Security and access control

Amazon SageMaker Feature Store enables you to create two types of stores: an online store or offline store. The online store is used for low latency real-time inference use cases whereas the offline store is used for training and batch inference use cases. When you create a feature group for online or offline use you can provide a AWS Key Management Service customer managed key to encrypt all your data at rest. In case you do not provide a AWS KMS key then we ensure that your data is encrypted on the server side using an AWS owned AWS KMS key or AWS managed AWS KMS key. While creating a feature group, you can select storage type and optionally provide a AWS KMS key for encrypting data, then you can call various APIs for data management such as PutRecord, GetRecord, DeleteRecord.

Feature Store allows you to grant or deny access to individuals at the feature group-level and enables cross-account access to Feature Store. For example, you can set up developer accounts to access the offline store for model training and exploration that do not have write access to production accounts. You can set up production accounts to access both online and offline stores. Feature Store uses unique customer AWS KMS keys for offline and online store data at-rest encryption. Access control is enabled through both API and AWS KMS key access. You can also create feature group-level access control.

For more information about customer managed key, see customer managed keys. For more information about AWS KMS, see AWS KMS.

Using AWS KMS permissions for Amazon SageMaker Feature Store

Encryption at rest protects Feature Store under an AWS KMS customer managed key. By default, it uses an AWS owned customer managed key for OnlineStore and AWS managed customer managed key for OfflineStore. Feature Store supports an option to encrypt your online or offline store under customer managed key. You can select the customer managed key for Feature Store when you create your online or offline store, and they can be different for each store.

Feature Store supports only symmetric customer managed keys. You cannot use an asymmetric customer managed key to encrypt your data in your online or offline store. For help determining whether a customer managed key is symmetric or asymmetric, see Identifying symmetric and asymmetric customer managed keys.

When you use a customer managed key, you can take advantage of the following features:

You do not pay a monthly fee for AWS owned customer managed keys. Customer managed keys will incur a charge for each API call and AWS Key Management Service quotas apply to each customer managed key.

Authorizing use of a customer managed Key for your online store

If you use a customer managed key to protect your online store, the policies on that customer managed key must give Feature Store permission to use it on your behalf. You have full control over the policies and grants on a customer managed key.

Feature Store does not need additional authorization to use the default AWS owned KMS key to protect your online or offline stores in your AWS account.

Customer managed key policy

When you select a customer managed key to protect your Online Store, Feature Store must have permission to use the customer managed key on behalf of the principal who makes the selection. That principal, a user or role, must have the permissions on the customer managed key that Feature Store requires. You can provide these permissions in a key policy, an IAM policy, or a grant. At a minimum, Feature Store requires the following permissions on a customer managed key:

For example, the following example key policy provides only the required permissions. The policy has the following effects:

Before using an example key policy, replace the example principals with actual principals from your AWS account.

{"Id": "key-policy-feature-store",
   "Version":"2012-10-17",
   "Statement": [
     {"Sid" : "Allow access through Amazon SageMaker AI Feature Store for all principals in the account that are authorized to use  Amazon SageMaker AI Feature Store",
       "Effect": "Allow",
       "Principal": {"AWS": "arn:aws:iam::111122223333:user/featurestore-user"},
       "Action": [
         "kms:Encrypt",
         "kms:Decrypt",
         "kms:DescribeKey",
         "kms:CreateGrant",
         "kms:RetireGrant",
         "kms:ReEncryptFrom",
         "kms:ReEncryptTo",
         "kms:GenerateDataKey",
         "kms:ListAliases",
         "kms:ListGrants"
       ],
       "Resource": "*",      
       "Condition": {"StringLike": {"kms:ViaService" : "sagemaker.*.amazonaws.com"
          }
       }
     },
     {"Sid":  "Allow administrators to view the customer managed key and revoke grants",
       "Effect": "Allow",
       "Principal": {"AWS": "arn:aws:iam::111122223333:role/featurestore-admin"
        },
       "Action": [
         "kms:Describe*",
         "kms:Get*",
         "kms:List*",
         "kms:RevokeGrant"
       ],
       "Resource": "*"
     },
     {"Sid": "Enable IAM User Permissions",
       "Effect": "Allow",
        "Principal": {"AWS": "arn:aws:iam::123456789:root"
        },
        "Action": "kms:*",
        "Resource": "*"
     }
   ]
 }
 

Using grants to authorize Feature Store

In addition to key policies, Feature Store uses grants to set permissions on the customer managed key. To view the grants on a customer managed key in your account, use the ListGrants operation. Feature Store does not need grants, or any additional permissions, to use the AWS owned customer managed key to protect your online store.

Feature Store uses the grant permissions when it performs background system maintenance and continuous data protection tasks.

Each grant is specific to an online store. If the account includes multiple stores encrypted under the same customer managed key, there will be unique grants per FeatureGroup using the same customer managed key.

The key policy can also allow the account to revoke the grant on the customer managed key. However, if you revoke the grant on an active encrypted online store, Feature Store won't be able to protect and maintain the store.

Monitoring Feature Store interaction with AWS KMS

If you use a customer managed key to protect your online or offline store, you can use AWS CloudTrail logs to track the requests that Feature Store sends to AWS KMS on your behalf.

Accessing data in your online store

The caller (either user or role) to ALL DataPlane operations (Put, Get, DeleteRecord) must have below permissions on the customer managed key:

"kms:Decrypt"

Authorizing use of a customer managed key for your offline store

The roleArn that is passed as a parameter to createFeatureGroup must have below permissions to the OfflineStore KmsKeyId:

"kms:GenerateDataKey"