Profile Applicability:
Level 2
Description:
Amazon SageMaker provides fully managed machine learning services for building, training, and deploying models. Intercontainer encryption ensures that data transmitted between containers during the training job is encrypted, protecting sensitive data in transit. By enabling intercontainer encryption, you can ensure that any communications between containers are secured, reducing the risk of data exposure or interception.
Rationale:
Enabling intercontainer encryption for SageMaker training jobs ensures that data transferred between containers during training is encrypted in transit, improving the overall security of machine learning workloads. This is especially crucial when dealing with sensitive data or when training jobs involve multiple containers communicating with each other.
Impact:
Pros:
Protects sensitive data during training by encrypting communication between containers.
Helps comply with data protection and privacy regulations.
Provides additional security layer in multi-container training jobs.
Cons:
Slightly increases overhead in terms of performance due to encryption and decryption processes.
May require additional configuration in terms of IAM roles and encryption keys.
Default Value:
By default, Amazon SageMaker does not have intercontainer encryption enabled. It must be manually configured when creating the training job.
Pre-requisites:
AWS IAM permissions:
sagemaker:CreateTrainingJob
sagemaker:DescribeTrainingJobAmazon SageMaker environment with an active training job.
Encryption key in AWS KMS (Key Management Service), if needed.
Remediation:
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to SageMaker and review the list of training jobs.
Select the training job that you want to check for intercontainer encryption.
Under the Job details tab, locate the Encryption section.
Verify if Intercontainer encryption is enabled.
If intercontainer encryption is not enabled, modify the job by selecting a KMS key for encryption.
Using AWS CLI:
List the training jobs:
aws sagemaker list-training-jobs --query "TrainingJobSummaries[*].TrainingJobName"
For each training job, check if intercontainer encryption is enabled:
aws sagemaker describe-training-job --training-job-name <TRAINING_JOB_NAME> --query "TrainingJob.StaticHyperParameters"
If encryption is not enabled, configure the training job to use intercontainer encryption by running:
aws sagemaker create-training-job --training-job-name <TRAINING_JOB_NAME> --role <IAM_ROLE> --algorithm-specification TrainingImage=<IMAGE_URL>,TrainingInputMode=File --input-data-config <INPUT_DATA_CONFIG> --output-data-config <OUTPUT_DATA_CONFIG> --resource-config <RESOURCE_CONFIG> --encryption-config "InterContainerEncryptionEnabled=true,EncryptionKeyId=<KMS_KEY_ID>"
Implementation Plan:
Using AWS Console:
Navigate to Amazon SageMaker and select Create Training Job.
Under Encryption Configurations, ensure Intercontainer Encryption is enabled.
Select the encryption key from AWS KMS or create a new one.
Continue with the setup and create the training job.
Monitor the training job to ensure that intercontainer encryption is active and data is securely transmitted.
Using AWS CLI:
Ensure that the create-training-job command is used with the InterContainerEncryptionEnabled parameter set to true:
aws sagemaker create-training-job --training-job-name <TRAINING_JOB_NAME> --role <IAM_ROLE> --encryption-config "InterContainerEncryptionEnabled=true,EncryptionKeyId=<KMS_KEY_ID>"
Verify that encryption is enabled by running:
aws sagemaker describe-training-job --training-job-name <TRAINING_JOB_NAME>
Backout Plan:
If enabling intercontainer encryption causes issues:
Identify the affected training job and review the encryption configuration.
Disable intercontainer encryption by running:
aws sagemaker update-training-job --training-job-name <TRAINING_JOB_NAME> --encryption-config "InterContainerEncryptionEnabled=false"
Verify that data is no longer encrypted during intercontainer communication and troubleshoot any issues related to encryption configuration or IAM permissions.
Document the changes and backout process for auditing purposes.
Reference:
CIS Controls:
