Monitoring user resource access from Amazon SageMaker Studio Classic
With Amazon SageMaker Studio Classic, you can monitor user resource access. To view resource access activity, you can configure AWS CloudTrail to monitor and record user activities by following the steps in Log Amazon SageMaker API Calls with AWS CloudTrail.
However, the AWS CloudTrail logs for resource access only list the Studio Classic execution IAM role as the identifier. This level of logging is enough to audit user activity when each user profile has a distinct execution role. However, when a single execution IAM role is shared between several user profiles, you can't get information about the specific user that accessed the AWS resources.
You can get information about which specific user performed an action in an
AWS CloudTrail log when using a shared execution role, using
the sourceIdentity
configuration to propagate the Studio Classic user profile name.
For more information about source identity, see Monitor and control
actions taken with assumed roles.
Prerequisites
-
Install and configure the AWS Command Line Interface following the steps in Installing or updating the latest version of the AWS CLI.
-
Ensure that Studio Classic users in your domain don’t have a policy that allows them to update or modify the domain.
-
To turn on or turn off
sourceIdentity
propagation, all apps in the domain must be in theStopped
orDeleted
state. For more information about how to stop and shut down apps, see Shut down and Update Studio Classic Apps. -
If source identity propagation is turned on, all execution roles must have the following trust policy permissions:
-
Any role that the domain's execution role assumes must have the
sts:SetSourceIdentity
permission in the trust policy. If this permission is missing, your actions fail withAccessDeniedException
orValidationError
when you call the job creation API. The following example trust policy includes thests:SetSourceIdentity
permission.{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "sagemaker.amazonaws.com" }, "Action": [ "sts:AssumeRole", "sts:SetSourceIdentity" ] } ] }
-
When you assume a role with another role, called role chaining, do the following:
-
Permissions for
sts:SetSourceIdentity
are required in both the permissions policy of the principal that is assuming the role, and in the role trust policy of the target role. Otherwise, the assume role operation will fail. -
This role chaining can happen in Studio Classic or any other downstream service, such as Amazon EMR. For more information about role chaining, see Roles terms and concepts.
-
-
Considerations when using sourceIdentity
When you make AWS API calls from Studio Classic notebooks, SageMaker Canvas, or Amazon SageMaker Data Wrangler, the
sourceIdentity
is only recorded in CloudTrail if those calls are made using the
Studio Classic execution role session or any chained
role from that session.
When these API calls invoke other services to perform additional operations,
sourceIdentity
logging depends on the specific implementation of the invoked
services.
-
Amazon SageMaker Processing: When you create a job using these features, the job creation APIs are not able to ingest the
sourceIdentity
that exists in the session. As a result, any AWS API calls made from these jobs do not recordsourceIdentity
in the CloudTrail logs. -
Amazon SageMaker Training: When you create a training job, the job creation APIs are able to ingest the
sourceIdentity
that exists in the session. As a result, any AWS API calls made from these jobs recordsourceIdentity
in the CloudTrail logs. Amazon SageMaker Model Building Pipelines: When you create jobs using automated CI/CD pipelines,
sourceIdentity
propagates downstream and can be viewed in the CloudTrail logs.-
Amazon EMR: When connecting to Amazon EMR from Studio Classic using runtime roles, administrators must explicitly set the PropagateSourceIdentity field. This ensures that Amazon EMR applies the
sourceIdentity
from the calling credentials to a job or query session. ThesourceIdentity
is then recorded in CloudTrail logs.
Note
The following exceptions apply when using sourceIdentity
.
-
SageMaker Studio Classic shared spaces do not support
sourceIdentity
passthrough. AWS API calls made from SageMaker shared spaces do not recordsourceIdentity
in CloudTrail logs. -
If AWS API calls are made from sessions that are created by users or other services and the sessions are not based on the Studio Classic execution role session, then the
sourceIdentity
is not recorded in CloudTrail logs.
Turn on sourceIdentity
The ability to propagate the user profile name as the sourceIdentity
in
Studio Classic is turned off by default.
To enable the ability to propagate the user profile name as the
sourceIdentity
, use the AWS CLI during domain creation and domain update. This
feature is enabled at the domain level and not at the user profile level.
After you enable this configuration, administrators can view the user profile in the
AWS CloudTrail log for the service accessed. The user profile is given as the
sourceIdentity
value in the userIdentity
section. For more
information about using AWS CloudTrail logs with SageMaker, see Log Amazon SageMaker
API Calls with AWS CloudTrail.
You can use the following code to enable the propagation of the user profile name as the
sourceIdentity
during domain creation using the create-domain
API.
create-domain --domain-name <value> --auth-mode <value> --default-user-settings <value> --subnet-ids <value> --vpc-id <value> [--tags <value>] [--app-network-access-type <value>] [--home-efs-file-system-kms-key-id <value>] [--kms-key-id <value>] [--app-security-group-management <value>] [--domain-settings "ExecutionRoleIdentityConfig=USER_PROFILE_NAME"] [--cli-input-json <value>] [--generate-cli-skeleton <value>]
You can enable the propagation of the user profile name as the sourceIdentity
during domain update using the update-domain
API.
To update this configuration, all apps in the domain must be in the Stopped
or Deleted
state. For more information about how to stop and shut down apps, see
Shut
down and Update Studio Classic Apps.
Use the following code to enable the propagation of the user profile name as the
sourceIdentity
.
update-domain --domain-id <value> [--default-user-settings <value>] [--domain-settings-for-update "ExecutionRoleIdentityConfig=USER_PROFILE_NAME"] [--cli-input-json <value>] [--generate-cli-skeleton <value>]
Turn off sourceIdentity
You can also turn off the propagation of the user profile name as the
sourceIdentity
using the AWS CLI. This occurs during domain update by passing
the ExecutionRoleIdentityConfig=DISABLED
value for
the --domain-settings-for-update
parameter as part of the
update-domain
API call.
In the AWS CLI, use the following code to disable the propagation of the user profile name
as the sourceIdentity
.
update-domain --domain-id <value> [--default-user-settings <value>] [--domain-settings-for-update "ExecutionRoleIdentityConfig=DISABLED"] [--cli-input-json <value>] [--generate-cli-skeleton <value>]