Google patches two Chrome zero-days that were exploited in the wild, after tips from anonymous sources; Google has patched five Chrome zero-days in three weeks — Google has now patched five Chrome zero-days in three weeks. — Google has released today Chrome version 86..4240.198 to patch …
Analysis of Apple's A14 chip shows an increase in single-thread performance of nearly 3x in 5 years, suggesting M1 will be a formidable rival to x86 incumbents — From Mobile to Mac: What to Expect? — To date, our performance comparisons for Apple's chipsets have always been in the context …
Amazon SageMaker is a fully managed service that provides every machine learning (ML) developer and data scientist with the ability to build, train, and deploy ML models quickly. Amazon SageMaker Studio is a web-based, integrated development environment (IDE) for ML that lets you build, train, debug, deploy, and monitor your ML models. Amazon SageMaker Studio provides all the tools you need to take your models from experimentation to production while boosting your productivity. You can write code, track experiments, visualize data, and perform debugging and monitoring within a single, integrated visual interface.
This post outlines how to configure access control for teams or groups within Amazon SageMaker Studio using attribute-based access control (ABAC). ABAC is a powerful approach that you can utilize to configure Studio so that different ML and data science teams have complete isolation of team resources.
We provide guidance on how to configure Amazon SageMaker Studio access for both AWS Identity and Access Management (IAM) and AWS Single Sign-On (AWS SSO) authentication methods. This post helps you set up IAM policies for users and roles using ABAC principals. To demonstrate the configuration, we set up two teams as shown in the following diagram and showcase two use cases:
You can configure policies according to your needs. You can even include a project tag in case you want to further restrict user access by projects within a team. The approach is very flexible and scalable.
Amazon SageMaker Studio supports the following authentication methods for onboarding users. When setting up Studio, you can pick an authentication method that you use for all your users:
The following table describes two different personas that interact with Amazon SageMaker Studio resources and the level of access they need to fulfill their duties. We use this table as a high-level requirement to model IAM roles and policies to establish desired controls based on resource ownership at the team and user level.
| User Personas | Permissions |
| Admin User |
Create, modify, delete any IAM resource. Create Amazon SageMaker Studio user profiles with a tag. Sign in to the Amazon SageMaker console. Read and describe Amazon SageMaker resources. |
| Data Scientists or Developers |
Launch an Amazon SageMaker Studio IDE assigned to a specific IAM or AWS SSO user. Create Amazon SageMaker resources with necessary tags. For this post, we use the team tag. Update, delete, and run resources created with a specific tag. Sign in to the Amazon SageMaker console if an IAM user. Read and describe Amazon SageMaker resources. |
We use the preceding requirements to model roles and permissions required to establish controls. The following flow diagram outlines the different configuration steps:
You should apply the following policy to the admin user who creates Studio user profiles. This policy requires the admin to include the studiouserid tag. You could use a different name for the tag if need be. The Studio console doesn’t allow you to add tags when creating user profiles, so we use the AWS Command Line Interface (AWS CLI).
For admin users managed in IAM, attach the following policy to the user. For admin users managed in an external IdP, add the following policy to the rule that the user assumes upon federation. The following policy enforces the studiouserid tag to be present when the sagemaker:CreateUserProfile action is invoked.
AWS SSO doesn’t require this policy; it performs the identity check.
The following policy limits Studio access to the respective users by requiring the resource tag to match the user name for the sagemaker:CreatePresignedDomainUrl action. When a user tries to access the Amazon SageMaker Studio launch URL, this check is performed.
For IAM users, attach the following policy to the user. Use the user name for the studiouserid tag value.
For AWS account federation, attach the following policy to role that the user assumes after federation:
Add the following statement to this policy in the Trust Relationship section. This statement defines the allowed transitive tag.
For users managed in AWS SSO, this policy is not required. AWS SSO performs the identity check.
To create roles for your teams, you must first create the policies. For simplicity, we use the same policies for both teams. In most cases, you just need one set of policies for all teams, but you have the flexibility to create different policies for different teams. In the second step, you create a role for each team, attach the policies, and tag the roles with appropriate team tags.
Create the following policies. For this post, we split them into three policies for more readability, but you can create them according to your needs.
The following policy gives privileges to List and Describe Amazon SageMaker resources. You can customize this policy according to your needs.
The following policy gives privileges to create, read, update, and delete access to Amazon Simple Storage Service (Amazon S3), Amazon Elastic Container Registry (Amazon ECR), and Amazon CloudWatch, and read access to AWS Key Management Service (AWS KMS). You can customize this policy according to your needs.
The following policy gives privileges to create, update, and delete Amazon SageMaker Studio resources.
It also enforces the team tag requirement during creation. In addition, it enforces start, stop, update, and delete actions on resources restricted only to the respective team members.
The team tag validation condition in the following code makes sure that the team tag value matches the principal’s team. Refer to the bolded code for specifcs.
You can now create a role for each team with these policies. Tag the roles on the IAM console or with the CLI command. The steps are the same for all three authentication types. For example, tag the role for Team A with the tag key= team and value = “<Team Name>”.
In this step, we add the studiouserid tag when creating Studio user profiles. The steps are slightly different for each authentication type.
For IAM users, you create Studio user profiles for each user by including the role that was created for the team the user belongs to. The following code is a sample CLI command. As of this writing, including a tag when creating a user profile is available only through AWS CLI.
For AWS account federation, you create a user attribute (studiouserid) in an external IdP with a unique value for each user. The following code shows how to configure the attribute in Okta:
The following screenshot shows the attributes on the Okta console.
Next, create the user profile using the following command. Use the user attribute value in the preceding step for the studiouserid tag value.
For instructions on assigning users in AWS SSO, see Onboarding Amazon SageMaker Studio with AWS SSO and Okta Universal Directory.
Update the Studio user profile to include the appropriate execution role that was created for the team that the user belongs to. See the following CLI command:
When a user tries to access a Studio profile that doesn’t have studiouserid tag value matching their user name, an AccessDeniedException error occurs. You can test this by copying the link for Launch Studio on the Amazon SageMaker console and accessing it when logged in as a different user. The following screenshot shows the error message.
In this step, we show how to configure Studio so that members of a given team can’t access artifacts that another team creates.
In our use case, a Team A user creates an experiment and tags that experiment with the team tag. This limits access to this experiment to Team A users only. See the following code:
If a user who is not in Team A tries to delete the experiment, Studio denies the delete action. See the following code:
In this post, we demonstrated how to isolate Amazon SageMaker Studio access using the ABAC technique. We showcased two use cases: restricting access to a Studio profile to only the assigned user (using the studiouserid tag) and restricting access to Studio artifacts to team members only. We also showed how to limit access to experiments to only the members of the team using the team tag. You can further customize policies by applying more tags to create more complex hierarchical controls.
Try out this solution for isolating resources by teams or groups in Amazon SageMaker Studio. For more information about using ABAC as an authorization strategy, see What is ABAC for AWS?
Vikrant Kahlir is Senior Solutions Architect in the Solutions Architecture team. He works with AWS strategic customers product and engineering teams to help them with technology solutions using AWS services for Managed Databases, AI/ML, HPC, Autonomous Computing, and IoT.
Rakesh Ramadas is an ISV Solution Architect at Amazon Web Services. His focus areas include AI/ML and Big Data.
Rama Thamman is a Software Development Manager with the AI Platforms team, leading the ML Migrations team.
Amazon SageMaker is a fully managed service that provides every machine learning (ML) developer and data scientist with the ability to build, train, and deploy ML models quickly. Amazon SageMaker Studio is a web-based, integrated development environment (IDE) for ML that lets you build, train, debug, deploy, and monitor your ML models. Amazon SageMaker Studio provides all the tools you need to take your models from experimentation to production while boosting your productivity. You can write code, track experiments, visualize data, and perform debugging and monitoring within a single, integrated visual interface.
This post outlines how to configure access control for teams or groups within Amazon SageMaker Studio using attribute-based access control (ABAC). ABAC is a powerful approach that you can utilize to configure Studio so that different ML and data science teams have complete isolation of team resources.
We provide guidance on how to configure Amazon SageMaker Studio access for both AWS Identity and Access Management (IAM) and AWS Single Sign-On (AWS SSO) authentication methods. This post helps you set up IAM policies for users and roles using ABAC principals. To demonstrate the configuration, we set up two teams as shown in the following diagram and showcase two use cases:
You can configure policies according to your needs. You can even include a project tag in case you want to further restrict user access by projects within a team. The approach is very flexible and scalable.
Amazon SageMaker Studio supports the following authentication methods for onboarding users. When setting up Studio, you can pick an authentication method that you use for all your users:
The following table describes two different personas that interact with Amazon SageMaker Studio resources and the level of access they need to fulfill their duties. We use this table as a high-level requirement to model IAM roles and policies to establish desired controls based on resource ownership at the team and user level.
| User Personas | Permissions |
| Admin User |
Create, modify, delete any IAM resource. Create Amazon SageMaker Studio user profiles with a tag. Sign in to the Amazon SageMaker console. Read and describe Amazon SageMaker resources. |
| Data Scientists or Developers |
Launch an Amazon SageMaker Studio IDE assigned to a specific IAM or AWS SSO user. Create Amazon SageMaker resources with necessary tags. For this post, we use the team tag. Update, delete, and run resources created with a specific tag. Sign in to the Amazon SageMaker console if an IAM user. Read and describe Amazon SageMaker resources. |
We use the preceding requirements to model roles and permissions required to establish controls. The following flow diagram outlines the different configuration steps:
You should apply the following policy to the admin user who creates Studio user profiles. This policy requires the admin to include the studiouserid tag. You could use a different name for the tag if need be. The Studio console doesn’t allow you to add tags when creating user profiles, so we use the AWS Command Line Interface (AWS CLI).
For admin users managed in IAM, attach the following policy to the user. For admin users managed in an external IdP, add the following policy to the rule that the user assumes upon federation. The following policy enforces the studiouserid tag to be present when the sagemaker:CreateUserProfile action is invoked.
AWS SSO doesn’t require this policy; it performs the identity check.
The following policy limits Studio access to the respective users by requiring the resource tag to match the user name for the sagemaker:CreatePresignedDomainUrl action. When a user tries to access the Amazon SageMaker Studio launch URL, this check is performed.
For IAM users, attach the following policy to the user. Use the user name for the studiouserid tag value.
For AWS account federation, attach the following policy to role that the user assumes after federation:
Add the following statement to this policy in the Trust Relationship section. This statement defines the allowed transitive tag.
For users managed in AWS SSO, this policy is not required. AWS SSO performs the identity check.
To create roles for your teams, you must first create the policies. For simplicity, we use the same policies for both teams. In most cases, you just need one set of policies for all teams, but you have the flexibility to create different policies for different teams. In the second step, you create a role for each team, attach the policies, and tag the roles with appropriate team tags.
Create the following policies. For this post, we split them into three policies for more readability, but you can create them according to your needs.
The following policy gives privileges to List and Describe Amazon SageMaker resources. You can customize this policy according to your needs.
The following policy gives privileges to create, read, update, and delete access to Amazon Simple Storage Service (Amazon S3), Amazon Elastic Container Registry (Amazon ECR), and Amazon CloudWatch, and read access to AWS Key Management Service (AWS KMS). You can customize this policy according to your needs.
The following policy gives privileges to create, update, and delete Amazon SageMaker Studio resources.
It also enforces the team tag requirement during creation. In addition, it enforces start, stop, update, and delete actions on resources restricted only to the respective team members.
The team tag validation condition in the following code makes sure that the team tag value matches the principal’s team. Refer to the bolded code for specifcs.
You can now create a role for each team with these policies. Tag the roles on the IAM console or with the CLI command. The steps are the same for all three authentication types. For example, tag the role for Team A with the tag key= team and value = “<Team Name>”.
In this step, we add the studiouserid tag when creating Studio user profiles. The steps are slightly different for each authentication type.
For IAM users, you create Studio user profiles for each user by including the role that was created for the team the user belongs to. The following code is a sample CLI command. As of this writing, including a tag when creating a user profile is available only through AWS CLI.
For AWS account federation, you create a user attribute (studiouserid) in an external IdP with a unique value for each user. The following code shows how to configure the attribute in Okta:
The following screenshot shows the attributes on the Okta console.
Next, create the user profile using the following command. Use the user attribute value in the preceding step for the studiouserid tag value.
For instructions on assigning users in AWS SSO, see Onboarding Amazon SageMaker Studio with AWS SSO and Okta Universal Directory.
Update the Studio user profile to include the appropriate execution role that was created for the team that the user belongs to. See the following CLI command:
When a user tries to access a Studio profile that doesn’t have studiouserid tag value matching their user name, an AccessDeniedException error occurs. You can test this by copying the link for Launch Studio on the Amazon SageMaker console and accessing it when logged in as a different user. The following screenshot shows the error message.
In this step, we show how to configure Studio so that members of a given team can’t access artifacts that another team creates.
In our use case, a Team A user creates an experiment and tags that experiment with the team tag. This limits access to this experiment to Team A users only. See the following code:
If a user who is not in Team A tries to delete the experiment, Studio denies the delete action. See the following code:
In this post, we demonstrated how to isolate Amazon SageMaker Studio access using the ABAC technique. We showcased two use cases: restricting access to a Studio profile to only the assigned user (using the studiouserid tag) and restricting access to Studio artifacts to team members only. We also showed how to limit access to experiments to only the members of the team using the team tag. You can further customize policies by applying more tags to create more complex hierarchical controls.
Try out this solution for isolating resources by teams or groups in Amazon SageMaker Studio. For more information about using ABAC as an authorization strategy, see What is ABAC for AWS?
Vikrant Kahlir is Senior Solutions Architect in the Solutions Architecture team. He works with AWS strategic customers product and engineering teams to help them with technology solutions using AWS services for Managed Databases, AI/ML, HPC, Autonomous Computing, and IoT.
Rakesh Ramadas is an ISV Solution Architect at Amazon Web Services. His focus areas include AI/ML and Big Data.
Rama Thamman is a Software Development Manager with the AI Platforms team, leading the ML Migrations team.
Online mortgage lender Better.com has raised ~$200M Series D led by L Catterton according to an internal memo; sources say the round values the company at $4B — Online mortgage lender Better.com has closed a new funding round led by private equity firm L Catterton, according to an internal memo reviewed by Bloomberg News.
Strategy Analytics: in Q3, Samsung sold more smartphones in the US than Apple for the first time in three years; Samsung had 33.7% marketshare, Apple had 30.2% — Samsung Electronics Co. sold the largest number of smartphones in the United States in the third quarter of the year …
Two US House representatives who oversee the FCC ask Ajit Pai to abandon “controversial items under consideration”, likely referencing changes to Section 230 — Two U.S. Representatives who oversee the FCC have asked the agency to respect the results of the election by abandoning any …
Facebook says political content makes up about 6% of what is seen on its platform and says CrowdTangle measures engagement but doesn't predict reach — Facebook Tuesday said that political content makes up only about 6% of what users actually see on its platform.
Patreon partners with Acast, which will host creators' podcasts to simplify distribution of subscriber-only episodes and give them access to Acast analytics — Private RSS feeds are streamlined — Patreon's newest partnership might entice more podcasters to join its platform.
What to expect from Apple's “One More Thing” event: first Apple Silicon powered Macs, a macOS Big Sur release date, and potentially AirTags, over-ear headphones — It seems likely Apple will reveal the first computers powered by its custom silicon
EU tightens rules on surveillance tech, forcing companies selling spyware, facial recognition, and tech with military uses to get a license, be more transparent — The goal is to make sales of technologies like spyware and facial recognition more transparent in Europe first, and then worldwide.
Facebook removed seven pages, with over 2.45 million followers, tied to Steve Bannon for pushing misinformation about voter fraud and election results — The pages, which pushed the ‘Stop the Steal’ hashtag and other misleading messages, were removed over the weekend while Bannon's account was frozen
Apple Silicon Macs will run iOS apps but some developers, including Facebook, Google, and the developers of Candy Crush and Among Us, have already opted out — Apple will hold another special event tomorrow, and we expect to see the first Mac with Apple Silicon chips.
Facebook and Google have been blocking political ads since Election Day, which Democrats say is hurting fundraising in the lead up to Georgia's upcoming runoffs — The fate of the United States Senate will be determined by two Georgia runoffs scheduled for less than two months from now …
Tim Berners Lee's Inrupt startup releases an enterprise version of the Solid privacy platform, which allows organizations to build privacy-focused apps — Inrupt, the startup from World Wide Web founder Tim Berners-Lee, announced an enterprise version of the Solid privacy platform today …
Indian grocery delivery service Bigbasket confirms it suffered a data breach in which attackers stole user email ids, mobile phone numbers, and full addresses — - Attackers offer to sell data on millions of users on dark web — Cybercrimes on the rise as Covid forces people to shop online
Free speech Twitter alternative Parler becomes top downloaded app as conservatives rally support to leave Twitter and Facebook — Social media platform Parler jumped to the top downloaded app this weekend, as conservatives rally support to leave Facebook and Twitter over censorship.
Apple suspends new business with key supplier Pegatron after discovering violations of labor rules related to a student worker program — - Apple says Pegatron violated rules for student worker program — Company says new business paused until corrective action taken