Enabling Trusted Identity Propagation in Amazon SageMaker Studio: A Comprehensive Guide

Introduction to Trusted Identity Propagation

Solution Overview

Prerequisites

Creating or Updating the SageMaker Execution Role

Creating a SageMaker AI Domain with Trusted Identity Propagation Enabled

Updating an Existing SageMaker AI Domain

(Optional) Updating User Background Session Configuration in IAM Identity Center

Use Cases

Scenario 1: Experimenting with Amazon S3 Data in Notebooks

Scenario 2: Accessing Lake Formation Through Athena

Scenario 3: Creating a Training Job Supported with User Background Sessions

Scenario 4: Auditing Using CloudTrail

Clean Up

Conclusion

About the Authors

Enhancing Security and Access Control in AWS with Trusted Identity Propagation

In today’s cloud-centric world, security and efficient access management are paramount, especially for enterprises handling sensitive data in machine learning workflows. Amazon Web Services (AWS) has introduced a powerful feature known as trusted identity propagation, which allows for seamless, secure, and fine-grained identity management across service boundaries. In this post, we’ll explore trusted identity propagation, particularly in the context of Amazon SageMaker Studio, and demonstrate its advantages through practical use cases.

What is Trusted Identity Propagation?

Trusted identity propagation is a feature that allows AWS services to propagate a user’s identity securely across service boundaries. This means that access controls are based on the actual user’s identity rather than just relying on IAM roles. By implementing this feature, organizations can achieve:

• Fine-Grained Access Control: Tailor access permissions based on individual user identities.
• Enhanced Security Audits: Maintain detailed logs of user actions across supported AWS services.
• Long-Running Training Jobs: Successfully run training jobs without being logged in, ensuring continuous background processing and management.

For organizations looking to enhance their machine learning systems, integrating trusted identity propagation with SageMaker Studio simplifies access management while bolstering security.

Enabling Trusted Identity Propagation in SageMaker Studio

To enable and use trusted identity propagation in SageMaker Studio, follow these steps:

Solution Overview

Begin by understanding the architecture required. The user’s identity propagates from their identity provider through IAM Identity Center to downstream services such as Amazon EMR and Amazon Athena. This architecture allows access to data across supported AWS services, leveraging the user’s identity and group memberships.

Prerequisites

Before diving in, ensure you have:

• An active AWS account with IAM Identity Center set up through AWS Organizations.
• Administrator permissions for modifying IAM roles and SageMaker settings.

Create or Update the SageMaker Execution Role

1. Create or Update the Execution Role: Modify the trust policy to allow sts:SetContext in addition to sts:AssumeRole permissions. This step is crucial for enabling trusted identity propagation.

2. Trust Policy Example:

   {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": ["sagemaker.amazonaws.com"]
        },
        "Action": ["sts:AssumeRole", "sts:SetContext"],
        "Condition": {
          "aws:SourceAccount": ""
        }
      }
    ]
   }

Create and Configure a SageMaker Domain

You can either create a new SageMaker domain with trusted identity propagation or update an existing one. During setup, ensure to select the option for enabling trusted identity propagation, allowing users’ identities to flow through the system.

Optional: Update User Background Session Configuration

With IAM Identity Center now supporting user background sessions, you can enhance the user experience by allowing training jobs to run in the background even if the user logs out. The maximum session duration can be set up to 90 days, ensuring continuity for long-running tasks.

Real-World Use Cases

Let’s take a closer look at how trusted identity propagation can be leveraged in practical scenarios:

Scenario 1: Experiment with Amazon S3 Data in Notebooks

S3 Access Grants enable data access management at scale. By defining access based on familiar patterns, organizations can significantly reduce the operational overhead associated with maintaining intricate IAM policies. Once S3 Access Grants are configured, users can seamlessly access required data based on their identities.

Scenario 2: Access Lake Formation through Athena

Integrating Lake Formation, which provides centralized governance, allows for fine-grained access control to data stored in Amazon S3. With trusted identity propagation, users can conduct queries and access protected resources without onerous permissions management, thereby promoting precise data governance.

Scenario 3: Create a Training Job with User Background Sessions

Training jobs initiated from SageMaker Studio can run without user interaction. This capability allows data scientists to set up training jobs and carry on with their day-to-day tasks while their jobs execute in the background. Updates to the session settings ensure that the jobs can continue running as needed.

Scenario 4: Auditing with CloudTrail

With trusted identity propagation enabled, organizations can leverage AWS CloudTrail to track specific user actions in their workflows. This capability enhances security by enabling the auditing of user activity, allowing administrators to maintain accountability across operations.

Conclusion

Incorporating trusted identity propagation in your AWS environment, particularly within SageMaker Studio, empowers organizations to manage user access more effectively while ensuring security and auditability.

This powerful feature not only simplifies permissions management but also maintains robust security across all data services in AWS.

For further information on enabling this feature and exploring its many use cases, please consult AWS documentation on trusted identity propagation.

About the Authors

• Amit Shyam Jaisinghani – Software Engineer at Amazon Web Services, specializing in SageMaker Studio since 2019.
• Durga Sury – Senior Solutions Architect at Amazon SageMaker, focusing on secure and scalable AI/ML systems.
• Khushboo Srivastava – Senior Product Manager for Amazon SageMaker, dedicated to simplifying machine learning workflows.
• Krishnan Manivannan – Senior Software Engineer at AWS, with extensive experience in identity and access management.

With AWS constantly evolving, we encourage you to dive deeper into the documentation and leverage trusted identity propagation to enhance your solutions!