AWS sagemaker: Refine Ray endpoint operator security guidance wording
Summary
Renames 'Revoking sessions' to 'Revoking Ray dashboard sessions', updates the example IAM principal ARN account ID, and clarifies the remote job submission link text.
Security assessment
Edits to an existing security best-practices page (KMS signing, presigned URLs, session revocation, RBAC identity handling); improves clarity but does not fix a specific vulnerability.
Evidence
+## Revoking Ray dashboard sessions
Diff
diff --git a/sagemaker/latest/dg/sagemaker-hyperpod-ray-endpoint-operator-security.md b/sagemaker/latest/dg/sagemaker-hyperpod-ray-endpoint-operator-security.md index 1274819..b5c4574 100644 --- a//sagemaker/latest/dg/sagemaker-hyperpod-ray-endpoint-operator-security.md +++ b//sagemaker/latest/dg/sagemaker-hyperpod-ray-endpoint-operator-security.md @@ -7 +7 @@ -Configure KMS signingDo not share presigned URLsDo not store secrets in Ray job environment variablesUse sagemaker_ray:// for programmatic job submissionRestrict in-cluster access to Ray dashboardsUse unique session names for shared execution rolesRevoking sessionsAudit dashboard accessKeep the Helm chart updated +Configure KMS signingDo not share presigned URLsDo not store secrets in Ray job environment variablesUse sagemaker_ray:// for programmatic job submissionRestrict in-cluster access to Ray dashboardsUse unique session names for shared execution rolesRevoking Ray dashboard sessionsAudit dashboard accessKeep the Helm chart updated @@ -29 +29 @@ Environment variables and entrypoint scripts are visible through the Ray dashboa -The `sagemaker_ray://` address scheme handles authentication without exposing a URL in terminal output or logs. The [toolkit-for-ray-on-sagemaker-ai](https://pypi.org/project/toolkit-for-ray-on-sagemaker-ai/) Python library on the PyPI website registers this scheme, so Ray's standard Jobs CLI and Python SDK authenticate through the cluster's secured endpoint. The library is preinstalled in SageMaker AI Distribution images. For more information, see [Submitting jobs remotely with the toolkit library](./sagemaker-hyperpod-ray-remote-job-submission.html). +The `sagemaker_ray://` address scheme handles authentication without exposing a URL in terminal output or logs. The [toolkit-for-ray-on-sagemaker-ai](https://pypi.org/project/toolkit-for-ray-on-sagemaker-ai/) Python library on the PyPI website registers this scheme, so Ray's standard Jobs CLI and Python SDK authenticate through the cluster's secured endpoint. The library is preinstalled in SageMaker AI Distribution images. For more information, see [Submitting Ray jobs remotely with the toolkit library](./sagemaker-hyperpod-ray-remote-job-submission.html). @@ -59 +59 @@ For more information about Kubernetes RBAC, see [Identity and access management] -The HyperPod Ray Endpoint Operator identifies users by their full IAM principal ARN, which includes the role session name (for example, `arn:aws:sts::123456789012:assumed-role/DataScientist/alice`). If multiple users assume the same IAM role with the same session name, the operator cannot distinguish between them and treats them as the same identity. +The HyperPod Ray Endpoint Operator identifies users by their full IAM principal ARN, which includes the role session name (for example, `arn:aws:sts::111122223333:assumed-role/DataScientist/alice`). If multiple users assume the same IAM role with the same session name, the operator cannot distinguish between them and treats them as the same identity. @@ -63 +63 @@ To enable per-user access control when users share an execution role, configure -## Revoking sessions +## Revoking Ray dashboard sessions