Gunakan kontrol akses berbasis atribut (ABAC) untuk pelatihan multi-tenancy

Aktifkan rantai tag sesi untuk ABAC

1. Imp boto3 or dan SageMaker Python SDK. ABAC-enabled isolasi pekerjaan pelatihan hanya tersedia di versi 2.217 atau yang lebih baru dari SageMaker AI Python SDK.

   import boto3
   
   from sagemaker.train import ModelTrainer
   from sagemaker.train.configs import InputData, CheckpointConfig
   from sagemaker.core.helper.session_helper import Session
   from sagemaker.core.shapes import OutputDataConfig
   from sagemaker.train.configs import Compute

2. Siapkan klien AWS STS dan SageMaker AI untuk menggunakan tag sesi berlabel penyewa. Anda dapat mengubah nilai tag untuk menentukan penyewa yang berbeda.

   # Start an AWS STS client
   sts_client = boto3.client('sts')
   
   # Define your tenants using tags
   # The session tag key must match the principal tag key in your execution role policy
   tags = []
   tag = {}
   tag['Key'] = "tenant-id"
   tag['Value'] = "example-tenant"
   tags.append(tag)
   
   # Have AWS STS assume your ABAC-enabled job creation role
   response = sts_client.assume_role(
       RoleArn="arn:aws:iam::<account-id>:role/<your-training-job-creation-role>",
       RoleSessionName="SessionName",
       Tags=tags)
   credentials = response['Credentials']
   
   # Create a client with your job creation role (which was assumed with tags)
   sagemaker_client = boto3.client(
       'sagemaker',
       aws_access_key_id=credentials['AccessKeyId'],
       aws_secret_access_key=credentials['SecretAccessKey'],
       aws_session_token=credentials['SessionToken']
   )
   sagemaker_session = Session(sagemaker_client=sagemaker_client)

   Saat menambahkan tag "tenant-id=example-tenant" ke peran penciptaan pekerjaan, tag ini diekstraksi oleh peran eksekusi untuk menggunakan kebijakan berikut:

   JSON

   {
       "Version":"2012-10-17",
       "Statement": [
           {
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject"
               ],
               "Resource": [
                   "arn:aws:s3:::your-input-s3-bucket/example-tenant/*"
               ],
               "Effect": "Allow"
           },
           {
               "Action": [
                   "s3:PutObject"
               ],
               "Resource": "arn:aws:s3:::your-output-s3-bucket/example-tenant/*",
               "Effect": "Allow"
           },
           {
               "Action": "s3:ListBucket",
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }
   

3. Tentukan a ModelTrainer untuk membuat pekerjaan pelatihan menggunakan SageMaker Python SDK. Set enable_session_tag_chaining el True untuk mengizinkan peran eksekusi pelatihan SageMaker AI Anda mengambil tag dari peran penciptaan pekerjaan Anda.

   # Specify your training input
   trainingInput = InputData(
       channel_name='training',
       data_source='s3://<your-input-bucket>/example-tenant'
   )
   
   # Specify your training job execution role 
   execution_role_arn = "arn:aws:iam::<account-id>:role/<your-training-job-execution-role>"
   
   # Define your model trainer with session tag chaining enabled
   model_trainer = ModelTrainer(
       training_image="<your-training-image-uri>",
       role=execution_role_arn,
       compute=Compute(
           instance_type='ml.m4.xlarge',
           instance_count=1,
           volume_size_in_gb=20
       ),
       sagemaker_session=sagemaker_session,
       output_data_config=OutputDataConfig(s3_output_path="s3://<your-output-bucket>/example-tenant"),
       tags=[{"Key": "sagemaker:EnableSessionTagChaining", "Value": "true"}]
   )
   
   model_trainer.train(input_data_config=[trainingInput])