{"id":444,"date":"2020-10-24T01:02:57","date_gmt":"2020-10-24T01:02:57","guid":{"rendered":"https:\/\/machine-learning.webcloning.com\/2020\/10\/24\/securing-amazon-sagemaker-studio-connectivity-using-a-private-vpc\/"},"modified":"2020-10-24T01:02:57","modified_gmt":"2020-10-24T01:02:57","slug":"securing-amazon-sagemaker-studio-connectivity-using-a-private-vpc","status":"publish","type":"post","link":"https:\/\/salarydistribution.com\/machine-learning\/2020\/10\/24\/securing-amazon-sagemaker-studio-connectivity-using-a-private-vpc\/","title":{"rendered":"Securing Amazon SageMaker Studio connectivity using a private VPC"},"content":{"rendered":"
\n

Amazon SageMaker Studio<\/a> is the first fully integrated development environment (IDE) for machine learning (ML). With a single click, data scientists and developers can quickly spin up Amazon SageMaker Studio Notebooks<\/a> for exploring datasets and building models. With the new ability to launch Amazon SageMaker Studio in your Amazon Virtual Private Cloud<\/a> (Amazon VPC), you can control the data flow from your Amazon SageMaker Studio notebooks. This allows you to restrict internet access, monitor and inspect traffic using standard AWS networking and security capabilities, and connect to other AWS resources through AWS PrivateLink<\/a> or VPC endpoints.<\/p>\n

In this post, we explore how the Amazon SageMaker Studio VPC connectivity works, implement a sample architecture, and demonstrate some security controls in action.<\/p>\n

Solution overview<\/h2>\n

When experimenting with and deploying ML workflows, you need access to multiple resources, such as libraries, packages, and datasets. If you\u2019re in a highly regulated industry, controlling access to these resources is a paramount requirement. Amazon SageMaker Studio allows you to implement security in depth, with features such as data encryption, AWS Identity and Access Management<\/a> (IAM), and AWS Single Sign-On<\/a> (AWS SSO) integration. The ability to launch Amazon SageMaker Studio in your own private VPC adds another layer of security.<\/p>\n

Amazon SageMaker Studio runs on an environment managed by AWS. When launching a new Studio domain, the parameter AppNetworkAccessType<\/code> defines the external connectivity for such domain. Previously, the only option available for this parameter was DirectInternetOnly<\/code>, meaning the traffic from the notebook flowed from an AWS managed internet gateway, as described in the following diagram.<\/p>\n

\"\"<\/p>\n

The Amazon Elastic File System<\/a> (Amazon EFS) volumes that store the Studio users\u2019 home directories<\/a> resides in the customer VPC, even when AppNetworkAccessType=DirectInternetOnly<\/code>. You can optionally specify which VPC and subnet to use.<\/p>\n

With the newly introduced feature to launch Studio in your VPC, you can set the AppNetworkAccessType<\/code> parameter to VpcOnly<\/code>. This launches Studio inside the specified VPC, communicating with the domain through an elastic network interface (ENI). You can apply security groups to that ENI to enforce a first layer of security control.<\/p>\n

You can also use VPC endpoints to establish a private connection between the Studio domain and other AWS services, such as Amazon Simple Storage Service<\/a> (Amazon S3) for data storage and Amazon CloudWatch<\/a> for logging and monitoring, without requiring internet connectivity. VPC endpoints can impose additional networking controls such as VPC endpoint IAM policies that may, for example, only allow traffic to certain S3 buckets. The following diagram illustrates this architecture.<\/p>\n

\"\"<\/p>\n

Prerequisites<\/h2>\n

Before getting started, make sure you have the following prerequisites:<\/p>\n