Profile Applicability:

  • Level 1

Description:

Amazon SageMaker is a fully managed service for building, training, and deploying machine learning models. To enhance the security and privacy of SageMaker Models, network isolation can be enabled. When network isolation is enabled for a model, it ensures that the model does not have internet access and is isolated within the VPC. This SOP checks if Amazon SageMaker Models have network isolation enabled to ensure that the model operates in a secure and isolated environment.

Rationale:

  • Security: Enabling network isolation ensures that the SageMaker Models do not interact with the internet, providing better control over data privacy and reducing the risk of unauthorized access.

  • Compliance: For compliance with frameworks such as SOC 2 and HIPAA, restricting internet access and enabling network isolation may be required to meet data protection and privacy regulations.

  • Control: Network isolation helps prevent the model from making unintended connections to external resources, ensuring that all communication is controlled within the VPC.

Impact:

Pros:

  • Enhanced Security: Isolates the SageMaker Model from external networks, mitigating the risk of unauthorized data access.

  • Better Compliance: Ensures alignment with regulatory requirements for isolated environments and secure data handling.

  • Controlled Access: Provides strict control over model access and communications within the isolated network.

Cons:

  • Limited Access: Some models may require internet access for downloading external data or interacting with APIs. Network isolation may limit these capabilities, requiring workarounds such as using NAT Gateway or VPC endpoints.

  • Configuration Complexity: Enabling network isolation requires proper configuration of VPC settings, subnets, and security groups.

Default Value:

By default, Amazon SageMaker Models do not have network isolation enabled. It must be explicitly configured during model creation.

Pre-requisite:

  • AWS IAM Permissions:

    • sagemaker:DescribeModel

    • ec2:DescribeVpcs

    • ec2:DescribeSubnets

    • ec2:DescribeSecurityGroups

  • AWS CLI installed and configured.

  • SageMaker Model is created and operational.

  • VPC is set up with appropriate subnets, security groups, and access controls.

Test Plan:

Using AWS Console:

  1. Sign in to the AWS Management Console.

  2. Navigate to Amazon SageMaker under Services.

  3. In the SageMaker Dashboard, select Models.

  4. Choose the Model you want to review.

  5. Under Model details, check if network isolation is enabled:

    • Network isolation should be enabled if the VPC and subnets used for the model are configured to isolate it from the internet.

  6. If network isolation is not enabled, proceed with enabling it as described in the Implementation Steps.

Using AWS CLI:

  1. To describe the SageMaker Model and check if network isolation is enabled, run:

    aws sagemaker describe-model --model-name <model-name> --query 'ModelVpcConfig'

  2. Review the output and verify if VpcConfig has Subnets and SecurityGroupIds populated, indicating that the model is deployed with network isolation.

Implementation Steps:

Using AWS Console:

  1. Sign in to the AWS Management Console and navigate to Amazon SageMaker.

  2. In the SageMaker Dashboard, go to Models and choose the Model to modify.

  3. Under Network Configuration, enable Network Isolation by specifying a VPC and subnets for the model.

    • Choose private subnets for complete isolation.

    • Ensure that the Security Group allows controlled inbound and outbound traffic.

  4. Save the changes to apply network isolation.

Using AWS CLI:

  1. To create a SageMaker Model with network isolation enabled, use the following command:

    aws sagemaker create-model \
  --model-name <model-name> \
  --primary-container Image=<container-image> \
  --vpc-config Subnets=<subnet-id-1>,<subnet-id-2> SecurityGroupIds=<sg-id>

  1. To update an existing model to enable network isolation, run:

    aws sagemaker update-model \
  --model-name <model-name> \
  --vpc-config Subnets=<subnet-id-1>,<subnet-id-2> SecurityGroupIds=<sg-id>

  1. Verify the configuration by running:

    aws sagemaker describe-model --model-name <model-name> --query 'ModelVpcConfig'

  2. Ensure that VPC, subnets, and security groups are correctly configured for the model.

Backout Plan:

Using AWS Console:

  1. If network isolation causes issues with the model, sign in to the AWS Management Console.

  2. Navigate to Amazon SageMaker, select the model, and go to Edit.

  3. Remove the VPC configuration and security groups.

  4. Save the changes and verify that the model is no longer using network isolation.

Using AWS CLI:

  1. To remove the VPC settings, run the following command:

    aws sagemaker update-model --model-name <MODEL_NAME> --vpc-config "" --region <REGION>

  2. Verify that network isolation has been removed by describing the model:

    aws sagemaker describe-model --model-name <MODEL_NAME> --region <REGION>

References:

CIS Controls Mapping:

Version

Control ID

Control Description

IG1

IG2

IG3

v8

3.4

Encrypt Data on End-User Devices – Ensure data encryption during file system access.

●

●

●

v8

6.7

Implement Application Layer Filtering and Content Control – Ensure appropriate content filtering is applied to sensitive files.

●

●

●

v8

6.8

Define and Maintain Role-Based Access Control – Implement and manage role-based access for file systems.

●

●

●

v8

14.6

Protect Information Through Access Control Lists – Apply strict access control to file systems.

●

●

●