使用基于属性的访问权限控制（ABAC）进行多租户训练

为 ABAC 启用会话标记链

1. 导入boto3和 SageMaker Python 开发工具包。支持 ABAC 的训练作业隔离仅在 AI Python SDK 的 2.217 或更高版本中可用。 SageMaker

   import boto3
   import sagemaker
   
   from sagemaker.estimator import Estimator
   from sagemaker.inputs import TrainingInput

2. 设置 AWS STS 和 SageMaker AI 客户端以使用标有租户标签的会话标签。您可以更改标签值，指定不同的租户。

   # Start an AWS STS client
   sts_client = boto3.client('sts')
   
   # Define your tenants using tags
   # The session tag key must match the principal tag key in your execution role policy
   tags = []
   tag = {}
   tag['Key'] = "tenant-id"
   tag['Value'] = "example-tenant"
   tags.append(tag)
   
   # Have AWS STS assume your ABAC-enabled job creation role
   response = sts_client.assume_role(
       RoleArn="arn:aws:iam::<account-id>:role/<your-training-job-creation-role>",
       RoleSessionName="SessionName",
       Tags=tags)
   credentials = response['Credentials']
   
   # Create a client with your job creation role (which was assumed with tags)
   sagemaker_client = boto3.client(
       'sagemaker',
       aws_access_key_id=credentials['AccessKeyId'],
       aws_secret_access_key=credentials['SecretAccessKey'],
       aws_session_token=credentials['SessionToken']
   )
   sagemaker_session = sagemaker.Session(sagemaker_client=sagemaker_client)

   在向作业创建角色添加标签 "tenant-id=example-tenant" 时，执行角色会提取这些标记，以使用以下策略：

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject"
               ],
               "Resource": [
                   "arn:aws:s3:::<your-input-s3-bucket>/example-tenant/*"
               ],
               "Effect": "Allow"
           },
               "Action": [
                   "s3:PutObject"
               ],
               "Resource": "arn:aws:s3:::<your-output-s3-bucket>/example-tenant/*"
           },
           {
               "Action": "s3:ListBucket",
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }

3. 使用 Pyth SageMaker on SDK 定义一个估计器来创建训练作业。设置为True，enable_session_tag_chaining允许您的 SageMaker AI 训练执行角色从您的任务创建角色中检索标签。

   # Specify your training input
   trainingInput = TrainingInput(
       s3_data='s3://<your-input-bucket>/example-tenant',
       distribution='ShardedByS3Key',
       s3_data_type='S3Prefix'
   )
   
   # Specify your training job execution role 
   execution_role_arn = "arn:aws:iam::<account-id>:role/<your-training-job-execution-role>"
   
   # Define your esimator with session tag chaining enabled
   estimator = Estimator(
       image_uri="<your-training-image-uri>",
       role=execution_role_arn,
       instance_count=1,
       instance_type='ml.m4.xlarge',
       volume_size=20,
       max_run=3600,
       sagemaker_session=sagemaker_session,
       output_path="s3://<your-output-bucket>/example-tenant",
       enable_session_tag_chaining=True
   )
   
   estimator.fit(inputs=trainingInput, job_name="abac-demo")