View a markdown version of this page

Configuring service control policies for monitoring schedules - Amazon SageMaker AI

Configuring service control policies for monitoring schedules

Note

Amazon SageMaker Model Monitor is no longer open to new customers. Existing customers can continue to use the service as normal. AWS continues to invest in security and availability improvements for Model Monitor, but we do not plan to introduce new features. For more information, see Amazon SageMaker Model Monitor availability change.

You have to specify the parameters of a monitoring job when you create or update a schedule for it with the CreateMonitoringSchedule API or the UpdateMonitoringSchedule API, respectively. Depending on your use case, you can do this in one of the following ways:

The aforementioned processes are mutually exclusive, that is, you can either specify the MonitoringJobDefinition field or the MonitoringJobDefinitionName field when creating or updating monitoring schedules.

When you create a monitoring job definition, or specify one in the MonitoringJobDefinition field, you can set security parameters, such as NetworkConfig and VolumeKmsKeyId. As an administrator, you might want that these parameters are always set to certain values, so that the monitoring jobs always run in a secure environment. To ensure this, set up appropriate Service control policies (SCPs). SCPs are a type of organization policy that you can use to manage permissions in your organization.

The following example shows a SCP that you can use to ensure that infrastructure parameters are properly set when creating or updating schedules for monitoring jobs.

JSON
{
    "Version":"2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "sagemaker:CreateDataQualityJobDefinition",
                "sagemaker:CreateModelBiasJobDefinition",
                "sagemaker:CreateModelExplainabilityJobDefinition",
                "sagemaker:CreateModelQualityJobDefinition"
            ],
            "Resource": "arn:*:sagemaker:*:*:*",
            "Condition": {
                "Null": {
                    "sagemaker:VolumeKmsKey":"true",
                    "sagemaker:VpcSubnets": "true",
                    "sagemaker:VpcSecurityGroupIds": "true"
                }
            }
        },
        {
            "Effect": "Deny",
            "Action": [
                "sagemaker:CreateDataQualityJobDefinition",
                "sagemaker:CreateModelBiasJobDefinition",
                "sagemaker:CreateModelExplainabilityJobDefinition",
                "sagemaker:CreateModelQualityJobDefinition"
            ],
            "Resource": "arn:*:sagemaker:*:*:*",
            "Condition": {
                "Bool": {
                    "sagemaker:InterContainerTrafficEncryption": "false"
                }
            }
        },
        {
            "Effect": "Deny",
            "Action": [
                "sagemaker:CreateMonitoringSchedule",
                "sagemaker:UpdateMonitoringSchedule"
            ],
            "Resource": "arn:*:sagemaker:*:*:monitoring-schedule/*",
            "Condition": {
                "Null": {
                    "sagemaker:ModelMonitorJobDefinitionName": "true"
                }
            }
        }
    ]
}

The first two rules in the example, ensure that the security parameters are always set for monitoring job definitions. The final rule requires that anyone, in your organization, creating or updating a schedule, have to always specify the MonitoringJobDefinitionName field. This ensures that no one in your organization, can set insecure values for the security parameters by specifying the MonitoringJobDefinition field, when creating or updating schedules.