MLSEC-03: Ensure least privilege access
Protect all resources across various phases of the ML lifecycle using the principle of least privilege. These resources include: data, algorithms, code, hyperparameters, trained model artifacts, and infrastructure. Provide dedicated network environments with dedicated resources and services to operate any individual project.
Implementation plan
-
Restrict access based on business roles for individuals - Identify roles that need to explore data to build models, features, and algorithms. Map those roles to access patterns using role-based authentication. This approach helps you achieve least privilege access to sensitive data, assets, and services on a project-by-project basis.
-
Use account separation and AWS Organizations - Establish tagging and role-based access grants. Understand workflows of the different user types. Use Service Catalog
to create pre-provisioned environments for quick deployment including a multi-account architecture that segregates workloads between development, test, and production with appropriate governance based on data sensitivity and compliance requirements. Tag data and buckets that contain sensitive workloads. Use these tags to grant granular access to individuals. -
Break out ML workloads by access pattern and structure organizational units - Delegate specific access to each group, such as administrators or data analysts, as required. Use guardrails and service control policies (SCPs) to enforce best practices for each access type and group. Limit infrastructure access to administrators. Verify all sensitive data is accessed through restricted, dedicated, and isolated environments.
Documents
Blogs
Videos
Examples
