Network isolation in Amazon SageMaker Unified Studio

Amazon SageMaker Unified Studio can be configured to limit from where your data is accessed and exposure of that data over the public internet. You can interact with Amazon SageMaker Unified Studio, and dependent AWS services, directly through interface endpoints in your Amazon VPC instead of connecting over the internet. When using Amazon VPC interface endpoints, communication between your Amazon VPC and Amazon SageMaker Unified Studio happens within the AWS network.

This topic discusses how customers can isolate their Amazon SageMaker Unified Studio portal experience by restricting Amazon SageMaker Unified Studio network traffic to stay within the AWS network.

Prerequisites

Before implementing these solutions, ensure you have:

Restrict Amazon SageMaker Unified Studio network traffic to within the AWS network

Your Amazon SageMaker Unified Studio domain and the data within can be configured to limit all traffic to only use the AWS network - and not pass through the public internet. With AWS PrivateLink, AWS service endpoints can be provisioned within your Amazon VPC, keeping customer data within the AWS network.

This level of network isolation means:

Disable Amazon Athena Spark in Amazon VPC-enabled domains

If your organization requires all compute traffic to stay within the Amazon VPC, you can disable Amazon Athena Spark by using the following controls.

If Amazon VPC endpoints are missing or misconfigured, network calls to Amazon SageMaker Unified Studio and other AWS services route over the public internet when that network path is available.

Step 1 - Deploy Amazon VPC endpoints

The Amazon SageMaker Unified Studio portal calls the following AWS services, each of which supports AWS PrivateLink Amazon VPC endpoints. The network traffic between the Amazon SageMaker Unified Studio portal and AWS services stays within the AWS network when the Amazon VPC endpoints are created in the Amazon VPC.

Create the Amazon VPC endpoint for each required AWS service API and any optional AWS service APIs from the tables below. To create a Amazon VPC endpoint see, Access an AWS service using an interface Amazon VPC endpoint.

For the list of AWS Services with support for AWS PrivateLink see, AWS services that integrate with AWS PrivateLink.

Amazon VPC endpoint considerations:

Required Amazon VPC endpoints

These Amazon VPC endpoints are required for Amazon SageMaker Unified Studio and supporting services to function correctly.

Optional Amazon VPC endpoints

Create these Amazon VPC endpoints if you plan to deploy Amazon SageMaker Unified Studio projects that include blueprints using the services listed below.

Step 2: Create an IAM policy

Create an IAM policy that only allows the Amazon SageMaker Unified Studio Portal web client to call AWS service APIs through VPC endpoints deployed in an allowed VPC(s). The global context condition key aws:SourceVpc in the IAM policy can be used to enforce this access for AWS service callers (Amazon SageMaker domain execution role, IAM user or role), and AWS Organizations service control policies.

This policy denies the Amazon SageMaker Unified Studio portal's access to all AWS service APIs when the API calls do not originate from within an allowed Amazon VPC. The Deny policy is applied when all of the three policy Conditions evaluate to true. You will need to replace the example VPC ID with your VPC ID or VPC ID list.

This policy may need to be modified if the domain execution role credentials are used in other contexts, or if this policy is applied to a role other than the domain execution role.

{
    "Version": "2012-10-17", 
    "Statement": [
        {
            "Sid": "DenyUserAccessFromUnauthorizedVPCs",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:SourceVpc": [
                        "vpc-1234567890abcdef0"
                    ]
                },
                "StringLike": {
                    "aws:userid": "*:user-*"
                },
                "BoolIfExists": {
                    "aws:ViaAWSService": "false"
                }
            }
        }
    ]
}

The following are details about the policy conditions:

"StringNotEquals": {
    "aws:SourceVpc": [
        "vpc-1234567890abcdef0"
    ]
}

This condition evaluates to true when the API call originates from a network location other than a VPC endpoint deployed in one of the allowed source Amazon VPC IDs.

"StringLike": { "aws:userid": "*:user-*" }

This condition evaluates to true for the domain execution role credentials issued to the Amazon SageMaker Unified Studio portal, so that the Deny policy is only applied for portal users. For example, the condition evaluates to false and the Deny policy is not applied when the Amazon SageMaker Unified Studio catalog service executes tasks that use the domain execution role.

"BoolIfExists": { "aws:ViaAWSService": "false" }

This condition evaluates to true when the API caller is not an AWS service (aws:ViaAWSService is false), which is the case for the Amazon SageMaker Unified Studio portal. When an AWS service calls another AWS service on behalf of the original caller, aws:ViaAWSService is true and the condition evaluates to false - allowing the AWS service call to another AWS service to succeed.

Step 3: Attach the custom policy

Attach the new custom policy to the SageMaker AI domain execution role. If SageMaker AI created this role for you it will be called AmazonSageMakerDomainExecution. The Amazon SageMaker Unified Studio portal uses the domain execution role for the Amazon SageMaker Unified Studio domain to call all AWS services. When a DENY by source Amazon VPC policy is added to the domain execution role, Amazon SageMaker Unified Studio portal calls to AWS service APIs from outside the allowed Amazon VPC will fail with Access denied. This policy can also be applied to an IAM user, IAM role or to an AWS Organizations service control policy.

Public internet access

Public internet access is required to load Amazon SageMaker Unified Studio clients and for client operations that do not handle customer data.

Public internet access for Amazon SageMaker Unified Studio portal

Running the Amazon SageMaker Unified Studio portal web client requires public internet access to download client assets (portal web application, plugins, and user interface components) and to call client management APIs. Customer data is not transmitted through these calls. These endpoints are used by the Amazon SageMaker Unified Studio portal.

Public internet access for IAM Identity Center login to Amazon SageMaker Unified Studio portal

When the Amazon SageMaker Unified Studio portal web client logs into a domain using AWS Identity and Access Management Identity Center (IDC) Single Sign-On (IAM Identity Center), public internet access is required. These endpoints are used by the Amazon SageMaker Unified Studio portal.

Public internet access for Amazon SageMaker Unified Studio on AWS console

Running the Amazon SageMaker Unified Studio console web client requires public internet access to download client assets (console web application, plugins, and user interface components) and to call AWS console platform APIs. Customer data is not transmitted through these calls. These endpoints are used by the AWS console.

Public internet access for IAM login to Amazon SageMaker Unified Studio portal

Amazon SageMaker Unified Studio domains that use IAM login for the Portal web client require the Amazon SageMaker Unified Studio Console. See the public internet access requirements for the Amazon SageMaker Unified Studio on AWS console above.

Amazon VPC troubleshooting

This section helps you diagnose and resolve common Amazon VPC configuration issues that affect notebook connectivity in Amazon SageMaker Unified Studio. Use the following table to identify your subnet configuration and determine the appropriate recovery action.

Convert a public subnet to a private subnet

A public subnet has a route to an internet gateway (IGW), which allows resources in the subnet to communicate directly with the internet. To convert a public subnet to a private subnet, remove the IGW route and disable auto-assign public IP.

To convert a public subnet to a private subnet

To disable auto-assign public IP

(Optional) If instances in the subnet need outbound internet access, add a NAT gateway route. For instructions, see Add a NAT gateway to a private subnet.

To verify the conversion

Add a NAT gateway to a private subnet

A NAT gateway allows instances in a private subnet to connect to the internet for outbound traffic while preventing unsolicited inbound connections. You must have a public subnet with an internet gateway route before you create a NAT gateway.

To create a NAT gateway

To update the private subnet route table

To verify the NAT gateway

Add Amazon VPC endpoints

Amazon VPC endpoints allow resources in your private subnets to communicate with AWS services without requiring internet access. There are two types of Amazon VPC endpoints:

The following are common endpoints to add for Amazon SageMaker Unified Studio notebook connectivity:

To create a gateway endpoint

To create an interface endpoint

To verify Amazon VPC endpoints