Skip to content

/AWS1/CL_SGMONLINESTORESECCFG

The security configuration for OnlineStore.

CONSTRUCTOR

IMPORTING

Optional arguments:

iv_kmskeyid TYPE /AWS1/SGMKMSKEYID /AWS1/SGMKMSKEYID

The Amazon Web Services Key Management Service (KMS) key ARN that SageMaker Feature Store uses to encrypt the Amazon S3 objects at rest using Amazon S3 server-side encryption.

The caller (either user or IAM role) of CreateFeatureGroup must have below permissions to the OnlineStore KmsKeyId:

  • "kms:Encrypt"

  • "kms:Decrypt"

  • "kms:DescribeKey"

  • "kms:CreateGrant"

  • "kms:RetireGrant"

  • "kms:ReEncryptFrom"

  • "kms:ReEncryptTo"

  • "kms:GenerateDataKey"

  • "kms:ListAliases"

  • "kms:ListGrants"

  • "kms:RevokeGrant"

The caller (either user or IAM role) to all DataPlane operations (PutRecord, GetRecord, DeleteRecord) must have the following permissions to the KmsKeyId:

  • "kms:Decrypt"

Queryable Attributes

KmsKeyId

The Amazon Web Services Key Management Service (KMS) key ARN that SageMaker Feature Store uses to encrypt the Amazon S3 objects at rest using Amazon S3 server-side encryption.

The caller (either user or IAM role) of CreateFeatureGroup must have below permissions to the OnlineStore KmsKeyId:

  • "kms:Encrypt"

  • "kms:Decrypt"

  • "kms:DescribeKey"

  • "kms:CreateGrant"

  • "kms:RetireGrant"

  • "kms:ReEncryptFrom"

  • "kms:ReEncryptTo"

  • "kms:GenerateDataKey"

  • "kms:ListAliases"

  • "kms:ListGrants"

  • "kms:RevokeGrant"

The caller (either user or IAM role) to all DataPlane operations (PutRecord, GetRecord, DeleteRecord) must have the following permissions to the KmsKeyId:

  • "kms:Decrypt"

Accessible with the following methods

Method Description
GET_KMSKEYID() Getter for KMSKEYID, with configurable default
ASK_KMSKEYID() Getter for KMSKEYID w/ exceptions if field has no value
HAS_KMSKEYID() Determine if KMSKEYID has a value