Gunakan kontrol akses berbasis atribut (ABAC) untuk pelatihan multi-tenancy

Aktifkan rantai tag sesi untuk ABAC

1. Impor boto3 dan SageMaker Python SDK. Isolasi pekerjaan pelatihan berkemampuan ABAC hanya tersedia di SDK AI Python versi 2.217 atau yang lebih baru. SageMaker

   import boto3
   import sagemaker
   
   from sagemaker.estimator import Estimator
   from sagemaker.inputs import TrainingInput

2. Siapkan klien AWS STS dan SageMaker AI untuk menggunakan tag sesi berlabel penyewa. Anda dapat mengubah nilai tag untuk menentukan penyewa yang berbeda.

   # Start an AWS STS client
   sts_client = boto3.client('sts')
   
   # Define your tenants using tags
   # The session tag key must match the principal tag key in your execution role policy
   tags = []
   tag = {}
   tag['Key'] = "tenant-id"
   tag['Value'] = "example-tenant"
   tags.append(tag)
   
   # Have AWS STS assume your ABAC-enabled job creation role
   response = sts_client.assume_role(
       RoleArn="arn:aws:iam::<account-id>:role/<your-training-job-creation-role>",
       RoleSessionName="SessionName",
       Tags=tags)
   credentials = response['Credentials']
   
   # Create a client with your job creation role (which was assumed with tags)
   sagemaker_client = boto3.client(
       'sagemaker',
       aws_access_key_id=credentials['AccessKeyId'],
       aws_secret_access_key=credentials['SecretAccessKey'],
       aws_session_token=credentials['SessionToken']
   )
   sagemaker_session = sagemaker.Session(sagemaker_client=sagemaker_client)

   Saat menambahkan tag "tenant-id=example-tenant" ke peran penciptaan pekerjaan, tag ini diekstraksi oleh peran eksekusi untuk menggunakan kebijakan berikut:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject"
               ],
               "Resource": [
                   "arn:aws:s3:::<your-input-s3-bucket>/example-tenant/*"
               ],
               "Effect": "Allow"
           },
               "Action": [
                   "s3:PutObject"
               ],
               "Resource": "arn:aws:s3:::<your-output-s3-bucket>/example-tenant/*"
           },
           {
               "Action": "s3:ListBucket",
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }

3. Tentukan estimator untuk membuat pekerjaan pelatihan menggunakan SageMaker Python SDK. Atur enable_session_tag_chaining True agar peran eksekusi pelatihan SageMaker AI Anda dapat mengambil tag dari peran penciptaan pekerjaan Anda.

   # Specify your training input
   trainingInput = TrainingInput(
       s3_data='s3://<your-input-bucket>/example-tenant',
       distribution='ShardedByS3Key',
       s3_data_type='S3Prefix'
   )
   
   # Specify your training job execution role 
   execution_role_arn = "arn:aws:iam::<account-id>:role/<your-training-job-execution-role>"
   
   # Define your esimator with session tag chaining enabled
   estimator = Estimator(
       image_uri="<your-training-image-uri>",
       role=execution_role_arn,
       instance_count=1,
       instance_type='ml.m4.xlarge',
       volume_size=20,
       max_run=3600,
       sagemaker_session=sagemaker_session,
       output_path="s3://<your-output-bucket>/example-tenant",
       enable_session_tag_chaining=True
   )
   
   estimator.fit(inputs=trainingInput, job_name="abac-demo")