
Diff
diff --git a/sagemaker/latest/dg/sagemaker-roles.md b/sagemaker/latest/dg/sagemaker-roles.md index 516f9229c..95cb2fc65 100644 --- a//sagemaker/latest/dg/sagemaker-roles.md +++ b//sagemaker/latest/dg/sagemaker-roles.md @@ -74 +74 @@ Once you have created an execution role, you can associate it with a SageMaker A -You can also pass the ARN of an execution role to your API call. For example, using [Amazon SageMaker Python SDK](https://sagemaker.readthedocs.io/en/stable), you can pass the ARN of your execution role to an estimator. In the code sample that follows, we create an estimator using the XGBoost algorithm container and pass the ARN of the execution role as a parameter. For the full example on GitHub, see [Customer Churn Prediction with XGBoost](https://github.com/aws/amazon-sagemaker-examples/blob/89c54681b7e0f83ce137b34b879388cf5960af93/introduction_to_applying_machine_learning/xgboost_customer_churn/xgboost_customer_churn.ipynb). +You can also pass the ARN of an execution role to your API call. For example, using [Amazon SageMaker Python SDK](https://sagemaker.readthedocs.io/en/stable), you can pass the ARN of your execution role to a ModelTrainer. In the code sample that follows, we create a ModelTrainer using the XGBoost algorithm container and pass the ARN of the execution role as a parameter. For the full example on GitHub, see [Customer Churn Prediction with XGBoost](https://github.com/aws/amazon-sagemaker-examples/blob/89c54681b7e0f83ce137b34b879388cf5960af93/introduction_to_applying_machine_learning/xgboost_customer_churn/xgboost_customer_churn.ipynb). @@ -77,2 +77,6 @@ You can also pass the ARN of an execution role to your API call. For example, us - import sagemaker, boto3 - from sagemaker import image_uris + import boto3 + from sagemaker.core import image_uris + from sagemaker.core.helper.session_helper import Session + from sagemaker.core.shapes import OutputDataConfig + from sagemaker.train import ModelTrainer + from sagemaker.train.configs import Compute @@ -80 +84 @@ You can also pass the ARN of an execution role to your API call. For example, us - sess = sagemaker.Session() + sess = Session() @@ -84 +88 @@ You can also pass the ARN of an execution role to your API call. For example, us - container = sagemaker.image_uris.retrieve("xgboost", region, "1.7-1") + container = image_uris.retrieve("xgboost", region, "1.7-1") @@ -86,3 +90,4 @@ You can also pass the ARN of an execution role to your API call. For example, us - xgb = sagemaker.estimator.Estimator( - container, - execution-role-ARN, + xgb = ModelTrainer( + training_image=container, + role=execution-role-ARN, + compute=Compute( @@ -91 +96,2 @@ You can also pass the ARN of an execution role to your API call. For example, us - output_path="s3://{}/{}/output".format(bucket, prefix), + ), + output_data_config=OutputDataConfig(s3_output_path="s3://{}/{}/output".format(bucket, prefix)), @@ -225 +231,12 @@ The following code is meant to be run in a SageMaker AI environment, like any of -The following [`get_execution_role`](https://sagemaker.readthedocs.io/en/stable/api/utility/session.html#sagemaker.session.get_execution_role) [Amazon SageMaker Python SDK](https://sagemaker.readthedocs.io/en/stable) command retrieves the ARN of the execution role attached to the space. +The following [`get_execution_role`](https://sagemaker.readthedocs.io/en/stable/api/sagemaker_core.html) [Amazon SageMaker Python SDK](https://sagemaker.readthedocs.io/en/stable) command retrieves the ARN of the execution role attached to the space. + +SageMaker Python SDK v3 + + + + from sagemaker.core.helper.session_helper import get_execution_role + role = get_execution_role() + print(role) + +SageMaker Python SDK v2 (Legacy) + @@ -570,2 +587 @@ If you specify a KMS key in the output configuration of your AutoML job, add the - "kms:Encrypt", - "kms:GenerateDataKey" + "kms:Encrypt" @@ -864,15 +879,0 @@ The `cloudwatch` and `logs` actions are applicable for "*" resources. For more i -If you specify an AWS KMS key to encrypt the storage volume of the notebook instance, add the following permissions to the execution role: - - - { - "Effect": "Allow", - "Action": [ - "kms:CreateGrant", - "kms:DescribeKey", - "kms:Decrypt", - "kms:GenerateDataKey", - "kms:GenerateDataKeyWithoutPlaintext" - ], - "Resource": "arn:aws:kms:us-east-1:111122223333:key/kms-key-id" - } - @@ -1189 +1190 @@ If you specify a KMS key in the output configuration of your processing job, add - "kms:GenerateDataKey" + "kms:Encrypt" @@ -1199,2 +1200 @@ If you specify a volume KMS key in the resource configuration of your processing - "kms:CreateGrant", - "kms:DescribeKey" + "kms:CreateGrant" @@ -1361 +1361 @@ If you specify a KMS key in the output configuration of your training job, add t - "kms:GenerateDataKey" + "kms:Encrypt" @@ -1371,2 +1371 @@ If you specify a volume KMS key in the resource configuration of your training j - "kms:CreateGrant", - "kms:DescribeKey" + "kms:CreateGrant"