AWS sagemaker medium security documentation change
Summary
Added new DataPlane operations (ListRecords, BatchWriteRecord, BatchGetRecord) and detailed their required IAM permissions including KMS:Decrypt
Security assessment
Explicitly documents required IAM permissions for new APIs (ListRecords/BatchWriteRecord/BatchGetRecord) and clarifies KMS:Decrypt requirement for all DataPlane operations. Highlights that BatchWriteRecord requires both BatchWriteRecord and PutRecord permissions, preventing unintended access denials.
Diff
diff --git a/sagemaker/latest/dg/feature-store-security.md b/sagemaker/latest/dg/feature-store-security.md index c188ba689..3c5179b41 100644 --- a//sagemaker/latest/dg/feature-store-security.md +++ b//sagemaker/latest/dg/feature-store-security.md @@ -11 +11 @@ Using AWS KMS permissions for Amazon SageMaker Feature StoreAuthorizing use of a -Amazon SageMaker Feature Store enables you to create two types of stores: an online store or offline store. The online store is used for low latency real-time inference use cases whereas the offline store is used for training and batch inference use cases. When you create a feature group for online or offline use you can provide a AWS Key Management Service customer managed key to encrypt all your data at rest. In case you do not provide a AWS KMS key then we ensure that your data is encrypted on the server side using an AWS owned AWS KMS key or AWS managed AWS KMS key. While creating a feature group, you can select storage type and optionally provide a AWS KMS key for encrypting data, then you can call various APIs for data management such as `PutRecord`, `GetRecord`, `DeleteRecord`. +Amazon SageMaker Feature Store enables you to create two types of stores: an online store or offline store. The online store is used for low latency real-time inference use cases whereas the offline store is used for training and batch inference use cases. When you create a feature group for online or offline use you can provide a AWS Key Management Service customer managed key to encrypt all your data at rest. In case you do not provide a AWS KMS key then we ensure that your data is encrypted on the server side using an AWS owned AWS KMS key or AWS managed AWS KMS key. While creating a feature group, you can select storage type and optionally provide a AWS KMS key for encrypting data, then you can call various APIs for data management such as `PutRecord`, `GetRecord`, `DeleteRecord`, `ListRecords`, and `BatchWriteRecord`. @@ -143 +143 @@ If you use a [customer managed key](https://docs.aws.amazon.com/kms/latest/devel -The **caller (either user or role)** to **ALL DataPlane operations (Put, Get, DeleteRecord)** must have below permissions on the customer managed key: +The **caller (either user or role)** to DataPlane operations must have the corresponding IAM action permissions on the target feature group resource. In addition, all DataPlane operations require `kms:Decrypt` on the customer managed key. @@ -144,0 +145 @@ The **caller (either user or role)** to **ALL DataPlane operations (Put, Get, De + * **PutRecord** – Requires `sagemaker:PutRecord` @@ -146 +147,16 @@ The **caller (either user or role)** to **ALL DataPlane operations (Put, Get, De - "kms:Decrypt" + * **GetRecord** – Requires `sagemaker:GetRecord` + + * **DeleteRecord** – Requires `sagemaker:DeleteRecord` + + * **ListRecords** – Requires `sagemaker:ListRecords` + + * **BatchWriteRecord** – Requires `sagemaker:BatchWriteRecord` and `sagemaker:PutRecord` + + * **BatchGetRecord** – Requires `sagemaker:BatchGetRecord` + + + + +###### Note + +The `BatchWriteRecord` API requires the caller to have both `sagemaker:BatchWriteRecord` and `sagemaker:PutRecord` permissions on the target feature group. An explicit Deny on either action blocks the request.